This is the start of the stable review cycle for the 6.6.110 release.
There are 7 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sun, 05 Oct 2025 16:02:25 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.110-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 6.6.110-rc1
Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com>
ASoC: qcom: audioreach: fix potential null pointer dereference
Thadeu Lima de Souza Cascardo <cascardo(a)igalia.com>
media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID
Larshin Sergey <Sergey.Larshin(a)kaspersky.com>
media: rc: fix races with imon_disconnect()
Duoming Zhou <duoming(a)zju.edu.cn>
media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove
Wang Haoran <haoranwangsec(a)gmail.com>
scsi: target: target_core_configfs: Add length check to avoid buffer overflow
Kees Cook <kees(a)kernel.org>
gcc-plugins: Remove TODO_verify_il for GCC >= 16
Breno Leitao <leitao(a)debian.org>
crypto: sha256 - fix crash at kexec
-------------
Diffstat:
Makefile | 4 +-
drivers/media/pci/b2c2/flexcop-pci.c | 2 +-
drivers/media/rc/imon.c | 27 +++++++++----
drivers/media/usb/uvc/uvc_driver.c | 73 ++++++++++++++++++++++-------------
drivers/media/usb/uvc/uvcvideo.h | 2 +
drivers/target/target_core_configfs.c | 2 +-
include/crypto/sha256_base.h | 2 +-
scripts/gcc-plugins/gcc-common.h | 7 ++++
sound/soc/qcom/qdsp6/topology.c | 4 +-
9 files changed, 82 insertions(+), 41 deletions(-)
This is the start of the stable review cycle for the 6.16.11 release.
There are 14 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sun, 05 Oct 2025 16:02:25 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.16.11-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.16.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 6.16.11-rc1
Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com>
ASoC: qcom: audioreach: fix potential null pointer dereference
Chandra Mohan Sundar <chandramohan.explore(a)gmail.com>
media: stm32-csi: Fix dereference before NULL check
Dikshita Agarwal <quic_dikshita(a)quicinc.com>
media: iris: Fix memory leak by freeing untracked persist buffer
Matvey Kovalev <matvey.kovalev(a)ispras.ru>
wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load()
Charan Teja Kalla <charan.kalla(a)oss.qualcomm.com>
mm: swap: check for stable address space before operating on the VMA
Thadeu Lima de Souza Cascardo <cascardo(a)igalia.com>
media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID
Larshin Sergey <Sergey.Larshin(a)kaspersky.com>
media: rc: fix races with imon_disconnect()
Duoming Zhou <duoming(a)zju.edu.cn>
media: tuner: xc5000: Fix use-after-free in xc5000_release
Duoming Zhou <duoming(a)zju.edu.cn>
media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe
Duoming Zhou <duoming(a)zju.edu.cn>
media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove
Jeongjun Park <aha310510(a)gmail.com>
ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free
Wang Haoran <haoranwangsec(a)gmail.com>
scsi: target: target_core_configfs: Add length check to avoid buffer overflow
Kees Cook <kees(a)kernel.org>
gcc-plugins: Remove TODO_verify_il for GCC >= 16
Yu Kuai <yukuai3(a)huawei.com>
blk-mq: fix blk_mq_tags double free while nr_requests grown
-------------
Diffstat:
Makefile | 4 +-
block/blk-mq-tag.c | 1 +
drivers/media/i2c/tc358743.c | 4 +-
drivers/media/pci/b2c2/flexcop-pci.c | 2 +-
drivers/media/platform/qcom/iris/iris_buffer.c | 10 ++++
drivers/media/platform/st/stm32/stm32-csi.c | 4 +-
drivers/media/rc/imon.c | 27 +++++++---
drivers/media/tuners/xc5000.c | 2 +-
drivers/media/usb/uvc/uvc_driver.c | 73 ++++++++++++++++----------
drivers/media/usb/uvc/uvcvideo.h | 2 +
drivers/net/wireless/ath/ath11k/qmi.c | 2 +-
drivers/target/target_core_configfs.c | 2 +-
mm/swapfile.c | 3 ++
scripts/gcc-plugins/gcc-common.h | 7 +++
sound/soc/qcom/qdsp6/topology.c | 4 +-
sound/usb/midi.c | 9 ++--
16 files changed, 105 insertions(+), 51 deletions(-)
This is the start of the stable review cycle for the 6.17.1 release.
There are 15 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sun, 05 Oct 2025 16:02:25 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.17.1-rc1…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.17.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 6.17.1-rc1
Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com>
ASoC: qcom: audioreach: fix potential null pointer dereference
Chandra Mohan Sundar <chandramohan.explore(a)gmail.com>
media: stm32-csi: Fix dereference before NULL check
Dikshita Agarwal <quic_dikshita(a)quicinc.com>
media: iris: Fix memory leak by freeing untracked persist buffer
Matvey Kovalev <matvey.kovalev(a)ispras.ru>
wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load()
Charan Teja Kalla <charan.kalla(a)oss.qualcomm.com>
mm: swap: check for stable address space before operating on the VMA
Thadeu Lima de Souza Cascardo <cascardo(a)igalia.com>
media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID
Larshin Sergey <Sergey.Larshin(a)kaspersky.com>
media: rc: fix races with imon_disconnect()
Duoming Zhou <duoming(a)zju.edu.cn>
media: tuner: xc5000: Fix use-after-free in xc5000_release
Duoming Zhou <duoming(a)zju.edu.cn>
media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe
Duoming Zhou <duoming(a)zju.edu.cn>
media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove
Fedor Pchelkin <pchelkin(a)ispras.ru>
wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait()
Jeongjun Park <aha310510(a)gmail.com>
ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free
Wang Haoran <haoranwangsec(a)gmail.com>
scsi: target: target_core_configfs: Add length check to avoid buffer overflow
Kees Cook <kees(a)kernel.org>
gcc-plugins: Remove TODO_verify_il for GCC >= 16
Yu Kuai <yukuai3(a)huawei.com>
blk-mq: fix blk_mq_tags double free while nr_requests grown
-------------
Diffstat:
Makefile | 4 +-
block/blk-mq-tag.c | 1 +
drivers/media/i2c/tc358743.c | 4 +-
drivers/media/pci/b2c2/flexcop-pci.c | 2 +-
drivers/media/platform/qcom/iris/iris_buffer.c | 10 ++++
drivers/media/platform/st/stm32/stm32-csi.c | 4 +-
drivers/media/rc/imon.c | 27 +++++++---
drivers/media/tuners/xc5000.c | 2 +-
drivers/media/usb/uvc/uvc_driver.c | 73 ++++++++++++++++----------
drivers/media/usb/uvc/uvcvideo.h | 2 +
drivers/net/wireless/ath/ath11k/qmi.c | 2 +-
drivers/net/wireless/realtek/rtw89/core.c | 30 ++++++++---
drivers/net/wireless/realtek/rtw89/core.h | 35 +++++++++++-
drivers/net/wireless/realtek/rtw89/pci.c | 3 +-
drivers/net/wireless/realtek/rtw89/ser.c | 2 +
drivers/target/target_core_configfs.c | 2 +-
mm/swapfile.c | 3 ++
scripts/gcc-plugins/gcc-common.h | 7 +++
sound/soc/qcom/qdsp6/topology.c | 4 +-
sound/usb/midi.c | 9 ++--
20 files changed, 166 insertions(+), 60 deletions(-)
Total jobs: 120
Total errors: 61 (50.83%)
LAVA errors: 0 (0.00%)
Test errors: 57 (47.50%)
Job errors: 2 (1.67%)
Infra errors: 2 (1.67%)
Canceled jobs: 0 (0.00%)
Device type: rk3399-rock-pi-4b
Total jobs: 1
Total errors: 0 (0.00%)
Device type: dragonboard-845c
Total jobs: 80
Total errors: 39 (48.75%)
Error type: Test
Error count: 37 (46.25%)
Error: No match for error type 'Test', message 'tradefed - adb device lost[a6622a22]'
Count: 4 (5.00%)
IDs:
db845c-09:
8477528 8477633 8478003 8478059
Error: No match for error type 'Test', message 'tradefed - adb device lost[f3a58ae3]'
Count: 4 (5.00%)
IDs:
db845c-04:
8477584 8478001 8478044 8478048
Error: No match for error type 'Test', message 'tradefed - adb device lost[d9b7d9b]'
Count: 5 (6.25%)
IDs:
db845c-05:
8477591 8477639 8477717 8478019 8478046
Error: No match for error type 'Test', message 'tradefed - adb device lost[e875976d]'
Count: 3 (3.75%)
IDs:
db845c-06:
8477554 8478005 8478043
Error: No match for error type 'Test', message 'tradefed - adb device lost[476f370a]'
Count: 3 (3.75%)
IDs:
db845c-10:
8477577 8477700 8478036
Error: Device NOT found!
Count: 1 (1.25%)
IDs:
db845c-04:
8478035
Error: No match for error type 'Test', message 'tradefed - adb device lost[d966d3f5]'
Count: 3 (3.75%)
IDs:
db845c-03:
8477556 8477685 8478030
Error: No match for error type 'Test', message 'tradefed - adb device lost[dd3b965f]'
Count: 4 (5.00%)
IDs:
db845c-02:
8477553 8477590 8477644 8478020
Error: No match for error type 'Test', message 'Device NOT found after DUT booted up! adb wait-for-device timed out after 300s'
Count: 7 (8.75%)
IDs:
db845c-05:
8477520 8477530 8478014
db845c-09:
8477559 8477646 8477694 8477834
Error: No match for error type 'Test', message 'tradefed - adb device lost[30e1e2ee]'
Count: 1 (1.25%)
IDs:
db845c-08:
8477993
Error: No match for error type 'Test', message 'lava-test-interactive timed out after 600 seconds'
Count: 1 (1.25%)
IDs:
db845c-06:
8477719
Error: No match for error type 'Test', message 'lava-docker-test-shell timed out after 598 seconds'
Count: 1 (1.25%)
IDs:
db845c-10:
8477557
Error type: Job
Error count: 2 (2.50%)
Error: No match for error type 'Job', message 'login-action timed out after 873 seconds'
Count: 2 (2.50%)
IDs:
db845c-04:
8478016
db845c-09:
8478052
Device type: qrb5165-rb5
Total jobs: 35
Total errors: 19 (54.29%)
Error type: Test
Error count: 17 (48.57%)
Error: No match for error type 'Test', message 'tradefed - adb device lost[4fc7b22]'
Count: 3 (8.57%)
IDs:
rb5-06:
8477704 8477813 8478006
Error: Device NOT found!
Count: 1 (2.86%)
IDs:
rb5-05:
8477986
Error: No match for error type 'Test', message 'tradefed - adb device lost[d8a1879f]'
Count: 2 (5.71%)
IDs:
rb5-07:
8477711 8477720
Error: No match for error type 'Test', message 'tradefed - adb device lost[74d67c95]'
Count: 3 (8.57%)
IDs:
rb5-03:
8477587 8477707 8477716
Error: No match for error type 'Test', message 'Device NOT found after DUT booted up! adb wait-for-device timed out after 300s'
Count: 6 (17.14%)
IDs:
rb5-05:
8477589 8477593
rb5-07:
8477678 8477687 8477697 8477710
Error: No match for error type 'Test', message 'tradefed - adb device lost[93dcfd96]'
Count: 1 (2.86%)
IDs:
rb5-01:
8477653
Error: No match for error type 'Test', message 'tradefed - adb device lost[f11b68eb]'
Count: 1 (2.86%)
IDs:
rb5-05:
8477599
Error type: Infrastructure
Error count: 2 (5.71%)
Error: Connection closed
Count: 2 (5.71%)
IDs:
rb5-01:
8477601 8477698
Device type: sm8550-hdk
Total jobs: 4
Total errors: 3 (75.00%)
Error type: Test
Error count: 3 (75.00%)
Error: No match for error type 'Test', message 'tradefed - adb device lost[124d1c34]'
Count: 2 (50.00%)
IDs:
sm8550-hdk-01:
8477692 8477702
Error: No match for error type 'Test', message 'Device NOT found after DUT booted up! adb wait-for-device timed out after 300s'
Count: 1 (25.00%)
IDs:
sm8550-hdk-01:
8477689