Lkft-triage

lkft-triage@lists.linaro.org

32 participants
34216 discussions

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.6.153 release. There are 166 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat, 22 Aug 2026 14:51:11 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.153-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.6.153-rc1 Paolo Abeni <pabeni(a)redhat.com> net: harmonize tstats and dstats Christian Brauner <brauner(a)kernel.org> binfmt_misc: use exe_file_deny_write_access() for the interpreter clone Baul Lee <baul.lee(a)xbow.com> net/x25: fix use-after-free of the socket by its timers Gao Xiang <xiang(a)kernel.org> erofs: fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: cls_bpf: reject dev-bound programs bound to a different device Siddharth Vadapalli <s-vadapalli(a)ti.com> net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG Uwe Kleine-König <ukleinek(a)kernel.org> m68k: Define NR_CPUS to 1 Christoph Hellwig <hch(a)lst.de> m68k: use the coherent DMA code for coldfire without data cache Christoph Hellwig <hch(a)lst.de> dma-direct: add a CONFIG_ARCH_HAS_DMA_ALLOC symbol Zhang Changzhong <zhangchangzhong(a)huawei.com> net/sched: cls_u32: skip hash tables in u32_bind_class() Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain Victor Nogueira <victor(a)mojatatu.com> net: sched: Add initial TC error skb drop reasons Victor Nogueira <victor(a)mojatatu.com> net: sched: Move drop_reason to struct tc_skb_cb Yan Zhai <yan(a)cloudflare.com> packet: add a generic drop reason for receive Jamal Hadi Salim <jhs(a)mojatatu.com> net, sched: Fix SKB_NOT_DROPPED_YET splat under debug config Daniel Borkmann <daniel(a)iogearbox.net> net, sched: Add tcf_set_drop_reason for {__,}tcf_classify Daniel Borkmann <daniel(a)iogearbox.net> net, sched: Make tc-related drop reason more flexible Eric Dumazet <edumazet(a)google.com> af_packet: Don't send zero-byte data in tpacket_snd(). Rosen Penev <rosenp(a)gmail.com> ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers Chuck Lever <cel(a)kernel.org> net/tls: Fail tls_sw_splice_read() after a failed async decrypt Wei Fang <wei.fang(a)nxp.com> net: packet: fix wrong transport_header when sending VLAN-tagged frame Eric Dumazet <edumazet(a)google.com> macvlan: inherit needed_headroom and needed_tailroom from lowerdev Eric Dumazet <edumazet(a)google.com> ipvlan: inherit needed_headroom and needed_tailroom from phy_dev Florian Westphal <fw(a)strlen.de> netfilter: ipset: let destroy callbacks adjust ext mem size Florian Westphal <fw(a)strlen.de> netfilter: ipset: fix list type element drift bug Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> netfilter: flowtable: publish GC-visible tuple last Alexey Velichayshiy <a.velichayshiy(a)ispras.ru> netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path Xiang Mei (Microsoft) <xmei5(a)asu.edu> netfilter: ipset: fix refcount race between list:set GC and swap Herbert Xu <herbert(a)gondor.apana.org.au> crypto: ccm - Set rfc4309 maxauthsize from child Jon Hunter <jonathanh(a)nvidia.com> arm64: tegra: Add EL2 virtual timer interrupt for Tegra194 Lorenzo Stoakes (ARM) <ljs(a)kernel.org> mm/huge_memory: fix huge_zero_pfn race Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> tls: rx: restore msg_iter before TLS 1.3 optimistic retry Sabrina Dubroca <sd(a)queasysnail.net> selftests: tls: add rekey tests Paolo Bonzini <pbonzini(a)redhat.com> KVM: SVM: Serialize accesses to the owner and mirror list with separate lock Lorenzo Stoakes (ARM) <ljs(a)kernel.org> mm/ptdump: always stabilise against page table freeing using init_mm Lorenzo Stoakes (ARM) <ljs(a)kernel.org> mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> mm/pagewalk: split walk_page_range_novma() into kernel/user parts Pierre-Eric Pelloux-Prayer <pierre-eric.pelloux-prayer(a)amd.com> drm/amdgpu: move debug_vm handling to amdgpu_cs_parser_fini Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: fix pptable use-after-free Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: fix torn gpu metrics reads Tu Nguyen <tu.nguyen.xg(a)renesas.com> can: rcar_canfd: change the initializing flow for clocks and resets Jonas Gorski <jonas.gorski(a)bisdn.de> i2c: iproc: reset bus after timeout if START_BUSY is stuck Wolfram Sang <wsa+renesas(a)sang-engineering.com> i2c: bcm-iproc: remove printout on handled timeouts Eric Dumazet <edumazet(a)google.com> vxlan: use pskb_network_may_pull() for transmit path header pulls Guillaume Nault <gnault(a)redhat.com> vxlan: Handle stats using NETDEV_PCPU_STAT_DSTATS. Guillaume Nault <gnault(a)redhat.com> vrf: Make pcpu_dstats update functions available to other modules. Jeremy Kerr <jk(a)codeconstruct.com.au> net: core,vrf: Change pcpu_dstat fields to u64_stats_t Breno Leitao <leitao(a)debian.org> vxlan: Do not alloc tstats manually Dawid Osuchowski <dawid.osuchowski(a)linux.intel.com> ice: fix VF interrupts cleanup Christian Brauner <brauner(a)kernel.org> binfmt_misc: restore write access when removing an entry Amir Goldstein <amir73il(a)gmail.com> fs: don't block write during exec on pre-content watched files Matt Fleming <mfleming(a)cloudflare.com> veth: convert frag_list skbs before running XDP Chengfeng Ye <nicoyip.dev(a)gmail.com> net: pktgen: fix proc entry use-after-free Peter Seiderer <ps.report(a)gmx.net> net: pktgen: fix code style (WARNING: Block comments) Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: reject repeated SMB2 NEGOTIATE requests Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: conn lock to serialize smb2 negotiate David Carlier <devnexen(a)gmail.com> igc: remove napi_synchronize() in igc_down() Mark Brown <broonie(a)kernel.org> ASoC: tas2562: Validate values for volume writes Chengfeng Ye <nicoyip.dev(a)gmail.com> Bluetooth: hci_sync: Fix advertising data UAFs Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: eir: Fix possible crashes on eir_create_adv_data Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_core: Fix not handling hdev->le_num_of_adv_sets=1 Gustavo A. R. Silva <gustavoars(a)kernel.org> Bluetooth: hci_conn, hci_sync: Use __counted_by() to avoid -Wfamnae warnings Kees Cook <keescook(a)chromium.org> overflow: Change DEFINE_FLEX to take __counted_by member Maciej Fijalkowski <maciej.fijalkowski(a)intel.com> ice: make ice_vsi_cfg_rxq() static Przemek Kitszel <przemyslaw.kitszel(a)intel.com> ice: make use of DEFINE_FLEX() in ice_switch.c Kefeng Wang <wangkefeng.wang(a)huawei.com> mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE Guanghui Yang <3497809730(a)qq.com> btrfs: zoned: fix missing chunk metadata reservation Filipe Manana <fdmanana(a)suse.com> btrfs: remove fs_info argument from btrfs_zoned_activate_one_bg() Naohiro Aota <naohiro.aota(a)wdc.com> btrfs: add space_info argument to btrfs_chunk_alloc() David Sterba <dsterba(a)suse.com> btrfs: add debug build only WARN Yuxiang Yang <yangyx22(a)mails.tsinghua.edu.cn> tcp: challenge ACK for non-exact RST in SYN-RECEIVED Ilpo Järvinen <ij(a)kernel.org> tcp: fast path functions later Ilpo Järvinen <ij(a)kernel.org> tcp: Pass flags to __tcp_send_ack Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: validate minimum PDU size for transform requests ChenXiaoSong <chenxiaosong(a)kylinos.cn> smb/server: fix minimum SMB2 PDU size ChenXiaoSong <chenxiaosong(a)kylinos.cn> smb/server: fix minimum SMB1 PDU size Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: rename smb2_get_msg to smb_get_msg ChenXiaoSong <chenxiaosong(a)kylinos.cn> smb/server: rename include guard in smb_common.h ZhangGuoDong <zhangguodong(a)kylinos.cn> smb: move get_rfc1002_len() to common/smbglob.h ZhangGuoDong <zhangguodong(a)kylinos.cn> smb: move smb_version_values to common/smbglob.h Christian Brauner <brauner(a)kernel.org> super: fix emergency thaw deadlock on frozen block devices Aldo Ariel Panzardo <qwe.aldo(a)gmail.com> net/sched: serialize qdisc_rtab_list against concurrent get/put Shiming Cheng <shiming.cheng(a)mediatek.com> net: gro: fix double aggregation of flush-marked skbs Felix Fietkau <nbd(a)nbd.name> net: move skb_gro_receive_list from udp to core Pavitra Jha <jhapavitra98(a)gmail.com> libceph: fix two unsafe bare decodes in decode_lockers() Mike Rapoport (Microsoft) <rppt(a)kernel.org> userfaultfd: prevent registration of special VMAs Mike Rapoport (Microsoft) <rppt(a)kernel.org> userfaultfd: move vma_can_userfault out of line Chunyan Zhang <zhangchunyan(a)iscas.ac.cn> mm: userfaultfd: add pgtable_supports_uffd_wp() Zhang Yi <yi.zhang(a)huawei.com> iomap: fix out-of-bounds bitmap_set() with zero-length range Matthew Wilcox (Oracle) <willy(a)infradead.org> iomap: hold state_lock over call to ifs_set_range_uptodate() Chancel Liu <chancel.liu(a)nxp.com> ASoC: fsl_sai: Fix spurious BCLK on resume by clearing BYP Xiang Mei <xmei5(a)asu.edu> libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> libceph: Amend checking to fix `make W=1` build breakage Matthew Wilcox (Oracle) <willy(a)infradead.org> ceph: Use a folio in ceph_page_mkwrite() Max Kellermann <max.kellermann(a)ionos.com> ceph: fix hanging __ceph_get_caps() with stale mds_wanted Matthew Wilcox (Oracle) <willy(a)infradead.org> ceph: Remove ceph_writepage() Max Kellermann <max.kellermann(a)ionos.com> ceph: avoid fs reclaim while using current->journal_info Sabrina Dubroca <sd(a)queasysnail.net> selftests: tls: add test with a partially invalid iov Palmer Dabbelt <palmer(a)rivosinc.com> RISC-V: Provide pgtable_l5_enabled on rv32 Christoph Hellwig <hch(a)lst.de> xfs: check v5 superblock features early Long Li <leo.lilong(a)huawei.com> xfs: don't swallow dquot recovery verification errors Long Li <leo.lilong(a)huawei.com> xfs: fix ilock leak on error in xfs_dq_get_next_id Darrick J. Wong <djwong(a)kernel.org> xfs: only check mergeability of bnobt records Junrui Luo <moonafterrain(a)outlook.com> drm/amdgpu: disallow multiple FENCE chunks in one submit David Rosca <david.rosca(a)amd.com> drm/amdgpu: Fix UVD decode image min size calculation David Rosca <david.rosca(a)amd.com> drm/amdgpu: Fix UVD dpb min size calculation for H264 David Rosca <david.rosca(a)amd.com> drm/amdgpu: Fix UVD min buffer sizes David Rosca <david.rosca(a)amd.com> drm/amdgpu: Implement insert_end for VCE 3 David Rosca <david.rosca(a)amd.com> drm/amdgpu: Reject UVD message with dimensions above 4096 Candice Li <candice.li(a)amd.com> drm/amdgpu: validate GEM_CREATE domain combinations David Rosca <david.rosca(a)amd.com> drm/amdgpu: Reject UVD message with invalid number of h265 refs Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Selectively expand io_mutex Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Move cp cleanup out of not operational Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Fix out of bounds check on CCW array Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Ensure index for read/write regions are within range Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Cancel existing workqueues Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Limit the number of channel program segments Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Free all memory if cp_init() fails Guangshuo Li <lgs201920130244(a)gmail.com> drm/radeon: fix autosuspend cleanup during teardown Pei Xiao <xiaopei01(a)kylinos.cn> mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition Haibo Chen <haibo.chen(a)nxp.com> mmc: sdhci: make tuning_err a signed int Myeonghun Pak <mhun512(a)gmail.com> mmc: sdhci: unmap the bounce buffer before device release Zhan Xusheng <zhanxusheng1024(a)gmail.com> mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit Kefu Chai <k.chai(a)proxmox.com> libceph: tolerate addrvecs with multiple entries of the same type Yiming Zhu <zhuyiming(a)kuaishou.com> ceph: fix MDS random selection readiness predicate Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Avoid using invalid osd indices from primary_temp Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: sur40 - fix V4L error path cleanup Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: sur40 - fix input device registration ordering Ali Ahmet Memis <ali(a)iusegentoo.com> openrisc: signal: do not restore privileged SR bits on sigreturn Josh Poimboeuf <jpoimboe(a)kernel.org> ftrace: Fix off-by-one fentry site disable in ftrace_free_mem() Leon Hwang <leon.hwang(a)linux.dev> ftrace: Protect direct_functions in ftrace_find_rec_direct Pavitra Jha <jhapavitra98(a)gmail.com> libceph: fix multiple unsafe decodes in decode_locker() Thorsten Blum <thorsten.blum(a)linux.dev> crypto: qce - fix error path in devm_qce_register_algs Jianing Li <m13940358460(a)163.com> Input: hynitron_cstxxx - validate touch count and finger IDs Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: synaptics-rmi4 - block s_input when F54 queue is busy Bryam Vargas <hexlabsecurity(a)proton.me> Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: synaptics-rmi4 - zero report size on F54 work error George Wilson <gcwilson(a)linux.ibm.com> powerpc/pseries: lparcfg - fix kbuf[] underflow Pengpeng Hou <pengpeng(a)iscas.ac.cn> Input: iforce - validate input packet lengths Zhefu Zhang <a723356(a)gmail.com> Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard Linmao Li <lilinmao(a)kylinos.cn> Input: psxpad-spi - set driver data before use Richard Davies <richard(a)arachsys.com> Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: synaptics-rmi4 - fix F55 transmitter electrode count typo George Wilson <gcwilson(a)linux.ibm.com> powerpc/pseries: pci - logic bug Kyohei Kadota <lufia(a)lufia.org> Input: xpad - add support for ZENAIM LEVERLESS Asad Kamal <asad.kamal(a)amd.com> drm/amdgpu: fix aperture iounmap skipped on device removal Mingyu Wang <25181214217(a)stu.xidian.edu.cn> fbdev: core: Fix pointer desynchronization in fb_io_read() Dawid Wróbel <me(a)dawidwrobel.com> ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: cs35l41: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: cs35l45: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: cs4265: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked() Hidayath Khan <hidayath(a)linux.ibm.com> s390/qeth: validate user buffer length in SNMP and ARP query ioctls Wyatt Feng <bronzed_45_vested(a)icloud.com> mptcp: fastopen: only mark MPTFO subflows with SYN data Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: options: reset DSS fields in case of unexpected size Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: avoid combining some incoming suboptions Gang Yan <yangang(a)kylinos.cn> selftests: mptcp: join: mark tests with data corruption as failed Bryam Vargas <hexlabsecurity(a)proton.me> selinux: reject an unclaimed class value in security_get_classes() Bryam Vargas <hexlabsecurity(a)proton.me> selinux: do not cancel a policy conversion that never started Bryam Vargas <hexlabsecurity(a)proton.me> selinux: reject a class permission count below its inherited common Bryam Vargas <hexlabsecurity(a)proton.me> selinux: require every boolean value to be defined Erni Sri Satya Vennela <ernis(a)linux.microsoft.com> net: mana: Fix EQ leak in mana_remove on NULL port Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> ipvs: separate destination availability state Chao Yu <chao(a)kernel.org> f2fs: fix UAF issue in f2fs_merge_page_bio() Chao Shi <coshi036(a)gmail.com> block: stop the timeout timer when releasing a never added disk ------------- Diffstat: Makefile | 4 +- arch/arm/Kconfig | 1 + arch/arm64/boot/dts/nvidia/tegra194.dtsi | 2 + arch/m68k/Kconfig | 7 +- arch/m68k/Kconfig.cpu | 16 + arch/m68k/kernel/Makefile | 2 +- arch/m68k/kernel/dma.c | 2 +- arch/openrisc/include/asm/processor.h | 2 + arch/openrisc/kernel/dma.c | 4 +- arch/openrisc/kernel/signal.c | 5 +- arch/parisc/Kconfig | 1 + arch/powerpc/platforms/pseries/lparcfg.c | 2 +- arch/powerpc/platforms/pseries/pci.c | 2 +- arch/riscv/include/asm/pgtable-32.h | 3 + arch/riscv/include/asm/pgtable.h | 1 - arch/riscv/mm/init.c | 2 + arch/riscv/mm/pageattr.c | 8 +- arch/x86/kvm/svm/sev.c | 34 +- arch/x86/kvm/svm/svm.h | 1 + block/genhd.c | 12 +- crypto/ccm.c | 2 +- drivers/crypto/qce/core.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 34 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 21 + drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 10 +- drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 85 +--- drivers/gpu/drm/amd/amdgpu/vce_v3_0.c | 26 +- drivers/gpu/drm/amd/pm/amdgpu_dpm.c | 27 +- drivers/gpu/drm/amd/pm/amdgpu_pm.c | 16 +- drivers/gpu/drm/amd/pm/inc/amdgpu_dpm.h | 6 +- drivers/gpu/drm/radeon/radeon_kms.c | 1 + drivers/i2c/busses/i2c-bcm-iproc.c | 11 +- drivers/input/joystick/iforce/iforce-packets.c | 11 +- drivers/input/joystick/iforce/iforce-usb.c | 3 + drivers/input/joystick/psxpad-spi.c | 1 + drivers/input/joystick/xpad.c | 2 + drivers/input/keyboard/atkbd.c | 8 + drivers/input/mouse/focaltech.c | 2 +- drivers/input/rmi4/rmi_f54.c | 43 +- drivers/input/rmi4/rmi_f55.c | 4 +- drivers/input/touchscreen/hynitron_cstxxx.c | 13 +- drivers/input/touchscreen/sur40.c | 23 +- drivers/mmc/host/atmel-mci.c | 2 + drivers/mmc/host/omap_hsmmc.c | 2 +- drivers/mmc/host/sdhci.c | 16 + drivers/mmc/host/sdhci.h | 2 +- drivers/net/can/rcar/rcar_canfd.c | 28 +- drivers/net/ethernet/intel/ice/ice_base.c | 58 ++- drivers/net/ethernet/intel/ice/ice_base.h | 3 +- drivers/net/ethernet/intel/ice/ice_lib.c | 56 --- drivers/net/ethernet/intel/ice/ice_lib.h | 4 - drivers/net/ethernet/intel/ice/ice_switch.c | 63 +-- drivers/net/ethernet/intel/ice/ice_vf_lib.c | 27 + .../net/ethernet/intel/ice/ice_vf_lib_private.h | 1 + drivers/net/ethernet/intel/ice/ice_virtchnl.c | 21 + drivers/net/ethernet/intel/ice/ice_xsk.c | 2 +- drivers/net/ethernet/intel/igc/igc_main.c | 1 - drivers/net/ethernet/microsoft/mana/mana_en.c | 4 +- drivers/net/ethernet/ti/am65-cpsw-nuss.c | 2 + drivers/net/ipvlan/ipvlan_main.c | 4 + drivers/net/macvlan.c | 4 + drivers/net/veth.c | 4 +- drivers/net/vrf.c | 49 +- drivers/net/vxlan/vxlan_core.c | 45 +- drivers/net/vxlan/vxlan_mdb.c | 4 +- drivers/s390/cio/vfio_ccw_async.c | 16 + drivers/s390/cio/vfio_ccw_chp.c | 17 +- drivers/s390/cio/vfio_ccw_cp.c | 53 +- drivers/s390/cio/vfio_ccw_cp.h | 8 + drivers/s390/cio/vfio_ccw_drv.c | 15 +- drivers/s390/cio/vfio_ccw_fsm.c | 8 +- drivers/s390/cio/vfio_ccw_ops.c | 35 +- drivers/s390/cio/vfio_ccw_private.h | 6 +- drivers/s390/net/qeth_core_main.c | 3 + drivers/s390/net/qeth_l3_main.c | 5 + drivers/video/fbdev/core/fb_io_fops.c | 8 + fs/binfmt_elf.c | 4 +- fs/binfmt_elf_fdpic.c | 4 +- fs/binfmt_misc.c | 14 +- fs/btrfs/block-group.c | 61 ++- fs/btrfs/block-group.h | 3 +- fs/btrfs/extent-tree.c | 6 +- fs/btrfs/messages.h | 7 + fs/btrfs/space-info.c | 2 +- fs/btrfs/transaction.c | 5 +- fs/btrfs/zoned.c | 5 +- fs/btrfs/zoned.h | 6 +- fs/ceph/addr.c | 54 +- fs/ceph/caps.c | 17 +- fs/ceph/file.c | 9 +- fs/ceph/mds_client.c | 11 + fs/ceph/mds_client.h | 2 + fs/ceph/mdsmap.c | 2 +- fs/erofs/Kconfig | 3 +- fs/exec.c | 6 +- fs/f2fs/data.c | 2 +- fs/iomap/buffered-io.c | 42 +- fs/smb/client/cifsglob.h | 27 - fs/smb/client/cifssmb.c | 6 +- fs/smb/client/connect.c | 2 +- fs/smb/client/transport.c | 8 +- fs/smb/common/cifsglob.h | 36 ++ fs/smb/server/auth.c | 4 +- fs/smb/server/connection.c | 23 +- fs/smb/server/connection.h | 5 + fs/smb/server/oplock.c | 8 +- fs/smb/server/smb2misc.c | 2 +- fs/smb/server/smb2ops.c | 32 +- fs/smb/server/smb2pdu.c | 88 ++-- fs/smb/server/smb2pdu.h | 9 - fs/smb/server/smb_common.c | 43 +- fs/smb/server/smb_common.h | 43 +- fs/super.c | 22 +- fs/userfaultfd.c | 20 +- fs/xfs/libxfs/xfs_sb.c | 4 +- fs/xfs/scrub/alloc.c | 5 +- fs/xfs/xfs_dquot.c | 3 +- fs/xfs/xfs_dquot_item_recover.c | 2 +- include/asm-generic/pgtable_uffd.h | 17 + include/linux/fs.h | 12 + include/linux/mm_inline.h | 7 +- include/linux/mmap_lock.h | 4 + include/linux/netdevice.h | 52 +- include/linux/overflow.h | 52 ++ include/linux/pagewalk.h | 7 +- include/linux/userfaultfd_k.h | 19 +- include/net/bluetooth/hci.h | 8 +- include/net/bluetooth/hci_core.h | 1 + include/net/dropreason-core.h | 21 + include/net/gro.h | 1 + include/net/ip_vs.h | 7 + include/net/pkt_cls.h | 16 + include/net/pkt_sched.h | 3 +- include/net/sch_generic.h | 2 - include/net/tcp.h | 58 +-- include/uapi/linux/ip_vs.h | 6 - kernel/dma/Kconfig | 9 + kernel/dma/direct.c | 12 +- kernel/fork.c | 12 +- kernel/trace/ftrace.c | 9 +- lib/overflow_kunit.c | 19 + mm/huge_memory.c | 49 +- mm/internal.h | 7 + mm/migrate_device.c | 5 +- mm/pagewalk.c | 82 ++- mm/ptdump.c | 10 +- mm/userfaultfd.c | 26 + mm/vmalloc.c | 49 +- net/bluetooth/eir.c | 7 +- net/bluetooth/eir.h | 2 +- net/bluetooth/hci_core.c | 9 + net/bluetooth/hci_event.c | 3 +- net/bluetooth/hci_sync.c | 237 +++++---- net/ceph/cls_lock_client.c | 21 +- net/ceph/decode.c | 18 +- net/ceph/osdmap.c | 9 +- net/core/dev.c | 29 +- net/core/gro.c | 31 ++ net/core/pktgen.c | 43 +- net/ipv4/bpf_tcp_ca.c | 2 +- net/ipv4/tcp_dctcp.h | 2 +- net/ipv4/tcp_input.c | 56 ++- net/ipv4/tcp_minisocks.c | 12 +- net/ipv4/tcp_output.c | 6 +- net/ipv4/udp_offload.c | 29 -- net/mptcp/fastopen.c | 7 +- net/mptcp/options.c | 67 ++- net/mptcp/protocol.h | 1 + net/netfilter/ipset/ip_set_bitmap_gen.h | 2 +- net/netfilter/ipset/ip_set_core.c | 19 +- net/netfilter/ipset/ip_set_list_set.c | 10 +- net/netfilter/ipvs/ip_vs_conn.c | 4 +- net/netfilter/ipvs/ip_vs_core.c | 6 +- net/netfilter/ipvs/ip_vs_ctl.c | 4 +- net/netfilter/ipvs/ip_vs_dh.c | 4 +- net/netfilter/ipvs/ip_vs_lblc.c | 2 +- net/netfilter/ipvs/ip_vs_lblcr.c | 8 +- net/netfilter/nf_flow_table_core.c | 7 +- net/netfilter/nf_tables_offload.c | 2 +- net/packet/af_packet.c | 27 +- net/sched/act_api.c | 13 +- net/sched/cls_api.c | 32 +- net/sched/cls_bpf.c | 18 +- net/sched/cls_u32.c | 3 + net/sched/sch_api.c | 24 +- net/tls/tls_sw.c | 7 + net/x25/af_x25.c | 4 +- net/x25/x25_timer.c | 25 +- security/selinux/ss/policydb.c | 31 ++ security/selinux/ss/services.c | 28 +- sound/soc/codecs/cs35l41-lib.c | 2 +- sound/soc/codecs/cs35l45-tables.c | 32 +- sound/soc/codecs/cs4265.c | 4 +- sound/soc/codecs/lpass-wsa-macro.c | 8 +- sound/soc/codecs/tas2562.c | 9 +- sound/soc/fsl/fsl_sai.c | 29 +- sound/soc/sof/sof-audio.c | 9 +- sound/soc/xilinx/xlnx_formatter_pcm.c | 10 +- tools/testing/selftests/net/mptcp/mptcp_join.sh | 4 +- tools/testing/selftests/net/tls.c | 549 +++++++++++++++++++++ 200 files changed, 2659 insertions(+), 1145 deletions(-)

2 hours, 27 minutes

[PATCH 6.6 000/160] 6.6.153-rc2 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.6.153 release. There are 160 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sun, 23 Aug 2026 14:28:27 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.153-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.6.153-rc2 Tengda Wu <wutengda(a)huaweicloud.com> ring-buffer: Use current_context for safe per-CPU buffer swap Steven Rostedt <rostedt(a)goodmis.org> ring-buffer: Remove jump to out label in ring_buffer_swap_cpu() Paolo Abeni <pabeni(a)redhat.com> net: harmonize tstats and dstats Christian Brauner <brauner(a)kernel.org> binfmt_misc: use exe_file_deny_write_access() for the interpreter clone Baul Lee <baul.lee(a)xbow.com> net/x25: fix use-after-free of the socket by its timers Gao Xiang <xiang(a)kernel.org> erofs: fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: cls_bpf: reject dev-bound programs bound to a different device Siddharth Vadapalli <s-vadapalli(a)ti.com> net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG Uwe Kleine-König <ukleinek(a)kernel.org> m68k: Define NR_CPUS to 1 Christoph Hellwig <hch(a)lst.de> m68k: use the coherent DMA code for coldfire without data cache Christoph Hellwig <hch(a)lst.de> dma-direct: add a CONFIG_ARCH_HAS_DMA_ALLOC symbol Zhang Changzhong <zhangchangzhong(a)huawei.com> net/sched: cls_u32: skip hash tables in u32_bind_class() Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain Victor Nogueira <victor(a)mojatatu.com> net: sched: Add initial TC error skb drop reasons Victor Nogueira <victor(a)mojatatu.com> net: sched: Move drop_reason to struct tc_skb_cb Yan Zhai <yan(a)cloudflare.com> packet: add a generic drop reason for receive Jamal Hadi Salim <jhs(a)mojatatu.com> net, sched: Fix SKB_NOT_DROPPED_YET splat under debug config Daniel Borkmann <daniel(a)iogearbox.net> net, sched: Add tcf_set_drop_reason for {__,}tcf_classify Daniel Borkmann <daniel(a)iogearbox.net> net, sched: Make tc-related drop reason more flexible Eric Dumazet <edumazet(a)google.com> af_packet: Don't send zero-byte data in tpacket_snd(). Rosen Penev <rosenp(a)gmail.com> ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers Chuck Lever <cel(a)kernel.org> net/tls: Fail tls_sw_splice_read() after a failed async decrypt Wei Fang <wei.fang(a)nxp.com> net: packet: fix wrong transport_header when sending VLAN-tagged frame Eric Dumazet <edumazet(a)google.com> macvlan: inherit needed_headroom and needed_tailroom from lowerdev Eric Dumazet <edumazet(a)google.com> ipvlan: inherit needed_headroom and needed_tailroom from phy_dev Florian Westphal <fw(a)strlen.de> netfilter: ipset: let destroy callbacks adjust ext mem size Florian Westphal <fw(a)strlen.de> netfilter: ipset: fix list type element drift bug Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> netfilter: flowtable: publish GC-visible tuple last Alexey Velichayshiy <a.velichayshiy(a)ispras.ru> netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path Xiang Mei (Microsoft) <xmei5(a)asu.edu> netfilter: ipset: fix refcount race between list:set GC and swap Herbert Xu <herbert(a)gondor.apana.org.au> crypto: ccm - Set rfc4309 maxauthsize from child Jon Hunter <jonathanh(a)nvidia.com> arm64: tegra: Add EL2 virtual timer interrupt for Tegra194 Lorenzo Stoakes (ARM) <ljs(a)kernel.org> mm/huge_memory: fix huge_zero_pfn race Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> tls: rx: restore msg_iter before TLS 1.3 optimistic retry Sabrina Dubroca <sd(a)queasysnail.net> selftests: tls: add rekey tests Paolo Bonzini <pbonzini(a)redhat.com> KVM: SVM: Serialize accesses to the owner and mirror list with separate lock Lorenzo Stoakes (ARM) <ljs(a)kernel.org> mm/ptdump: always stabilise against page table freeing using init_mm Lorenzo Stoakes (ARM) <ljs(a)kernel.org> mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> mm/pagewalk: split walk_page_range_novma() into kernel/user parts Pierre-Eric Pelloux-Prayer <pierre-eric.pelloux-prayer(a)amd.com> drm/amdgpu: move debug_vm handling to amdgpu_cs_parser_fini Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: fix pptable use-after-free Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: fix torn gpu metrics reads Tu Nguyen <tu.nguyen.xg(a)renesas.com> can: rcar_canfd: change the initializing flow for clocks and resets Jonas Gorski <jonas.gorski(a)bisdn.de> i2c: iproc: reset bus after timeout if START_BUSY is stuck Wolfram Sang <wsa+renesas(a)sang-engineering.com> i2c: bcm-iproc: remove printout on handled timeouts Eric Dumazet <edumazet(a)google.com> vxlan: use pskb_network_may_pull() for transmit path header pulls Guillaume Nault <gnault(a)redhat.com> vxlan: Handle stats using NETDEV_PCPU_STAT_DSTATS. Guillaume Nault <gnault(a)redhat.com> vrf: Make pcpu_dstats update functions available to other modules. Jeremy Kerr <jk(a)codeconstruct.com.au> net: core,vrf: Change pcpu_dstat fields to u64_stats_t Breno Leitao <leitao(a)debian.org> vxlan: Do not alloc tstats manually Dawid Osuchowski <dawid.osuchowski(a)linux.intel.com> ice: fix VF interrupts cleanup Christian Brauner <brauner(a)kernel.org> binfmt_misc: restore write access when removing an entry Amir Goldstein <amir73il(a)gmail.com> fs: don't block write during exec on pre-content watched files Matt Fleming <mfleming(a)cloudflare.com> veth: convert frag_list skbs before running XDP Chengfeng Ye <nicoyip.dev(a)gmail.com> net: pktgen: fix proc entry use-after-free Peter Seiderer <ps.report(a)gmx.net> net: pktgen: fix code style (WARNING: Block comments) Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: reject repeated SMB2 NEGOTIATE requests Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: conn lock to serialize smb2 negotiate David Carlier <devnexen(a)gmail.com> igc: remove napi_synchronize() in igc_down() Mark Brown <broonie(a)kernel.org> ASoC: tas2562: Validate values for volume writes Kefeng Wang <wangkefeng.wang(a)huawei.com> mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE Guanghui Yang <3497809730(a)qq.com> btrfs: zoned: fix missing chunk metadata reservation Filipe Manana <fdmanana(a)suse.com> btrfs: remove fs_info argument from btrfs_zoned_activate_one_bg() Naohiro Aota <naohiro.aota(a)wdc.com> btrfs: add space_info argument to btrfs_chunk_alloc() David Sterba <dsterba(a)suse.com> btrfs: add debug build only WARN Yuxiang Yang <yangyx22(a)mails.tsinghua.edu.cn> tcp: challenge ACK for non-exact RST in SYN-RECEIVED Ilpo Järvinen <ij(a)kernel.org> tcp: fast path functions later Ilpo Järvinen <ij(a)kernel.org> tcp: Pass flags to __tcp_send_ack Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: validate minimum PDU size for transform requests ChenXiaoSong <chenxiaosong(a)kylinos.cn> smb/server: fix minimum SMB2 PDU size ChenXiaoSong <chenxiaosong(a)kylinos.cn> smb/server: fix minimum SMB1 PDU size Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: rename smb2_get_msg to smb_get_msg ChenXiaoSong <chenxiaosong(a)kylinos.cn> smb/server: rename include guard in smb_common.h ZhangGuoDong <zhangguodong(a)kylinos.cn> smb: move get_rfc1002_len() to common/smbglob.h ZhangGuoDong <zhangguodong(a)kylinos.cn> smb: move smb_version_values to common/smbglob.h Christian Brauner <brauner(a)kernel.org> super: fix emergency thaw deadlock on frozen block devices Aldo Ariel Panzardo <qwe.aldo(a)gmail.com> net/sched: serialize qdisc_rtab_list against concurrent get/put Shiming Cheng <shiming.cheng(a)mediatek.com> net: gro: fix double aggregation of flush-marked skbs Felix Fietkau <nbd(a)nbd.name> net: move skb_gro_receive_list from udp to core Pavitra Jha <jhapavitra98(a)gmail.com> libceph: fix two unsafe bare decodes in decode_lockers() Mike Rapoport (Microsoft) <rppt(a)kernel.org> userfaultfd: prevent registration of special VMAs Mike Rapoport (Microsoft) <rppt(a)kernel.org> userfaultfd: move vma_can_userfault out of line Chunyan Zhang <zhangchunyan(a)iscas.ac.cn> mm: userfaultfd: add pgtable_supports_uffd_wp() Zhang Yi <yi.zhang(a)huawei.com> iomap: fix out-of-bounds bitmap_set() with zero-length range Matthew Wilcox (Oracle) <willy(a)infradead.org> iomap: hold state_lock over call to ifs_set_range_uptodate() Chancel Liu <chancel.liu(a)nxp.com> ASoC: fsl_sai: Fix spurious BCLK on resume by clearing BYP Xiang Mei <xmei5(a)asu.edu> libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> libceph: Amend checking to fix `make W=1` build breakage Matthew Wilcox (Oracle) <willy(a)infradead.org> ceph: Use a folio in ceph_page_mkwrite() Max Kellermann <max.kellermann(a)ionos.com> ceph: fix hanging __ceph_get_caps() with stale mds_wanted Matthew Wilcox (Oracle) <willy(a)infradead.org> ceph: Remove ceph_writepage() Max Kellermann <max.kellermann(a)ionos.com> ceph: avoid fs reclaim while using current->journal_info Sabrina Dubroca <sd(a)queasysnail.net> selftests: tls: add test with a partially invalid iov Palmer Dabbelt <palmer(a)rivosinc.com> RISC-V: Provide pgtable_l5_enabled on rv32 Christoph Hellwig <hch(a)lst.de> xfs: check v5 superblock features early Long Li <leo.lilong(a)huawei.com> xfs: don't swallow dquot recovery verification errors Long Li <leo.lilong(a)huawei.com> xfs: fix ilock leak on error in xfs_dq_get_next_id Darrick J. Wong <djwong(a)kernel.org> xfs: only check mergeability of bnobt records Junrui Luo <moonafterrain(a)outlook.com> drm/amdgpu: disallow multiple FENCE chunks in one submit David Rosca <david.rosca(a)amd.com> drm/amdgpu: Fix UVD decode image min size calculation David Rosca <david.rosca(a)amd.com> drm/amdgpu: Fix UVD dpb min size calculation for H264 David Rosca <david.rosca(a)amd.com> drm/amdgpu: Fix UVD min buffer sizes David Rosca <david.rosca(a)amd.com> drm/amdgpu: Implement insert_end for VCE 3 David Rosca <david.rosca(a)amd.com> drm/amdgpu: Reject UVD message with dimensions above 4096 Candice Li <candice.li(a)amd.com> drm/amdgpu: validate GEM_CREATE domain combinations David Rosca <david.rosca(a)amd.com> drm/amdgpu: Reject UVD message with invalid number of h265 refs Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Selectively expand io_mutex Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Move cp cleanup out of not operational Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Fix out of bounds check on CCW array Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Ensure index for read/write regions are within range Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Cancel existing workqueues Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Limit the number of channel program segments Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Free all memory if cp_init() fails Guangshuo Li <lgs201920130244(a)gmail.com> drm/radeon: fix autosuspend cleanup during teardown Haibo Chen <haibo.chen(a)nxp.com> mmc: sdhci: make tuning_err a signed int Myeonghun Pak <mhun512(a)gmail.com> mmc: sdhci: unmap the bounce buffer before device release Zhan Xusheng <zhanxusheng1024(a)gmail.com> mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit Kefu Chai <k.chai(a)proxmox.com> libceph: tolerate addrvecs with multiple entries of the same type Yiming Zhu <zhuyiming(a)kuaishou.com> ceph: fix MDS random selection readiness predicate Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Avoid using invalid osd indices from primary_temp Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: sur40 - fix V4L error path cleanup Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: sur40 - fix input device registration ordering Ali Ahmet Memis <ali(a)iusegentoo.com> openrisc: signal: do not restore privileged SR bits on sigreturn Josh Poimboeuf <jpoimboe(a)kernel.org> ftrace: Fix off-by-one fentry site disable in ftrace_free_mem() Leon Hwang <leon.hwang(a)linux.dev> ftrace: Protect direct_functions in ftrace_find_rec_direct Pavitra Jha <jhapavitra98(a)gmail.com> libceph: fix multiple unsafe decodes in decode_locker() Thorsten Blum <thorsten.blum(a)linux.dev> crypto: qce - fix error path in devm_qce_register_algs Jianing Li <m13940358460(a)163.com> Input: hynitron_cstxxx - validate touch count and finger IDs Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: synaptics-rmi4 - block s_input when F54 queue is busy Bryam Vargas <hexlabsecurity(a)proton.me> Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: synaptics-rmi4 - zero report size on F54 work error George Wilson <gcwilson(a)linux.ibm.com> powerpc/pseries: lparcfg - fix kbuf[] underflow Pengpeng Hou <pengpeng(a)iscas.ac.cn> Input: iforce - validate input packet lengths Zhefu Zhang <a723356(a)gmail.com> Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard Linmao Li <lilinmao(a)kylinos.cn> Input: psxpad-spi - set driver data before use Richard Davies <richard(a)arachsys.com> Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: synaptics-rmi4 - fix F55 transmitter electrode count typo George Wilson <gcwilson(a)linux.ibm.com> powerpc/pseries: pci - logic bug Kyohei Kadota <lufia(a)lufia.org> Input: xpad - add support for ZENAIM LEVERLESS Asad Kamal <asad.kamal(a)amd.com> drm/amdgpu: fix aperture iounmap skipped on device removal Mingyu Wang <25181214217(a)stu.xidian.edu.cn> fbdev: core: Fix pointer desynchronization in fb_io_read() Dawid Wróbel <me(a)dawidwrobel.com> ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: cs35l41: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: cs35l45: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: cs4265: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked() Hidayath Khan <hidayath(a)linux.ibm.com> s390/qeth: validate user buffer length in SNMP and ARP query ioctls Wyatt Feng <bronzed_45_vested(a)icloud.com> mptcp: fastopen: only mark MPTFO subflows with SYN data Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: options: reset DSS fields in case of unexpected size Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: avoid combining some incoming suboptions Gang Yan <yangang(a)kylinos.cn> selftests: mptcp: join: mark tests with data corruption as failed Bryam Vargas <hexlabsecurity(a)proton.me> selinux: reject an unclaimed class value in security_get_classes() Bryam Vargas <hexlabsecurity(a)proton.me> selinux: do not cancel a policy conversion that never started Bryam Vargas <hexlabsecurity(a)proton.me> selinux: reject a class permission count below its inherited common Bryam Vargas <hexlabsecurity(a)proton.me> selinux: require every boolean value to be defined Erni Sri Satya Vennela <ernis(a)linux.microsoft.com> net: mana: Fix EQ leak in mana_remove on NULL port Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> ipvs: separate destination availability state Chao Yu <chao(a)kernel.org> f2fs: fix UAF issue in f2fs_merge_page_bio() Chao Shi <coshi036(a)gmail.com> block: stop the timeout timer when releasing a never added disk ------------- Diffstat: Makefile | 4 +- arch/arm/Kconfig | 1 + arch/arm64/boot/dts/nvidia/tegra194.dtsi | 2 + arch/m68k/Kconfig | 7 +- arch/m68k/Kconfig.cpu | 16 + arch/m68k/kernel/Makefile | 2 +- arch/m68k/kernel/dma.c | 2 +- arch/openrisc/include/asm/processor.h | 2 + arch/openrisc/kernel/dma.c | 4 +- arch/openrisc/kernel/signal.c | 5 +- arch/parisc/Kconfig | 1 + arch/powerpc/platforms/pseries/lparcfg.c | 2 +- arch/powerpc/platforms/pseries/pci.c | 2 +- arch/riscv/include/asm/pgtable-32.h | 3 + arch/riscv/include/asm/pgtable.h | 1 - arch/riscv/mm/init.c | 2 + arch/riscv/mm/pageattr.c | 8 +- arch/x86/kvm/svm/sev.c | 34 +- arch/x86/kvm/svm/svm.h | 1 + block/genhd.c | 12 +- crypto/ccm.c | 2 +- drivers/crypto/qce/core.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 34 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 21 + drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 10 +- drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 85 +--- drivers/gpu/drm/amd/amdgpu/vce_v3_0.c | 26 +- drivers/gpu/drm/amd/pm/amdgpu_dpm.c | 27 +- drivers/gpu/drm/amd/pm/amdgpu_pm.c | 16 +- drivers/gpu/drm/amd/pm/inc/amdgpu_dpm.h | 6 +- drivers/gpu/drm/radeon/radeon_kms.c | 1 + drivers/i2c/busses/i2c-bcm-iproc.c | 11 +- drivers/input/joystick/iforce/iforce-packets.c | 11 +- drivers/input/joystick/iforce/iforce-usb.c | 3 + drivers/input/joystick/psxpad-spi.c | 1 + drivers/input/joystick/xpad.c | 2 + drivers/input/keyboard/atkbd.c | 8 + drivers/input/mouse/focaltech.c | 2 +- drivers/input/rmi4/rmi_f54.c | 43 +- drivers/input/rmi4/rmi_f55.c | 4 +- drivers/input/touchscreen/hynitron_cstxxx.c | 13 +- drivers/input/touchscreen/sur40.c | 23 +- drivers/mmc/host/omap_hsmmc.c | 2 +- drivers/mmc/host/sdhci.c | 16 + drivers/mmc/host/sdhci.h | 2 +- drivers/net/can/rcar/rcar_canfd.c | 28 +- drivers/net/ethernet/intel/ice/ice_vf_lib.c | 27 + .../net/ethernet/intel/ice/ice_vf_lib_private.h | 1 + drivers/net/ethernet/intel/ice/ice_virtchnl.c | 21 + drivers/net/ethernet/intel/igc/igc_main.c | 1 - drivers/net/ethernet/microsoft/mana/mana_en.c | 4 +- drivers/net/ethernet/ti/am65-cpsw-nuss.c | 2 + drivers/net/ipvlan/ipvlan_main.c | 4 + drivers/net/macvlan.c | 4 + drivers/net/veth.c | 4 +- drivers/net/vrf.c | 49 +- drivers/net/vxlan/vxlan_core.c | 45 +- drivers/net/vxlan/vxlan_mdb.c | 4 +- drivers/s390/cio/vfio_ccw_async.c | 16 + drivers/s390/cio/vfio_ccw_chp.c | 17 +- drivers/s390/cio/vfio_ccw_cp.c | 53 +- drivers/s390/cio/vfio_ccw_cp.h | 8 + drivers/s390/cio/vfio_ccw_drv.c | 15 +- drivers/s390/cio/vfio_ccw_fsm.c | 8 +- drivers/s390/cio/vfio_ccw_ops.c | 35 +- drivers/s390/cio/vfio_ccw_private.h | 6 +- drivers/s390/net/qeth_core_main.c | 3 + drivers/s390/net/qeth_l3_main.c | 5 + drivers/video/fbdev/core/fb_io_fops.c | 8 + fs/binfmt_elf.c | 4 +- fs/binfmt_elf_fdpic.c | 4 +- fs/binfmt_misc.c | 14 +- fs/btrfs/block-group.c | 61 ++- fs/btrfs/block-group.h | 3 +- fs/btrfs/extent-tree.c | 6 +- fs/btrfs/messages.h | 7 + fs/btrfs/space-info.c | 2 +- fs/btrfs/transaction.c | 5 +- fs/btrfs/zoned.c | 5 +- fs/btrfs/zoned.h | 6 +- fs/ceph/addr.c | 54 +- fs/ceph/caps.c | 17 +- fs/ceph/file.c | 9 +- fs/ceph/mds_client.c | 11 + fs/ceph/mds_client.h | 2 + fs/ceph/mdsmap.c | 2 +- fs/erofs/Kconfig | 3 +- fs/exec.c | 6 +- fs/f2fs/data.c | 2 +- fs/iomap/buffered-io.c | 42 +- fs/smb/client/cifsglob.h | 27 - fs/smb/client/cifssmb.c | 6 +- fs/smb/client/connect.c | 2 +- fs/smb/client/transport.c | 8 +- fs/smb/common/cifsglob.h | 36 ++ fs/smb/server/auth.c | 4 +- fs/smb/server/connection.c | 23 +- fs/smb/server/connection.h | 5 + fs/smb/server/oplock.c | 8 +- fs/smb/server/smb2misc.c | 2 +- fs/smb/server/smb2ops.c | 32 +- fs/smb/server/smb2pdu.c | 88 ++-- fs/smb/server/smb2pdu.h | 9 - fs/smb/server/smb_common.c | 43 +- fs/smb/server/smb_common.h | 43 +- fs/super.c | 22 +- fs/userfaultfd.c | 20 +- fs/xfs/libxfs/xfs_sb.c | 4 +- fs/xfs/scrub/alloc.c | 5 +- fs/xfs/xfs_dquot.c | 3 +- fs/xfs/xfs_dquot_item_recover.c | 2 +- include/asm-generic/pgtable_uffd.h | 17 + include/linux/fs.h | 12 + include/linux/mm_inline.h | 7 +- include/linux/mmap_lock.h | 4 + include/linux/netdevice.h | 52 +- include/linux/pagewalk.h | 7 +- include/linux/userfaultfd_k.h | 19 +- include/net/dropreason-core.h | 21 + include/net/gro.h | 1 + include/net/ip_vs.h | 7 + include/net/pkt_cls.h | 16 + include/net/pkt_sched.h | 3 +- include/net/sch_generic.h | 2 - include/net/tcp.h | 58 +-- include/uapi/linux/ip_vs.h | 6 - kernel/dma/Kconfig | 9 + kernel/dma/direct.c | 12 +- kernel/fork.c | 12 +- kernel/trace/ftrace.c | 9 +- kernel/trace/ring_buffer.c | 23 +- mm/huge_memory.c | 49 +- mm/internal.h | 7 + mm/migrate_device.c | 5 +- mm/pagewalk.c | 82 ++- mm/ptdump.c | 10 +- mm/userfaultfd.c | 26 + mm/vmalloc.c | 49 +- net/ceph/cls_lock_client.c | 21 +- net/ceph/decode.c | 18 +- net/ceph/osdmap.c | 9 +- net/core/dev.c | 29 +- net/core/gro.c | 31 ++ net/core/pktgen.c | 43 +- net/ipv4/bpf_tcp_ca.c | 2 +- net/ipv4/tcp_dctcp.h | 2 +- net/ipv4/tcp_input.c | 56 ++- net/ipv4/tcp_minisocks.c | 12 +- net/ipv4/tcp_output.c | 6 +- net/ipv4/udp_offload.c | 29 -- net/mptcp/fastopen.c | 7 +- net/mptcp/options.c | 67 ++- net/mptcp/protocol.h | 1 + net/netfilter/ipset/ip_set_bitmap_gen.h | 2 +- net/netfilter/ipset/ip_set_core.c | 19 +- net/netfilter/ipset/ip_set_list_set.c | 10 +- net/netfilter/ipvs/ip_vs_conn.c | 4 +- net/netfilter/ipvs/ip_vs_core.c | 6 +- net/netfilter/ipvs/ip_vs_ctl.c | 4 +- net/netfilter/ipvs/ip_vs_dh.c | 4 +- net/netfilter/ipvs/ip_vs_lblc.c | 2 +- net/netfilter/ipvs/ip_vs_lblcr.c | 8 +- net/netfilter/nf_flow_table_core.c | 7 +- net/netfilter/nf_tables_offload.c | 2 +- net/packet/af_packet.c | 27 +- net/sched/act_api.c | 13 +- net/sched/cls_api.c | 32 +- net/sched/cls_bpf.c | 18 +- net/sched/cls_u32.c | 3 + net/sched/sch_api.c | 24 +- net/tls/tls_sw.c | 7 + net/x25/af_x25.c | 4 +- net/x25/x25_timer.c | 25 +- security/selinux/ss/policydb.c | 31 ++ security/selinux/ss/services.c | 28 +- sound/soc/codecs/cs35l41-lib.c | 2 +- sound/soc/codecs/cs35l45-tables.c | 32 +- sound/soc/codecs/cs4265.c | 4 +- sound/soc/codecs/lpass-wsa-macro.c | 8 +- sound/soc/codecs/tas2562.c | 9 +- sound/soc/fsl/fsl_sai.c | 29 +- sound/soc/sof/sof-audio.c | 9 +- sound/soc/xilinx/xlnx_formatter_pcm.c | 10 +- tools/testing/selftests/net/mptcp/mptcp_join.sh | 4 +- tools/testing/selftests/net/tls.c | 549 +++++++++++++++++++++ 185 files changed, 2359 insertions(+), 942 deletions(-)

2 hours, 37 minutes

[PATCH 5.15 000/272] 5.15.217-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 5.15.217 release. There are 272 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat, 22 Aug 2026 14:51:11 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.217-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 5.15.217-rc1 Easwar Hariharan <eahariha(a)linux.microsoft.com> jiffies: Cast to unsigned long in secs_to_jiffies() conversion Dmitry Osipenko <dmitry.osipenko(a)collabora.com> drm/virtio: Unlock reservations on dma_resv_reserve_fences() error Zack Rusin <zackr(a)vmware.com> drm/vmwgfx: Reserve fence slots on buffer objects in cotables Robert Mader <robert.mader(a)collabora.com> udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf() Christian Brauner <brauner(a)kernel.org> binfmt_misc: use exe_file_deny_write_access() for the interpreter clone Baul Lee <baul.lee(a)xbow.com> net/x25: fix use-after-free of the socket by its timers Siddharth Vadapalli <s-vadapalli(a)ti.com> net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG Eric Dumazet <edumazet(a)google.com> af_packet: Don't send zero-byte data in tpacket_snd(). Rosen Penev <rosenp(a)gmail.com> ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers Wei Fang <wei.fang(a)nxp.com> net: packet: fix wrong transport_header when sending VLAN-tagged frame Florian Westphal <fw(a)strlen.de> netfilter: ipset: fix list type element drift bug Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> netfilter: flowtable: publish GC-visible tuple last Alexey Velichayshiy <a.velichayshiy(a)ispras.ru> netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path Xiang Mei (Microsoft) <xmei5(a)asu.edu> netfilter: ipset: fix refcount race between list:set GC and swap Herbert Xu <herbert(a)gondor.apana.org.au> crypto: ccm - Set rfc4309 maxauthsize from child Jon Hunter <jonathanh(a)nvidia.com> arm64: tegra: Add EL2 virtual timer interrupt for Tegra194 Daming Li <d4n.for.sec(a)gmail.com> net: smc: fix splice entry lifetime imbalance in smc_rx_splice Guangguan Wang <guangguan.wang(a)linux.alibaba.com> net/smc: rdma write inline if qp has sufficient inline space Yangyu Chen <cyy(a)cyyself.name> net: atlantic: free stranded TX buffers on ring deinit Hyunjung Ko <hj351016(a)gmail.com> net/sched: act_ct: fix sk_buff leak when the header checks reject a packet Xin Long <lucien.xin(a)gmail.com> openvswitch: move key and ovs_cb update out of handle_fragments Xin Long <lucien.xin(a)gmail.com> net: sched: use skb_ip_totlen and iph_totlen Xin Long <lucien.xin(a)gmail.com> openvswitch: use skb_ip_totlen in conntrack Xin Long <lucien.xin(a)gmail.com> net: add a couple of helpers for iph tot_len Lorenzo Stoakes (ARM) <ljs(a)kernel.org> mm/ptdump: always stabilise against page table freeing using init_mm Tejun Heo <tj(a)kernel.org> sched/psi: Shut down rtpoll_timer in psi_cgroup_free() Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: fix torn gpu metrics reads Aaron Ma <aaron.ma(a)canonical.com> ice: wait for reset completion in ice_resume() Easwar Hariharan <eahariha(a)linux.microsoft.com> jiffies: Define secs_to_jiffies() Marc Kleine-Budde <mkl(a)pengutronix.de> can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure Jonas Gorski <jonas.gorski(a)bisdn.de> i2c: iproc: reset bus after timeout if START_BUSY is stuck Wolfram Sang <wsa+renesas(a)sang-engineering.com> i2c: bcm-iproc: remove printout on handled timeouts Liem <liem16213(a)gmail.com> i2c: imx: Fix slave registration race and error handling Christian Brauner <brauner(a)kernel.org> binfmt_misc: restore write access when removing an entry Amir Goldstein <amir73il(a)gmail.com> fs: don't block write during exec on pre-content watched files Amir Goldstein <amir73il(a)gmail.com> fsnotify: opt-in for permission events at file open time Dawei Feng <dawei.feng(a)seu.edu.cn> ice: fix memory leak in ice_lbtest_prepare_rings() Dawid Osuchowski <dawid.osuchowski(a)linux.intel.com> ice: fix VF interrupts cleanup Ibrahim Hashimov <security(a)auditcode.ai> scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write Damien Le Moal <damien.lemoal(a)opensource.wdc.com> scsi: scsi_debug: Rename zone type constants Damien Le Moal <damien.lemoal(a)opensource.wdc.com> scsi: sd: sd_zbc: Return early in sd_zbc_check_zoned_characteristics() Bart Van Assche <bvanassche(a)acm.org> scsi: sd: sd_zbc: Introduce struct zoned_disk_info Damien Le Moal <damien.lemoal(a)opensource.wdc.com> scsi: sd: sd_zbc: Use logical blocks as unit when querying zones Bart Van Assche <bvanassche(a)acm.org> scsi: sd: sd_zbc: Improve source code documentation Chengfeng Ye <nicoyip.dev(a)gmail.com> net: pktgen: fix proc entry use-after-free Peter Seiderer <ps.report(a)gmx.net> net: pktgen: fix code style (WARNING: Block comments) David Carlier <devnexen(a)gmail.com> igc: remove napi_synchronize() in igc_down() Maoyi Xie <maoyixie.tju(a)gmail.com> wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: reject repeated SMB2 NEGOTIATE requests Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: conn lock to serialize smb2 negotiate Gregory Price <gourry(a)gourry.net> mm/vmstat: fold stranded per-cpu node stats when a node comes online Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: validate minimum PDU size for transform requests ChenXiaoSong <chenxiaosong(a)kylinos.cn> smb/server: fix minimum SMB2 PDU size ChenXiaoSong <chenxiaosong(a)kylinos.cn> smb/server: fix minimum SMB1 PDU size Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: rename smb2_get_msg to smb_get_msg Christian Brauner <brauner(a)kernel.org> super: fix emergency thaw deadlock on frozen block devices Tengda Wu <wutengda(a)huaweicloud.com> ftrace: Add global mutex to serialize trace_parser access Aldo Ariel Panzardo <qwe.aldo(a)gmail.com> net/sched: serialize qdisc_rtab_list against concurrent get/put James Montgomery <james_montgomery(a)disroot.org> ksmbd: defer destroy_previous_session() until after NTLM authentication Pavitra Jha <jhapavitra98(a)gmail.com> libceph: fix two unsafe bare decodes in decode_lockers() Max Kellermann <max.kellermann(a)ionos.com> ceph: fix hanging __ceph_get_caps() with stale mds_wanted Xiubo Li <xiubli(a)redhat.com> ceph: print cluster fsid and client global_id in all debug logs Xiubo Li <xiubli(a)redhat.com> ceph: rename _to_client() to _to_fs_client() Xiubo Li <xiubli(a)redhat.com> libceph: add doutc and *_client debug macros support Xiang Mei <xmei5(a)asu.edu> libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> libceph: Amend checking to fix `make W=1` build breakage Max Kellermann <max.kellermann(a)ionos.com> ceph: avoid fs reclaim while using current->journal_info Zhiling Zou <roxy520tt(a)gmail.com> sctp: avoid auth_enable sysctl UAF during netns teardown Chenguang Zhao <zhaochenguang(a)kylinos.cn> mptcp: decrement subflows counter on failed passive join Paolo Abeni <pabeni(a)redhat.com> mptcp: fix subflow accounting on close Paolo Abeni <pabeni(a)redhat.com> mptcp: cleanup MPJ subflow list handling Hugo Villeneuve <hvilleneuve(a)dimonoff.com> serial: sc16is7xx: implement gpio get_direction() callback Hugo Villeneuve <hvilleneuve(a)dimonoff.com> serial: sc16is7xx: fix regression with GPIO configuration Hugo Villeneuve <hvilleneuve(a)dimonoff.com> serial: sc16is7xx: remove obsolete out_thread label Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com> serial: sc16is7xx: Fill in rs485_supported Tomasz Moń <tomasz.mon(a)camlingroup.com> sc16is7xx: Properly resume TX after stop LiangCheng Wang <zaq14760(a)gmail.com> wifi: brcmfmac: set F2 blocksize to 256 for BCM43752 Gokul Sivakumar <gokulkumar.sivakumar(a)infineon.com> wifi: brcmfmac: fix 43752 SDIO FWVID incorrectly labelled as Cypress (CYW) Jiangshan Yi <yijiangshan(a)kylinos.cn> serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> serial: 8250_mid: Remove unneeded test for ->setup() presence Fan Wu <fanwu01(a)zju.edu.cn> wifi: brcmfmac: drain bus_reset work on device removal Norbert Szetei <norbert(a)doyensec.com> ALSA: seq: close a re-opened queue timer in the destructor Mirela Rabulea <mirela.rabulea(a)nxp.com> media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor() Sakari Ailus <sakari.ailus(a)linux.intel.com> media: v4l: async: Set owner for async sub-devices Daniel Hodges <git(a)danielhodges.dev> wifi: ath6kl: fix use-after-free in aggr_reset_state() Sakari Ailus <sakari.ailus(a)linux.intel.com> media: imx219: Fix maximum frame length in lines Jai Luthra <jai.luthra(a)ideasonboard.com> media: i2c: imx219: Rename VTS to FRM_LENGTH David Plowman <david.plowman(a)raspberrypi.com> media: i2c: imx219: Correct the minimum vblanking value Laurent Pinchart <laurent.pinchart(a)ideasonboard.com> media: i2c: imx219: Drop IMX219_VTS_* macros Guangshuo Li <lgs201920130244(a)gmail.com> media: marvell-cam: fix missing pci_disable_device() on remove Jani Nikula <jani.nikula(a)intel.com> drm/i915/hdcp: require monotonically increasing seq_num_v Jani Nikula <jani.nikula(a)intel.com> drm/i915/hdcp: check streams[] bounds before overflow Jani Nikula <jani.nikula(a)intel.com> drm/i915/vrr: require valid min/max vfreq for VRR David Carlier <devnexen(a)gmail.com> media: aspeed: fix missing of_reserved_mem_device_release() on probe failure Bryam Vargas <hexlabsecurity(a)proton.me> drm/virtio: bound EDID block reads to the response buffer Dmitry Osipenko <dmitry.osipenko(a)collabora.com> drm/virtio: Return proper error codes instead of -1 Timur Kristóf <timur.kristof(a)gmail.com> drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT Thomas Zimmermann <tzimmermann(a)suse.de> drm/tegra: fbdev: Remove offset into framebuffer memory Jani Nikula <jani.nikula(a)intel.com> drm/displayid: fix Tiled Display Topology ID size Deepanshu Kartikey <kartikey406(a)gmail.com> drm/virtio: use uninterruptible resv lock for plane updates Christian König <christian.koenig(a)amd.com> dma-buf/drivers: make reserving a shared slot mandatory v4 Ashutosh Desai <ashutoshdesai993(a)gmail.com> drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers Ashutosh Desai <ashutoshdesai993(a)gmail.com> drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers Cen Zhang <zzzccc427(a)gmail.com> usb: gadget: f_tcm: synchronize delayed set_alt with teardown Ashutosh Desai <ashutoshdesai993(a)gmail.com> drm/dp/mst: fix buffer overflows in sideband chunk accumulation David Matlack <dmatlack(a)google.com> KVM: x86/mmu: Rename __direct_map() to direct_map() David Matlack <dmatlack(a)google.com> KVM: x86/mmu: Split out TDP MMU page fault handling Chao Peng <chao.p.peng(a)linux.intel.com> KVM: Rename mmu_notifier_* to mmu_invalidate_* Sean Christopherson <seanjc(a)google.com> KVM: x86/mmu: Document the "rules" for using host_pfn_mapping_level() Sean Christopherson <seanjc(a)google.com> KVM: x86/mmu: Rename pte_list_{destroy,remove}() to show they zap SPTEs Sean Christopherson <seanjc(a)google.com> KVM: x86/mmu: Directly "destroy" PTE list when recycling rmaps Reinette Chatre <reinette.chatre(a)intel.com> fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list Dawei Feng <dawei.feng(a)seu.edu.cn> octeontx2-pf: fix SQB pointer leak on init failure Haoxiang Li <haoxiang_li2024(a)163.com> net: ipa: fix SMEM state handle leaks in SMP2P init Sabrina Dubroca <sd(a)queasysnail.net> espintcp: use sk_msg_free_partial to fix partial send Breno Leitao <leitao(a)debian.org> bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline() Breno Leitao <leitao(a)debian.org> bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c Rasmus Villemoes <linux(a)rasmusvillemoes.dk> bootconfig: do not put quotes on cmdline items unless necessary Bryam Vargas <hexlabsecurity(a)proton.me> net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked Vladimir Oltean <vladimir.oltean(a)nxp.com> net/sched: taprio: avoid calling child->ops->dequeue(child) twice Runyu Xiao <runyu.xiao(a)seu.edu.cn> gpio: tegra: do not call pinctrl for GPIO direction Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> treewide: rename pinctrl_gpio_direction_output_new() Junrui Luo <moonafterrain(a)outlook.com> octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF Maoyi Xie <maoyixie.tju(a)gmail.com> net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink Dexuan Cui <decui(a)microsoft.com> net: mana: Validate the packet length reported by the NIC Zihan Xi <xizh2024(a)lzu.edu.cn> net/sched: act_ct: preserve tc_skb_cb across defragmentation Haoxiang Li <haoxiang_li2024(a)163.com> net: ixp4xx_hss: fix duplicate HDLC netdev allocation Maoyi Xie <maoyixie.tju(a)gmail.com> net: ipip: require CAP_NET_ADMIN in the device netns for changelink Liu Jian <liujian56(a)huawei.com> net: Add helper function to parse netlink msg of ip_tunnel_encap Thomas Gleixner <tglx(a)kernel.org> locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() Guangshuo Li <lgs201920130244(a)gmail.com> mmc: vub300: fix use-after-free on probe failure Johan Hovold <johan(a)kernel.org> mmc: vub300: rename probe error labels Johan Hovold <johan(a)kernel.org> mmc: vub300: fix use-after-free on disconnect Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: ims-pcu - fix firmware leak in async update Dmitry Torokhov <dmitry.torokhov(a)gmail.com> firmware_loader: introduce __free() cleanup hanler Mikulas Patocka <mpatocka(a)redhat.com> dm-verity: make error counter atomic Mikulas Patocka <mpatocka(a)redhat.com> dm-integrity: don't increment hash_offset twice Abdun Nihaal <nihaal(a)cse.iitm.ac.in> scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup() Souvik Banerjee <souvik(a)amlalabs.com> ovl: use linked upper dentry in copy-up tmpfile Jann Horn <jannh(a)google.com> bpf,fork: wipe ->bpf_storage before bailouts that access it Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Prevent XDomain delayed work use-after-free on disconnect Mika Westerberg <mika.westerberg(a)linux.intel.com> thunderbolt: Remove XDomain from the bus without holding tb->lock Mika Westerberg <mika.westerberg(a)linux.intel.com> thunderbolt: Remove service debugfs entries during unregister Mika Westerberg <mika.westerberg(a)linux.intel.com> thunderbolt: Keep XDomain reference during the lifetime of a service Alan Borzeszkowski <alan.borzeszkowski(a)linux.intel.com> thunderbolt: Update property.c function documentation Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> thunderbolt: Remove usage of the deprecated ida_simple_xx() API Fan Wu <fanwu01(a)zju.edu.cn> can: esd_usb: kill anchored URBs before freeing netdevs Frank Jungclaus <frank.jungclaus(a)esd.eu> can/esd_usb2: Rename esd_usb2.c to esd_usb.c Vincent Jardin <vjardin(a)free.fr> i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) Stefan Eichenberger <stefan.eichenberger(a)toradex.com> i2c: imx: separate atomic, dma and non-dma use case Ibrahim Hashimov <security(a)auditcode.ai> ksmbd: fix integer overflow in set_file_allocation_info() Jarkko Sakkinen <jarkko(a)kernel.org> tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat() Fredric Cover <fredric.cover.lkernel(a)gmail.com> smb: client: use kvzalloc() for megabyte buffer in simple fallocate Yiyang Chen <cyyzero16(a)gmail.com> taskstats: retain dead thread stats in TGID queries Oleg Nesterov <oleg(a)redhat.com> taskstats: fill_stats_for_tgid: use for_each_thread() Frank Li <Frank.Li(a)nxp.com> dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK Frank Li <Frank.Li(a)nxp.com> dmaengine: dw-edma: Detach the private data and chip info structures Frank Li <Frank.Li(a)nxp.com> dmaengine: dw-edma: Remove unused irq field in struct dw_edma_chip Miquel Raynal <miquel.raynal(a)bootlin.com> mtd: spi-nor: swp: Improve locking user experience Michael Walle <mwalle(a)kernel.org> mtd: spi-nor: Fix spi_nor_try_unlock_all() Maoyi Xie <maoyixie.tju(a)gmail.com> net: thunderbolt: Fix frags[] overflow by bounding frame_count Florian Fuchs <fuchsfl(a)gmail.com> mtd: maps: vmu-flash: fix fault in unaligned fixup Breno Leitao <leitao(a)debian.org> 9p: skip nlink update in cacheless mode to fix WARN_ON Michael Bommarito <michael.bommarito(a)gmail.com> ntfs3: validate split-point offset in indx_insert_into_buffer Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> fs/ntfs3: Undo critial modificatins to keep directory consistency Pavel Skripkin <paskripkin(a)gmail.com> fs/ntfs3: Make ntfs_update_mftmirr return void Tristan Madani <tristan(a)talencesecurity.com> selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() Casey Schaufler <casey(a)schaufler-ca.com> lsm: infrastructure management of the sock security Ondrej Mosnacek <omosnace(a)redhat.com> lsm: use default hook return value in call_int_hook() Wasim Nazir <wasim.nazir(a)oss.qualcomm.com> remoteproc: qcom: Fix leak when custom dump_segments addition fails Yogesh Lal <quic_ylal(a)quicinc.com> remoteproc: qcom: pas: Adjust the phys addr wrt the mem region Mukesh Ojha <quic_mojha(a)quicinc.com> remoteproc: qcom: fix sparse warnings Mukesh Ojha <quic_mojha(a)quicinc.com> remoteproc: qcom: replace kstrdup with kstrndup Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo: don't leak bad clone into future transaction Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo: move cloning of match info to insert/removal path Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo: merge deactivate helper into caller Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo: prepare walk function for on-demand clone Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo: make pipapo_clone helper return NULL Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_conntrack_sip: validate skb_dst() before accessing it Florian Westphal <fw(a)strlen.de> netfilter: nf_conntrack_sip: remove net variable shadowing Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo: move prove_locking helper around Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo: use GFP_KERNEL for insertions Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: mediatek: mt8192: Check runtime resume during probe Tang Bin <tangbin(a)cmss.chinamobile.com> ASoC: mediatek: mt8192-afe-pcm: Simplify probe() with local dev variable AngeloGioacchino Del Regno <angelogioacchino.delregno(a)collabora.com> ASoC: mediatek: Use common mtk_afe_pcm_platform with common probe cb AngeloGioacchino Del Regno <angelogioacchino.delregno(a)collabora.com> ASoC: mediatek: mt8192-afe-pcm: Simplify with dev_err_probe() AngeloGioacchino Del Regno <angelogioacchino.delregno(a)collabora.com> ASoC: mediatek: mt8192-afe-pcm: Convert to devm_pm_runtime_enable() Haoze Xie <royenheart(a)gmail.com> netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst Eric Dumazet <edumazet(a)google.com> ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu] Eric Dumazet <edumazet(a)google.com> net: dst: add four helpers to annotate data-races around dst->dev Eric Dumazet <edumazet(a)google.com> net: dst: annotate data-races around dst->output Eric Dumazet <edumazet(a)google.com> net: dst: annotate data-races around dst->input Eric Dumazet <edumazet(a)google.com> tcp: convert to dev_net_rcu() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: mediatek: mt8183: Check runtime resume during probe Runyu Xiao <runyu.xiao(a)seu.edu.cn> octeontx2-vf: clear stale mailbox IRQ state before request_irq() Runyu Xiao <runyu.xiao(a)seu.edu.cn> octeontx2-pf: clear stale mailbox IRQ state before request_irq() Subbaraya Sundeep <sbhatta(a)marvell.com> octeontx2: Annotate mmio regions as __iomem Geetha sowjanya <gakula(a)marvell.com> octeontx2-af: Fix APR entry mapping based on APR_LMT_CFG Jason Wang <jasowang(a)redhat.com> VDUSE: avoid leaking information to userspace Eugenio Pérez <eperezma(a)redhat.com> vduse: take out allocations from vduse_dev_alloc_coherent Eugenio Pérez <eperezma(a)redhat.com> vduse: remove unused vaddr parameter of vduse_domain_free_coherent Sheng Zhao <sheng.zhao(a)bytedance.com> vduse: Use fixed 4KB bounce pages for non-4KB page size Wentao Liang <vulab(a)iscas.ac.cn> mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() Petr Machata <petrm(a)nvidia.com> mlxsw: spectrum: On port enslavement to a LAG, join upper's bridges Li Xiasong <lixiasong1(a)huawei.com> tipc: restrict socket queue dumps in enqueue tracepoints Jiacheng Yu <yujiacheng3(a)huawei.com> fbcon: Use correct type for vc_resize() return value Thomas Zimmermann <tzimmermann(a)suse.de> fbcon: Rename struct fbcon_ops to struct fbcon_par Li Daming <d4n.for.sec(a)gmail.com> rxrpc: serialize kernel accept preallocation with socket teardown Tapio Reijonen <tapio.reijonen(a)vaisala.com> serial: max310x: implement gpio_chip::get_direction() Hugo Villeneuve <hvilleneuve(a)dimonoff.com> serial: max310x: replace bare use of 'unsigned' with 'unsigned int' (checkpatch) Xu Rao <raoxu(a)uniontech.com> ALSA: hda: Fix cached processing coefficient verbs Ricardo Robaina <rrobaina(a)redhat.com> audit: fix recursive locking deadlock in audit_dupe_exe() Ricardo Robaina <rrobaina(a)redhat.com> audit: use 'unsigned int' instead of 'unsigned' Jeff Layton <jlayton(a)kernel.org> audit: widen ino fields to u64 NeilBrown <neil(a)brown.name> VFS/audit: introduce kern_path_parent() for audit Zhang Heng <zhangheng(a)kylinos.cn> ALSA: hda: conexant: Remove mic bias threshold override Bryam Vargas <hexlabsecurity(a)proton.me> Input: mms114 - reject an oversized device packet size Haoxiang Li <haoxiang_li2024(a)163.com> i2c: davinci: Unregister cpufreq notifier on probe failure Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: mms114 - fix touch indexing for MMS134S and MMS136 Sebastian Alba Vives <sebasjosue84(a)gmail.com> fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() Mikhail Gavrilov <mikhail.v.gavrilov(a)gmail.com> dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning Jason Gunthorpe <jgg(a)ziepe.ca> udmabuf: Do not create malformed scatterlists Matt Bobrowski <mattbobrowski(a)google.com> bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized Weinan Liu <wnliu(a)google.com> iommu/amd: Don't split flush for amd_iommu_domain_flush_all() Pedro Falcato <pfalcato(a)suse.de> mm: do file ownership checks with the proper mount idmap Xiang Mei <xmei5(a)asu.edu> net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot Christoph Hellwig <hch(a)lst.de> xfs: check v5 superblock features early Long Li <leo.lilong(a)huawei.com> xfs: fix ilock leak on error in xfs_dq_get_next_id David Rosca <david.rosca(a)amd.com> drm/amdgpu: Fix UVD decode image min size calculation David Rosca <david.rosca(a)amd.com> drm/amdgpu: Implement insert_end for VCE 3 David Rosca <david.rosca(a)amd.com> drm/amdgpu: Reject UVD message with dimensions above 4096 Candice Li <candice.li(a)amd.com> drm/amdgpu: validate GEM_CREATE domain combinations David Rosca <david.rosca(a)amd.com> drm/amdgpu: Reject UVD message with invalid number of h265 refs Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Fix out of bounds check on CCW array Guangshuo Li <lgs201920130244(a)gmail.com> drm/radeon: fix autosuspend cleanup during teardown Pei Xiao <xiaopei01(a)kylinos.cn> mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition Haibo Chen <haibo.chen(a)nxp.com> mmc: sdhci: make tuning_err a signed int Myeonghun Pak <mhun512(a)gmail.com> mmc: sdhci: unmap the bounce buffer before device release Zhan Xusheng <zhanxusheng1024(a)gmail.com> mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit Kefu Chai <k.chai(a)proxmox.com> libceph: tolerate addrvecs with multiple entries of the same type Yiming Zhu <zhuyiming(a)kuaishou.com> ceph: fix MDS random selection readiness predicate Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Avoid using invalid osd indices from primary_temp Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: sur40 - fix V4L error path cleanup Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: sur40 - fix input device registration ordering Ali Ahmet Memis <ali(a)iusegentoo.com> openrisc: signal: do not restore privileged SR bits on sigreturn Josh Poimboeuf <jpoimboe(a)kernel.org> ftrace: Fix off-by-one fentry site disable in ftrace_free_mem() Pavitra Jha <jhapavitra98(a)gmail.com> libceph: fix multiple unsafe decodes in decode_locker() Thorsten Blum <thorsten.blum(a)linux.dev> crypto: qce - fix error path in devm_qce_register_algs Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: synaptics-rmi4 - block s_input when F54 queue is busy Bryam Vargas <hexlabsecurity(a)proton.me> Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: synaptics-rmi4 - zero report size on F54 work error George Wilson <gcwilson(a)linux.ibm.com> powerpc/pseries: lparcfg - fix kbuf[] underflow Pengpeng Hou <pengpeng(a)iscas.ac.cn> Input: iforce - validate input packet lengths Zhefu Zhang <a723356(a)gmail.com> Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard Linmao Li <lilinmao(a)kylinos.cn> Input: psxpad-spi - set driver data before use Richard Davies <richard(a)arachsys.com> Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: synaptics-rmi4 - fix F55 transmitter electrode count typo George Wilson <gcwilson(a)linux.ibm.com> powerpc/pseries: pci - logic bug Dawid Wróbel <me(a)dawidwrobel.com> ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: cs4265: sort the register default table Hidayath Khan <hidayath(a)linux.ibm.com> s390/qeth: validate user buffer length in SNMP and ARP query ioctls Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: options: reset DSS fields in case of unexpected size Bryam Vargas <hexlabsecurity(a)proton.me> selinux: do not cancel a policy conversion that never started Bryam Vargas <hexlabsecurity(a)proton.me> selinux: reject a class permission count below its inherited common Bryam Vargas <hexlabsecurity(a)proton.me> selinux: require every boolean value to be defined Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> ipvs: separate destination availability state Zhan Xusheng <zhanxusheng(a)xiaomi.com> fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() Jiasheng Jiang <jiashengjiangcool(a)gmail.com> media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization Fullway Wang <fullwaywang(a)outlook.com> media: mtk-vcodec: potential null pointer deference in SCP Chao Yu <chao(a)kernel.org> f2fs: fix UAF issue in f2fs_merge_page_bio() ------------- Diffstat: Makefile | 4 +- arch/arm64/boot/dts/nvidia/tegra194.dtsi | 2 + arch/arm64/kvm/mmu.c | 10 +- arch/mips/kvm/mmu.c | 12 +- arch/openrisc/include/asm/processor.h | 2 + arch/openrisc/kernel/signal.c | 5 +- arch/powerpc/include/asm/kvm_book3s_64.h | 2 +- arch/powerpc/kvm/book3s_64_mmu_host.c | 4 +- arch/powerpc/kvm/book3s_64_mmu_hv.c | 4 +- arch/powerpc/kvm/book3s_64_mmu_radix.c | 6 +- arch/powerpc/kvm/book3s_64_vio_hv.c | 2 +- arch/powerpc/kvm/book3s_hv_nested.c | 2 +- arch/powerpc/kvm/book3s_hv_rm_mmu.c | 8 +- arch/powerpc/kvm/e500_mmu_host.c | 4 +- arch/powerpc/platforms/pseries/lparcfg.c | 2 +- arch/powerpc/platforms/pseries/pci.c | 2 +- arch/x86/kernel/cpu/resctrl/rdtgroup.c | 12 +- arch/x86/kvm/mmu/mmu.c | 154 ++++-- arch/x86/kvm/mmu/paging_tmpl.h | 6 +- crypto/ccm.c | 2 +- drivers/char/tpm/tpm_tis_core.c | 38 +- drivers/crypto/qce/core.c | 2 +- drivers/dma-buf/dma-resv.c | 10 +- drivers/dma-buf/udmabuf.c | 21 +- drivers/dma/dw-edma/dw-edma-core.c | 90 ++-- drivers/dma/dw-edma/dw-edma-core.h | 33 +- drivers/dma/dw-edma/dw-edma-pcie.c | 83 ++-- drivers/dma/dw-edma/dw-edma-v0-core.c | 38 +- drivers/dma/dw-edma/dw-edma-v0-core.h | 4 +- drivers/dma/dw-edma/dw-edma-v0-debugfs.c | 18 +- drivers/dma/dw-edma/dw-edma-v0-debugfs.h | 8 +- drivers/fpga/dfl-afu-main.c | 3 + drivers/gpio/gpio-mvebu.c | 4 +- drivers/gpio/gpio-pxa.c | 4 +- drivers/gpio/gpio-rockchip.c | 4 +- drivers/gpio/gpio-tegra.c | 18 +- drivers/gpio/gpio-vf610.c | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 21 + drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 17 + drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 11 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 4 +- drivers/gpu/drm/amd/amdgpu/vce_v3_0.c | 26 +- drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 2 +- drivers/gpu/drm/amd/pm/amdgpu_pm.c | 14 +- drivers/gpu/drm/drm_connector.c | 12 +- drivers/gpu/drm/drm_dp_mst_topology.c | 32 +- drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c | 2 +- drivers/gpu/drm/i915/display/intel_hdcp.c | 12 +- drivers/gpu/drm/i915/display/intel_vrr.c | 4 + drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c | 4 +- drivers/gpu/drm/i915/i915_vma.c | 2 +- drivers/gpu/drm/lima/lima_gem.c | 2 +- drivers/gpu/drm/msm/msm_gem_submit.c | 2 +- drivers/gpu/drm/nouveau/nouveau_fence.c | 2 +- drivers/gpu/drm/qxl/qxl_release.c | 2 +- drivers/gpu/drm/radeon/radeon_kms.c | 1 + drivers/gpu/drm/radeon/radeon_vm.c | 2 +- drivers/gpu/drm/tegra/fb.c | 8 +- drivers/gpu/drm/ttm/ttm_bo.c | 4 +- drivers/gpu/drm/ttm/ttm_execbuf_util.c | 4 +- drivers/gpu/drm/vc4/vc4_gem.c | 2 +- drivers/gpu/drm/vgem/vgem_fence.c | 2 +- drivers/gpu/drm/virtio/virtgpu_drv.h | 1 + drivers/gpu/drm/virtio/virtgpu_gem.c | 28 ++ drivers/gpu/drm/virtio/virtgpu_plane.c | 10 +- drivers/gpu/drm/virtio/virtgpu_vq.c | 9 +- drivers/gpu/drm/vmwgfx/vmwgfx_cotable.c | 4 + drivers/i2c/busses/i2c-bcm-iproc.c | 11 +- drivers/i2c/busses/i2c-davinci.c | 4 +- drivers/i2c/busses/i2c-imx.c | 135 ++++-- drivers/input/joystick/iforce/iforce-packets.c | 11 +- drivers/input/joystick/iforce/iforce-usb.c | 3 + drivers/input/joystick/psxpad-spi.c | 1 + drivers/input/keyboard/atkbd.c | 8 + drivers/input/misc/ims-pcu.c | 5 +- drivers/input/mouse/focaltech.c | 2 +- drivers/input/rmi4/rmi_f54.c | 43 +- drivers/input/rmi4/rmi_f55.c | 4 +- drivers/input/touchscreen/mms114.c | 21 +- drivers/input/touchscreen/sur40.c | 23 +- drivers/iommu/amd/iommu.c | 3 +- drivers/md/dm-integrity.c | 4 - drivers/md/dm-verity-target.c | 12 +- drivers/md/dm-verity.h | 2 +- drivers/media/i2c/imx219.c | 47 +- drivers/media/platform/aspeed-video.c | 1 + drivers/media/platform/marvell-ccic/cafe-driver.c | 1 + .../media/platform/mtk-vcodec/mtk_vcodec_fw_scp.c | 5 + drivers/media/v4l2-core/v4l2-async.c | 8 +- drivers/media/v4l2-core/v4l2-fwnode.c | 6 +- drivers/mmc/host/atmel-mci.c | 2 + drivers/mmc/host/omap_hsmmc.c | 2 +- drivers/mmc/host/sdhci.c | 16 + drivers/mmc/host/sdhci.h | 2 +- drivers/mmc/host/vub300.c | 36 +- drivers/mtd/maps/vmu-flash.c | 8 +- drivers/mtd/spi-nor/swp.c | 30 +- drivers/net/can/usb/Kconfig | 15 +- drivers/net/can/usb/Makefile | 2 +- drivers/net/can/usb/{esd_usb2.c => esd_usb.c} | 5 +- drivers/net/can/usb/gs_usb.c | 2 +- drivers/net/ethernet/aquantia/atlantic/aq_ring.c | 25 + drivers/net/ethernet/aquantia/atlantic/aq_ring.h | 1 + drivers/net/ethernet/aquantia/atlantic/aq_vec.c | 2 +- drivers/net/ethernet/intel/ice/ice_ethtool.c | 10 +- drivers/net/ethernet/intel/ice/ice_main.c | 10 + drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c | 48 ++ drivers/net/ethernet/intel/igc/igc_main.c | 1 - drivers/net/ethernet/marvell/octeontx2/af/rvu.c | 14 +- drivers/net/ethernet/marvell/octeontx2/af/rvu.h | 1 + .../net/ethernet/marvell/octeontx2/af/rvu_cn10k.c | 18 +- .../net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 14 +- .../net/ethernet/marvell/octeontx2/nic/otx2_vf.c | 8 +- drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 92 +++- drivers/net/ethernet/microsoft/mana/mana_en.c | 13 + drivers/net/ethernet/ti/am65-cpsw-nuss.c | 2 + drivers/net/ipa/ipa_smp2p.c | 30 +- drivers/net/thunderbolt.c | 8 +- drivers/net/wan/ixp4xx_hss.c | 4 +- drivers/net/wireless/ath/ath6kl/txrx.c | 2 +- .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 16 +- .../net/wireless/broadcom/brcm80211/brcmfmac/bus.h | 6 + .../wireless/broadcom/brcm80211/brcmfmac/core.c | 45 +- .../wireless/broadcom/brcm80211/brcmfmac/pcie.c | 6 + .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 8 +- .../wireless/broadcom/brcm80211/brcmfmac/sdio.h | 1 + .../net/wireless/broadcom/brcm80211/brcmfmac/usb.c | 3 + drivers/net/wireless/marvell/libertas_tf/main.c | 2 +- drivers/pinctrl/bcm/pinctrl-bcm2835.c | 4 +- drivers/pinctrl/cirrus/pinctrl-lochnagar.c | 2 +- drivers/pinctrl/core.c | 15 +- drivers/pinctrl/intel/pinctrl-cherryview.c | 4 +- drivers/pinctrl/intel/pinctrl-intel.c | 4 +- drivers/pinctrl/intel/pinctrl-lynxpoint.c | 4 +- drivers/pinctrl/mediatek/pinctrl-moore.c | 4 +- drivers/pinctrl/mediatek/pinctrl-mtk-common.c | 4 +- drivers/pinctrl/mediatek/pinctrl-paris.c | 4 +- drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c | 4 +- drivers/pinctrl/pinctrl-as3722.c | 4 +- drivers/pinctrl/pinctrl-axp209.c | 2 +- drivers/pinctrl/pinctrl-ingenic.c | 11 +- drivers/pinctrl/pinctrl-ocelot.c | 4 +- drivers/pinctrl/pinctrl-rk805.c | 4 +- drivers/pinctrl/pinctrl-st.c | 4 +- drivers/pinctrl/renesas/gpio.c | 4 +- drivers/pinctrl/stm32/pinctrl-stm32.c | 4 +- drivers/pinctrl/sunxi/pinctrl-sunxi.c | 4 +- drivers/pinctrl/vt8500/pinctrl-wmt.c | 4 +- drivers/remoteproc/qcom_common.c | 31 +- drivers/remoteproc/qcom_common.h | 5 +- drivers/remoteproc/qcom_q6v5_pas.c | 20 +- drivers/s390/cio/vfio_ccw_cp.c | 17 +- drivers/s390/net/qeth_core_main.c | 3 + drivers/s390/net/qeth_l3_main.c | 5 + drivers/scsi/lpfc/lpfc_init.c | 3 +- drivers/scsi/scsi_debug.c | 27 +- drivers/scsi/sd.h | 27 +- drivers/scsi/sd_zbc.c | 126 +++-- drivers/thunderbolt/domain.c | 36 +- drivers/thunderbolt/icm.c | 5 + drivers/thunderbolt/nhi.c | 6 +- drivers/thunderbolt/nvm.c | 4 +- drivers/thunderbolt/property.c | 38 +- drivers/thunderbolt/switch.c | 20 +- drivers/thunderbolt/tb.c | 58 +-- drivers/thunderbolt/tb.h | 2 + drivers/thunderbolt/xdomain.c | 96 ++-- drivers/tty/serial/8250/8250_mid.c | 6 +- drivers/tty/serial/max310x.c | 20 +- drivers/tty/serial/sc16is7xx.c | 192 ++++++-- drivers/usb/gadget/function/f_tcm.c | 192 ++++++-- drivers/usb/gadget/function/tcm.h | 13 + drivers/vdpa/vdpa_user/iova_domain.c | 91 ++-- drivers/vdpa/vdpa_user/iova_domain.h | 13 +- drivers/vdpa/vdpa_user/vduse_dev.c | 16 +- drivers/video/fbdev/core/bitblit.c | 120 ++--- drivers/video/fbdev/core/fbcon.c | 413 ++++++++-------- drivers/video/fbdev/core/fbcon.h | 6 +- drivers/video/fbdev/core/fbcon_ccw.c | 146 +++--- drivers/video/fbdev/core/fbcon_cw.c | 146 +++--- drivers/video/fbdev/core/fbcon_rotate.c | 44 +- drivers/video/fbdev/core/fbcon_rotate.h | 6 +- drivers/video/fbdev/core/fbcon_ud.c | 162 +++---- drivers/video/fbdev/core/softcursor.c | 18 +- drivers/video/fbdev/core/tileblit.c | 28 +- fs/9p/vfs_inode.c | 9 + fs/binfmt_elf.c | 4 +- fs/binfmt_elf_fdpic.c | 4 +- fs/binfmt_misc.c | 14 +- fs/ceph/acl.c | 6 +- fs/ceph/addr.c | 20 +- fs/ceph/cache.c | 2 +- fs/ceph/caps.c | 53 ++- fs/ceph/dir.c | 20 +- fs/ceph/export.c | 10 +- fs/ceph/file.c | 42 +- fs/ceph/inode.c | 14 +- fs/ceph/ioctl.c | 8 +- fs/ceph/mds_client.c | 11 + fs/ceph/mds_client.h | 2 + fs/ceph/mdsmap.c | 2 +- fs/ceph/metric.c | 5 +- fs/ceph/snap.c | 2 +- fs/ceph/super.c | 22 +- fs/ceph/super.h | 14 +- fs/ceph/xattr.c | 12 +- fs/cifs/smb2ops.c | 4 +- fs/crypto/policy.c | 2 +- fs/exec.c | 6 +- fs/f2fs/data.c | 2 +- fs/ksmbd/auth.c | 4 +- fs/ksmbd/connection.c | 23 +- fs/ksmbd/connection.h | 5 + fs/ksmbd/oplock.c | 8 +- fs/ksmbd/smb2pdu.c | 102 ++-- fs/ksmbd/smb2pdu.h | 9 - fs/ksmbd/smb_common.c | 43 +- fs/ksmbd/smb_common.h | 9 + fs/namei.c | 43 ++ fs/ntfs3/fsntfs.c | 20 +- fs/ntfs3/index.c | 44 +- fs/ntfs3/ntfs_fs.h | 2 +- fs/overlayfs/copy_up.c | 14 +- fs/super.c | 19 +- fs/xfs/libxfs/xfs_sb.c | 4 +- fs/xfs/xfs_dquot.c | 3 +- include/drm/drm_connector.h | 6 +- include/drm/drm_displayid.h | 2 +- include/linux/audit.h | 18 +- include/linux/bootconfig.h | 3 + include/linux/bpf_lsm.h | 4 + include/linux/ceph/ceph_debug.h | 38 ++ include/linux/dma-resv.h | 2 +- include/linux/dma/edma.h | 50 +- include/linux/firmware.h | 3 + include/linux/fs.h | 33 ++ include/linux/ip.h | 21 + include/linux/jiffies.h | 13 + include/linux/kvm_host.h | 60 +-- include/linux/lsm_hooks.h | 1 + include/linux/mmc/sdio_ids.h | 2 +- include/linux/namei.h | 1 + include/linux/pinctrl/consumer.h | 13 +- include/linux/thunderbolt.h | 3 + include/media/v4l2-async.h | 8 +- include/net/dst.h | 24 +- include/net/inet6_hashtables.h | 2 +- include/net/inet_hashtables.h | 2 +- include/net/ip.h | 11 +- include/net/ip_tunnels.h | 3 + include/net/ip_vs.h | 7 + include/net/lwtunnel.h | 8 +- include/net/netfilter/nf_queue.h | 1 + include/net/route.h | 5 +- include/uapi/linux/ip_vs.h | 6 - init/main.c | 39 -- kernel/audit.c | 2 +- kernel/audit.h | 32 +- kernel/audit_fsnotify.c | 39 +- kernel/audit_tree.c | 2 +- kernel/audit_watch.c | 42 +- kernel/auditfilter.c | 17 +- kernel/auditsc.c | 6 +- kernel/bpf/bpf_inode_storage.c | 10 + kernel/fork.c | 21 +- kernel/locking/spinlock_rt.c | 27 +- kernel/sched/psi.c | 6 + kernel/taskstats.c | 67 +-- kernel/trace/ftrace.c | 21 +- lib/bootconfig.c | 65 +++ lib/compat_audit.c | 12 +- mm/madvise.c | 3 +- mm/memory_hotplug.c | 15 +- mm/mincore.c | 3 +- mm/pagewalk.c | 8 + mm/ptdump.c | 7 + net/bluetooth/hci_event.c | 2 - net/ceph/cls_lock_client.c | 21 +- net/ceph/decode.c | 18 +- net/ceph/osdmap.c | 9 +- net/core/dst.c | 8 +- net/core/pktgen.c | 43 +- net/core/sock.c | 6 +- net/ipv4/icmp.c | 24 +- net/ipv4/igmp.c | 2 +- net/ipv4/ip_fragment.c | 2 +- net/ipv4/ip_output.c | 4 +- net/ipv4/ip_tunnel_core.c | 35 ++ net/ipv4/ip_vti.c | 4 +- net/ipv4/ipip.c | 41 +- net/ipv4/netfilter.c | 4 +- net/ipv4/route.c | 10 +- net/ipv4/tcp_fastopen.c | 4 +- net/ipv4/tcp_ipv4.c | 8 +- net/ipv4/tcp_metrics.c | 8 +- net/ipv4/xfrm4_output.c | 2 +- net/ipv6/ip6_tunnel.c | 40 +- net/ipv6/sit.c | 38 +- net/ipv6/tcp_ipv6.c | 10 +- net/mptcp/options.c | 8 +- net/mptcp/pm_netlink.c | 4 - net/mptcp/protocol.c | 127 +++-- net/mptcp/protocol.h | 29 +- net/mptcp/sockopt.c | 24 +- net/mptcp/subflow.c | 17 +- net/netfilter/ipset/ip_set_core.c | 19 +- net/netfilter/ipset/ip_set_list_set.c | 7 +- net/netfilter/ipvs/ip_vs_conn.c | 4 +- net/netfilter/ipvs/ip_vs_core.c | 6 +- net/netfilter/ipvs/ip_vs_ctl.c | 4 +- net/netfilter/ipvs/ip_vs_dh.c | 4 +- net/netfilter/ipvs/ip_vs_lblc.c | 2 +- net/netfilter/ipvs/ip_vs_lblcr.c | 8 +- net/netfilter/nf_conntrack_sip.c | 10 +- net/netfilter/nf_flow_table_core.c | 7 +- net/netfilter/nf_queue.c | 14 + net/netfilter/nf_tables_offload.c | 2 +- net/netfilter/nfnetlink_queue.c | 3 + net/netfilter/nft_set_pipapo.c | 260 ++++++---- net/netfilter/nft_set_pipapo.h | 8 + net/openvswitch/conntrack.c | 39 +- net/packet/af_packet.c | 7 +- net/rxrpc/call_accept.c | 27 +- net/sched/act_ct.c | 41 +- net/sched/sch_api.c | 24 +- net/sched/sch_cake.c | 2 +- net/sched/sch_taprio.c | 12 +- net/sctp/protocol.c | 20 +- net/sctp/sysctl.c | 9 +- net/smc/af_smc.c | 3 +- net/smc/smc_rx.c | 12 +- net/smc/smc_tx.c | 17 +- net/tipc/socket.c | 6 +- net/x25/af_x25.c | 4 +- net/x25/x25_timer.c | 25 +- net/xfrm/espintcp.c | 32 +- security/apparmor/include/net.h | 6 +- security/apparmor/lsm.c | 38 +- security/bpf/hooks.c | 3 + security/security.c | 530 +++++++++++++-------- security/selinux/hooks.c | 91 ++-- security/selinux/include/objsec.h | 5 + security/selinux/netlabel.c | 23 +- security/selinux/ss/policydb.c | 31 ++ security/selinux/ss/services.c | 4 +- security/smack/smack.h | 5 + security/smack/smack_lsm.c | 66 ++- security/smack/smack_netfilter.c | 8 +- sound/core/seq/seq_timer.c | 13 +- sound/hda/hdac_regmap.c | 4 +- sound/pci/hda/patch_conexant.c | 3 - sound/soc/codecs/cs4265.c | 4 +- sound/soc/codecs/lpass-wsa-macro.c | 8 +- sound/soc/mediatek/mt8183/mt8183-afe-pcm.c | 12 +- sound/soc/mediatek/mt8192/mt8192-afe-pcm.c | 118 ++--- sound/soc/xilinx/xlnx_formatter_pcm.c | 10 +- virt/kvm/kvm_main.c | 49 +- 358 files changed, 4765 insertions(+), 2894 deletions(-)

6 hours, 29 minutes

[PATCH 6.1 000/303] 6.1.184-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.1.184 release. There are 303 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat, 22 Aug 2026 14:51:11 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.184-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.1.184-rc1 Zihan Xi <zihanx(a)nebusec.ai> Bluetooth: mgmt: fix pending command UAF in EIR updates Pauli Virtanen <pav(a)iki.fi> Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_sync: call destroy in hci_cmd_sync_run if immediate Edward Adam Davis <eadavis(a)qq.com> Bluetooth: hci_sock: Prevent race in socket write iter and sock bind Robert Mader <robert.mader(a)collabora.com> udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf() Gao Xiang <xiang(a)kernel.org> erofs: fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms Andrei Kuchynski <akuchynski(a)chromium.org> usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path Pedro Falcato <pfalcato(a)suse.de> RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_sync: Fix not using correct handle Christian Brauner <brauner(a)kernel.org> binfmt_misc: use exe_file_deny_write_access() for the interpreter clone Lorenzo Stoakes (ARM) <ljs(a)kernel.org> mm/huge_memory: fix huge_zero_pfn race Baul Lee <baul.lee(a)xbow.com> net/x25: fix use-after-free of the socket by its timers Siddharth Vadapalli <s-vadapalli(a)ti.com> net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG Zhang Changzhong <zhangchangzhong(a)huawei.com> net/sched: cls_u32: skip hash tables in u32_bind_class() Eric Dumazet <edumazet(a)google.com> af_packet: Don't send zero-byte data in tpacket_snd(). Rosen Penev <rosenp(a)gmail.com> ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers Chuck Lever <cel(a)kernel.org> net/tls: Fail tls_sw_splice_read() after a failed async decrypt Wei Fang <wei.fang(a)nxp.com> net: packet: fix wrong transport_header when sending VLAN-tagged frame Eric Dumazet <edumazet(a)google.com> macvlan: inherit needed_headroom and needed_tailroom from lowerdev Eric Dumazet <edumazet(a)google.com> ipvlan: inherit needed_headroom and needed_tailroom from phy_dev Florian Westphal <fw(a)strlen.de> netfilter: ipset: let destroy callbacks adjust ext mem size Florian Westphal <fw(a)strlen.de> netfilter: ipset: fix list type element drift bug Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> netfilter: flowtable: publish GC-visible tuple last Alexey Velichayshiy <a.velichayshiy(a)ispras.ru> netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path Xiang Mei (Microsoft) <xmei5(a)asu.edu> netfilter: ipset: fix refcount race between list:set GC and swap Herbert Xu <herbert(a)gondor.apana.org.au> crypto: ccm - Set rfc4309 maxauthsize from child Jon Hunter <jonathanh(a)nvidia.com> arm64: tegra: Add EL2 virtual timer interrupt for Tegra194 Zihan Xi <zihanx(a)nebusec.ai> netfilter: nf_conntrack: defer invalid log until after unlock Florian Westphal <fw(a)strlen.de> netfilter: conntrack: sctp: use nf log infrastructure for invalid packets Hyunjung Ko <hj351016(a)gmail.com> net/sched: act_ct: fix sk_buff leak when the header checks reject a packet Xin Long <lucien.xin(a)gmail.com> openvswitch: move key and ovs_cb update out of handle_fragments Xin Long <lucien.xin(a)gmail.com> net: sched: use skb_ip_totlen and iph_totlen Xin Long <lucien.xin(a)gmail.com> openvswitch: use skb_ip_totlen in conntrack Paolo Bonzini <pbonzini(a)redhat.com> KVM: SVM: Serialize accesses to the owner and mirror list with separate lock Sun Jian <sun.jian.kdev(a)gmail.com> veth: fix skb length accounting after XDP frag adjustment Stanislav Fomichev <sdf(a)google.com> veth: Introduce veth_xdp_buff wrapper for xdp_buff Lorenzo Stoakes (ARM) <ljs(a)kernel.org> mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF Pierre-Eric Pelloux-Prayer <pierre-eric.pelloux-prayer(a)amd.com> drm/amdgpu: move debug_vm handling to amdgpu_cs_parser_fini Tu Nguyen <tu.nguyen.xg(a)renesas.com> can: rcar_canfd: change the initializing flow for clocks and resets Geert Uytterhoeven <geert+renesas(a)glider.be> can: rcar_canfd: Extract rcar_canfd_global_{,de}init() Biju Das <biju.das.jz(a)bp.renesas.com> can: rcar_canfd: Use devm_clk_get_optional() for RAM clk Geert Uytterhoeven <geert+renesas(a)glider.be> can: rcar_canfd: Invert reset assert order Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: fix pptable use-after-free Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: fix torn gpu metrics reads Marc Kleine-Budde <mkl(a)pengutronix.de> can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure Jonas Gorski <jonas.gorski(a)bisdn.de> i2c: iproc: reset bus after timeout if START_BUSY is stuck Wolfram Sang <wsa+renesas(a)sang-engineering.com> i2c: bcm-iproc: remove printout on handled timeouts Christian Brauner <brauner(a)kernel.org> binfmt_misc: restore write access when removing an entry Amir Goldstein <amir73il(a)gmail.com> fs: don't block write during exec on pre-content watched files Amir Goldstein <amir73il(a)gmail.com> fsnotify: opt-in for permission events at file open time Dawei Feng <dawei.feng(a)seu.edu.cn> ice: fix memory leak in ice_lbtest_prepare_rings() Dawid Osuchowski <dawid.osuchowski(a)linux.intel.com> ice: fix VF interrupts cleanup Matt Fleming <mfleming(a)cloudflare.com> veth: convert frag_list skbs before running XDP Chengfeng Ye <nicoyip.dev(a)gmail.com> net: pktgen: fix proc entry use-after-free Peter Seiderer <ps.report(a)gmx.net> net: pktgen: fix code style (WARNING: Block comments) David Carlier <devnexen(a)gmail.com> igc: remove napi_synchronize() in igc_down() Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: reject repeated SMB2 NEGOTIATE requests Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: conn lock to serialize smb2 negotiate Chengfeng Ye <nicoyip.dev(a)gmail.com> Bluetooth: hci_sync: Fix advertising data UAFs Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_core: Fix not handling hdev->le_num_of_adv_sets=1 Gustavo A. R. Silva <gustavoars(a)kernel.org> Bluetooth: hci_conn, hci_sync: Use __counted_by() to avoid -Wfamnae warnings Kees Cook <keescook(a)chromium.org> overflow: Change DEFINE_FLEX to take __counted_by member Gregory Price <gourry(a)gourry.net> mm/vmstat: fold stranded per-cpu node stats when a node comes online Zihan Xi <xizh2024(a)lzu.edu.cn> Bluetooth: mgmt: fix UAF in pair command cancellation Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: MGMT: Protect mgmt_pending list with its own lock Dr. David Alan Gilbert <linux(a)treblig.org> Bluetooth: MGMT: Remove unused mgmt_pending_find_data Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: MGMT: Fix not generating command complete for MGMT_OP_DISCONNECT Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_sync: Introduce hci_cmd_sync_run/hci_cmd_sync_run_once Michael Bommarito <michael.bommarito(a)gmail.com> erofs: cap LZMA stream pool size Jingbo Xu <jefflexu(a)linux.alibaba.com> erofs: maintain cookies of share domain in self-contained list Gao Xiang <xiang(a)kernel.org> erofs: tidy up internal.h Kefeng Wang <wangkefeng.wang(a)huawei.com> mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE David Hildenbrand <david(a)redhat.com> mm/migrate_device: page_remove_rmap() -> folio_remove_rmap_pte() Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: validate minimum PDU size for transform requests ChenXiaoSong <chenxiaosong(a)kylinos.cn> smb/server: fix minimum SMB2 PDU size ChenXiaoSong <chenxiaosong(a)kylinos.cn> smb/server: fix minimum SMB1 PDU size Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: rename smb2_get_msg to smb_get_msg ChenXiaoSong <chenxiaosong(a)kylinos.cn> smb/server: rename include guard in smb_common.h Christian Brauner <brauner(a)kernel.org> super: fix emergency thaw deadlock on frozen block devices Wentao Guan <guanwentao(a)uniontech.com> ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL Haofeng Li <lihaofeng(a)kylinos.cn> ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl Ferry Meng <mengferry(a)linux.alibaba.com> ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow Aldo Ariel Panzardo <qwe.aldo(a)gmail.com> net/sched: serialize qdisc_rtab_list against concurrent get/put Shiming Cheng <shiming.cheng(a)mediatek.com> net: gro: fix double aggregation of flush-marked skbs Felix Fietkau <nbd(a)nbd.name> net: move skb_gro_receive_list from udp to core Pavitra Jha <jhapavitra98(a)gmail.com> libceph: fix two unsafe bare decodes in decode_lockers() Chancel Liu <chancel.liu(a)nxp.com> ASoC: fsl_sai: Fix spurious BCLK on resume by clearing BYP Max Kellermann <max.kellermann(a)ionos.com> ceph: fix hanging __ceph_get_caps() with stale mds_wanted Xiubo Li <xiubli(a)redhat.com> ceph: rename _to_client() to _to_fs_client() Xiubo Li <xiubli(a)redhat.com> ceph: pass the mdsc to several helpers Xiubo Li <xiubli(a)redhat.com> libceph: add doutc and *_client debug macros support Xiang Mei <xmei5(a)asu.edu> libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> libceph: Amend checking to fix `make W=1` build breakage Max Kellermann <max.kellermann(a)ionos.com> ceph: avoid fs reclaim while using current->journal_info Zhiling Zou <roxy520tt(a)gmail.com> sctp: avoid auth_enable sysctl UAF during netns teardown Geliang Tang <tanggeliang(a)kylinos.cn> mptcp: pm: userspace: fix use-after-free in get_local_id Geliang Tang <tanggeliang(a)kylinos.cn> mptcp: pm: use addr entry for get_local_id Geliang Tang <tanggeliang(a)kylinos.cn> mptcp: add mptcp_userspace_pm_lookup_addr helper Geliang Tang <tanggeliang(a)kylinos.cn> mptcp: pm: avoid code duplication to lookup endp Alexander Usyskin <alexander.usyskin(a)intel.com> mei: bus: access mei_device under device_lock on cleanup Kai Vehmanen <kai.vehmanen(a)linux.intel.com> ALSA: hda: codecs: hdmi: disable keep-alive before audio format change LiangCheng Wang <zaq14760(a)gmail.com> wifi: brcmfmac: set F2 blocksize to 256 for BCM43752 Gokul Sivakumar <gokulkumar.sivakumar(a)infineon.com> wifi: brcmfmac: fix 43752 SDIO FWVID incorrectly labelled as Cypress (CYW) Fan Wu <fanwu01(a)zju.edu.cn> wifi: brcmfmac: drain bus_reset work on device removal Daniel Hodges <git(a)danielhodges.dev> wifi: ath6kl: fix use-after-free in aggr_reset_state() Sakari Ailus <sakari.ailus(a)linux.intel.com> media: imx219: Fix maximum frame length in lines Jai Luthra <jai.luthra(a)ideasonboard.com> media: i2c: imx219: Rename VTS to FRM_LENGTH David Plowman <david.plowman(a)raspberrypi.com> media: i2c: imx219: Correct the minimum vblanking value Laurent Pinchart <laurent.pinchart(a)ideasonboard.com> media: i2c: imx219: Drop IMX219_VTS_* macros Jani Nikula <jani.nikula(a)intel.com> drm/i915/hdcp: check streams[] bounds before overflow Jani Nikula <jani.nikula(a)intel.com> drm/i915/hdcp: require monotonically increasing seq_num_v Suraj Kandpal <suraj.kandpal(a)intel.com> drm/i915/hdcp: Move to using intel_display in intel_hdcp Jani Nikula <jani.nikula(a)intel.com> drm/i915/vrr: require valid min/max vfreq for VRR Ville Syrjälä <ville.syrjala(a)linux.intel.com> drm/i915/vrr: Check HAS_VRR() first in intel_vrr_is_capable() Timur Kristóf <timur.kristof(a)gmail.com> drm/amdgpu: Respect placement requirements in amdgpu_gtt_mgr functions Thomas Zimmermann <tzimmermann(a)suse.de> drm/tegra: fbdev: Remove offset into framebuffer memory Jani Nikula <jani.nikula(a)intel.com> drm/displayid: fix Tiled Display Topology ID size Andrei Kuchynski <akuchynski(a)chromium.org> usb: typec: ucsi: Fix race condition and ordering in port unregistration Sergey Senozhatsky <senozhatsky(a)chromium.org> usb: typec: ucsi: split connector lock classes Diogo Ivo <diogo.ivo(a)tecnico.ulisboa.pt> usb: typec: ucsi: Only enable supported notifications Cen Zhang <zzzccc427(a)gmail.com> usb: gadget: f_tcm: synchronize delayed set_alt with teardown Vitor Soares <vitor.soares(a)toradex.com> drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS() Guangshuo Li <lgs201920130244(a)gmail.com> usb: musb: omap2430: Do not put borrowed of_node in probe Johan Hovold <johan(a)kernel.org> usb: musb: omap2430: clean up probe error handling Venkatesh Srinivas <venkateshs(a)chromium.org> KVM: x86: Only reset TSC Deadline Timer in apic_timer_expired on KVM_RUN David Matlack <dmatlack(a)google.com> KVM: Introduce vcpu->wants_to_run Alex Williamson <alex.williamson(a)nvidia.com> vfio/pci: Fix racy bitfields and tighten struct layout Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: HCI: Remove HCI_AMP support Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> Bluetooth: Remove usage of the deprecated ida_simple_xx() API Reinette Chatre <reinette.chatre(a)intel.com> fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list Peng Fan <peng.fan(a)nxp.com> pmdomain: imx: Fix i.MX8MP power notifier Bryam Vargas <hexlabsecurity(a)proton.me> ata: libata-core: Reject an invalid concurrent positioning ranges count Dawei Feng <dawei.feng(a)seu.edu.cn> octeontx2-pf: fix SQB pointer leak on init failure Haoxiang Li <haoxiang_li2024(a)163.com> net: ipa: fix SMEM state handle leaks in SMP2P init Crystal Wood <crwood(a)redhat.com> tracing/osnoise: Call synchronize_rcu() when unregistering Uladzislau Rezki (Sony) <urezki(a)gmail.com> tracing: Rename kvfree_rcu() to kvfree_rcu_mightsleep() Théo Lebrun <theo.lebrun(a)bootlin.com> net: macb: drop in-flight Tx SKBs on close Wentao Liang <vulab(a)iscas.ac.cn> ipmi: fix refcount leak in i_ipmi_request() Breno Leitao <leitao(a)debian.org> bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline() Breno Leitao <leitao(a)debian.org> bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c Rasmus Villemoes <linux(a)rasmusvillemoes.dk> bootconfig: do not put quotes on cmdline items unless necessary Sabrina Dubroca <sd(a)queasysnail.net> espintcp: use sk_msg_free_partial to fix partial send David Howells <dhowells(a)redhat.com> tcp_bpf, smc, tls, espintcp, siw: Reduce MSG_SENDPAGE_NOTLAST usage David Howells <dhowells(a)redhat.com> siw: Inline do_tcp_sendpages() David Howells <dhowells(a)redhat.com> espintcp: Inline do_tcp_sendpages() David Howells <dhowells(a)redhat.com> tcp_bpf: Inline do_tcp_sendpages as it's now a wrapper around tcp_sendmsg Bryam Vargas <hexlabsecurity(a)proton.me> net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked Vladimir Oltean <vladimir.oltean(a)nxp.com> net/sched: taprio: avoid calling child->ops->dequeue(child) twice Junrui Luo <moonafterrain(a)outlook.com> octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF Sergio Paracuellos <sergio.paracuellos(a)gmail.com> gpio: mt7621: avoid corruption of shared interrupt trigger state Runyu Xiao <runyu.xiao(a)seu.edu.cn> gpio: tegra: do not call pinctrl for GPIO direction Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> treewide: rename pinctrl_gpio_direction_input_new() Maoyi Xie <maoyixie.tju(a)gmail.com> net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink Zihan Xi <xizh2024(a)lzu.edu.cn> net/sched: act_ct: preserve tc_skb_cb across defragmentation Dexuan Cui <decui(a)microsoft.com> net: mana: Validate the packet length reported by the NIC Thomas Gleixner <tglx(a)kernel.org> locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() Guangshuo Li <lgs201920130244(a)gmail.com> mmc: vub300: fix use-after-free on probe failure Johan Hovold <johan(a)kernel.org> mmc: vub300: rename probe error labels Johan Hovold <johan(a)kernel.org> mmc: vub300: fix use-after-free on disconnect Maoyi Xie <maoyixie.tju(a)gmail.com> wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: ims-pcu - fix firmware leak in async update Dmitry Torokhov <dmitry.torokhov(a)gmail.com> firmware_loader: introduce __free() cleanup hanler Mikulas Patocka <mpatocka(a)redhat.com> dm-verity: make error counter atomic Mikulas Patocka <mpatocka(a)redhat.com> dm-integrity: don't increment hash_offset twice Heinz Mauelshagen <heinzm(a)redhat.com> dm: remove unnecessary braces from single statement blocks Heinz Mauelshagen <heinzm(a)redhat.com> dm: add missing empty lines Heinz Mauelshagen <heinzm(a)redhat.com> dm crypt: correct 'foo*' to 'foo *' Heinz Mauelshagen <heinzm(a)redhat.com> dm: fix trailing statements Mikulas Patocka <mpatocka(a)redhat.com> dm-verity: avoid double increment of &use_bh_wq_enabled Souvik Banerjee <souvik(a)amlalabs.com> ovl: use linked upper dentry in copy-up tmpfile Jann Horn <jannh(a)google.com> bpf,fork: wipe ->bpf_storage before bailouts that access it Vincent Jardin <vjardin(a)free.fr> i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) Stefan Eichenberger <stefan.eichenberger(a)toradex.com> i2c: imx: separate atomic, dma and non-dma use case Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Prevent XDomain delayed work use-after-free on disconnect Yiyang Chen <cyyzero16(a)gmail.com> taskstats: retain dead thread stats in TGID queries Oleg Nesterov <oleg(a)redhat.com> taskstats: fill_stats_for_tgid: use for_each_thread() Maoyi Xie <maoyixie.tju(a)gmail.com> net: thunderbolt: Fix frags[] overflow by bounding frame_count Florian Fuchs <fuchsfl(a)gmail.com> mtd: maps: vmu-flash: fix fault in unaligned fixup Breno Leitao <leitao(a)debian.org> 9p: skip nlink update in cacheless mode to fix WARN_ON Muchun Song <muchun.song(a)linux.dev> mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE Aneesh Kumar K.V <aneesh.kumar(a)linux.ibm.com> mm/vmemmap/devdax: fix kernel crash when probing devdax devices Mike Rapoport (IBM) <rppt(a)kernel.org> mm: move most of core MM initialization to mm/mm_init.c Michael Bommarito <michael.bommarito(a)gmail.com> ntfs3: validate split-point offset in indx_insert_into_buffer Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> fs/ntfs3: Undo critial modificatins to keep directory consistency Fernando Fernandez Mancera <fmancera(a)suse.de> netfilter: nft_objref: validate objref and objrefmap expressions Yue Haibing <yuehaibing(a)huawei.com> netfilter: nf_tables: Remove unused nft_reduce_is_readonly() Jeremy Sowden <jeremy(a)azazel.net> netfilter: bitwise: rename some boolean operation functions Florian Westphal <fw(a)strlen.de> netfilter: nf_tables: drop unused 3rd argument from validate callback ops Florian Westphal <fw(a)strlen.de> netfilter: nf_tables: pass context structure to nft_parse_register_load Wasim Nazir <wasim.nazir(a)oss.qualcomm.com> remoteproc: qcom: Fix leak when custom dump_segments addition fails Yogesh Lal <quic_ylal(a)quicinc.com> remoteproc: qcom: pas: Adjust the phys addr wrt the mem region Mukesh Ojha <quic_mojha(a)quicinc.com> remoteproc: qcom: fix sparse warnings Mukesh Ojha <quic_mojha(a)quicinc.com> remoteproc: qcom: replace kstrdup with kstrndup Tristan Madani <tristan(a)talencesecurity.com> selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() Casey Schaufler <casey(a)schaufler-ca.com> lsm: infrastructure management of the sock security Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_conntrack_sip: validate skb_dst() before accessing it Florian Westphal <fw(a)strlen.de> netfilter: nf_conntrack_sip: remove net variable shadowing Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo: don't leak bad clone into future transaction Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo: move cloning of match info to insert/removal path Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo: merge deactivate helper into caller Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo: prepare walk function for on-demand clone Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo: make pipapo_clone helper return NULL Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo: move prove_locking helper around Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo: use GFP_KERNEL for insertions Sumanth Korikkar <sumanthk(a)linux.ibm.com> s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init() Thomas Richter <tmricht(a)linux.ibm.com> s390/cpum_cf: merge source files for CPU Measurement counter facility Thomas Richter <tmricht(a)linux.ibm.com> s390/cpum_cf: remove in-kernel counting facility interface Thomas Richter <tmricht(a)linux.ibm.com> s390/cpum_cf: move stccm_avail() Thomas Richter <tmricht(a)linux.ibm.com> s390/cpum_cf: move cpum_cf_ctrset_size() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: mediatek: mt8192: Check runtime resume during probe Tang Bin <tangbin(a)cmss.chinamobile.com> ASoC: mediatek: mt8192-afe-pcm: Simplify probe() with local dev variable AngeloGioacchino Del Regno <angelogioacchino.delregno(a)collabora.com> ASoC: mediatek: Use common mtk_afe_pcm_platform with common probe cb AngeloGioacchino Del Regno <angelogioacchino.delregno(a)collabora.com> ASoC: mediatek: mt8192-afe-pcm: Simplify with dev_err_probe() AngeloGioacchino Del Regno <angelogioacchino.delregno(a)collabora.com> ASoC: mediatek: mt8192-afe-pcm: Convert to devm_pm_runtime_enable() Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: mediatek: mt8183: Check runtime resume during probe Runyu Xiao <runyu.xiao(a)seu.edu.cn> octeontx2-vf: clear stale mailbox IRQ state before request_irq() Runyu Xiao <runyu.xiao(a)seu.edu.cn> octeontx2-pf: clear stale mailbox IRQ state before request_irq() Subbaraya Sundeep <sbhatta(a)marvell.com> octeontx2: Annotate mmio regions as __iomem Wentao Liang <vulab(a)iscas.ac.cn> mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() Petr Machata <petrm(a)nvidia.com> mlxsw: spectrum: On port enslavement to a LAG, join upper's bridges Jason Wang <jasowang(a)redhat.com> VDUSE: avoid leaking information to userspace Eugenio Pérez <eperezma(a)redhat.com> vduse: take out allocations from vduse_dev_alloc_coherent Eugenio Pérez <eperezma(a)redhat.com> vduse: remove unused vaddr parameter of vduse_domain_free_coherent Sheng Zhao <sheng.zhao(a)bytedance.com> vduse: Use fixed 4KB bounce pages for non-4KB page size Li Xiasong <lixiasong1(a)huawei.com> tipc: restrict socket queue dumps in enqueue tracepoints Jiacheng Yu <yujiacheng3(a)huawei.com> fbcon: Use correct type for vc_resize() return value Thomas Zimmermann <tzimmermann(a)suse.de> fbcon: Rename struct fbcon_ops to struct fbcon_par Li Daming <d4n.for.sec(a)gmail.com> rxrpc: serialize kernel accept preallocation with socket teardown Tapio Reijonen <tapio.reijonen(a)vaisala.com> serial: max310x: implement gpio_chip::get_direction() Hugo Villeneuve <hvilleneuve(a)dimonoff.com> serial: max310x: replace bare use of 'unsigned' with 'unsigned int' (checkpatch) Xu Rao <raoxu(a)uniontech.com> ALSA: hda: Fix cached processing coefficient verbs Zhang Heng <zhangheng(a)kylinos.cn> ALSA: hda: conexant: Remove mic bias threshold override Ricardo Robaina <rrobaina(a)redhat.com> audit: fix recursive locking deadlock in audit_dupe_exe() Ricardo Robaina <rrobaina(a)redhat.com> audit: use 'unsigned int' instead of 'unsigned' Jeff Layton <jlayton(a)kernel.org> audit: widen ino fields to u64 NeilBrown <neil(a)brown.name> VFS/audit: introduce kern_path_parent() for audit Bryam Vargas <hexlabsecurity(a)proton.me> Input: mms114 - reject an oversized device packet size Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: mms114 - fix touch indexing for MMS134S and MMS136 Haoxiang Li <haoxiang_li2024(a)163.com> i2c: davinci: Unregister cpufreq notifier on probe failure Sebastian Alba Vives <sebasjosue84(a)gmail.com> fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() Mikhail Gavrilov <mikhail.v.gavrilov(a)gmail.com> dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning Jason Gunthorpe <jgg(a)ziepe.ca> udmabuf: Do not create malformed scatterlists Weinan Liu <wnliu(a)google.com> iommu/amd: Don't split flush for amd_iommu_domain_flush_all() Matt Bobrowski <mattbobrowski(a)google.com> bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized Pedro Falcato <pfalcato(a)suse.de> mm: do file ownership checks with the proper mount idmap Alexandre Ghiti <alexghiti(a)rivosinc.com> riscv: Don't use PGD entries for the linear mapping Xiang Mei <xmei5(a)asu.edu> net: bonding: fix use-after-free in bond_xmit_broadcast() Palmer Dabbelt <palmer(a)rivosinc.com> RISC-V: Provide pgtable_l5_enabled on rv32 Christoph Hellwig <hch(a)lst.de> xfs: check v5 superblock features early Long Li <leo.lilong(a)huawei.com> xfs: don't swallow dquot recovery verification errors Long Li <leo.lilong(a)huawei.com> xfs: fix ilock leak on error in xfs_dq_get_next_id David Rosca <david.rosca(a)amd.com> drm/amdgpu: Fix UVD decode image min size calculation David Rosca <david.rosca(a)amd.com> drm/amdgpu: Implement insert_end for VCE 3 David Rosca <david.rosca(a)amd.com> drm/amdgpu: Reject UVD message with dimensions above 4096 Candice Li <candice.li(a)amd.com> drm/amdgpu: validate GEM_CREATE domain combinations David Rosca <david.rosca(a)amd.com> drm/amdgpu: Reject UVD message with invalid number of h265 refs Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Fix out of bounds check on CCW array Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Ensure index for read/write regions are within range Guangshuo Li <lgs201920130244(a)gmail.com> drm/radeon: fix autosuspend cleanup during teardown Pei Xiao <xiaopei01(a)kylinos.cn> mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition Haibo Chen <haibo.chen(a)nxp.com> mmc: sdhci: make tuning_err a signed int Myeonghun Pak <mhun512(a)gmail.com> mmc: sdhci: unmap the bounce buffer before device release Zhan Xusheng <zhanxusheng1024(a)gmail.com> mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit Kefu Chai <k.chai(a)proxmox.com> libceph: tolerate addrvecs with multiple entries of the same type Yiming Zhu <zhuyiming(a)kuaishou.com> ceph: fix MDS random selection readiness predicate Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Avoid using invalid osd indices from primary_temp Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: sur40 - fix V4L error path cleanup Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: sur40 - fix input device registration ordering Ali Ahmet Memis <ali(a)iusegentoo.com> openrisc: signal: do not restore privileged SR bits on sigreturn Josh Poimboeuf <jpoimboe(a)kernel.org> ftrace: Fix off-by-one fentry site disable in ftrace_free_mem() Pavitra Jha <jhapavitra98(a)gmail.com> libceph: fix multiple unsafe decodes in decode_locker() Thorsten Blum <thorsten.blum(a)linux.dev> crypto: qce - fix error path in devm_qce_register_algs Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: synaptics-rmi4 - block s_input when F54 queue is busy Bryam Vargas <hexlabsecurity(a)proton.me> Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: synaptics-rmi4 - zero report size on F54 work error George Wilson <gcwilson(a)linux.ibm.com> powerpc/pseries: lparcfg - fix kbuf[] underflow Pengpeng Hou <pengpeng(a)iscas.ac.cn> Input: iforce - validate input packet lengths Zhefu Zhang <a723356(a)gmail.com> Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard Linmao Li <lilinmao(a)kylinos.cn> Input: psxpad-spi - set driver data before use Richard Davies <richard(a)arachsys.com> Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: synaptics-rmi4 - fix F55 transmitter electrode count typo George Wilson <gcwilson(a)linux.ibm.com> powerpc/pseries: pci - logic bug Dawid Wróbel <me(a)dawidwrobel.com> ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: cs35l41: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: cs4265: sort the register default table Hidayath Khan <hidayath(a)linux.ibm.com> s390/qeth: validate user buffer length in SNMP and ARP query ioctls Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: options: reset DSS fields in case of unexpected size Gang Yan <yangang(a)kylinos.cn> selftests: mptcp: join: mark tests with data corruption as failed Bryam Vargas <hexlabsecurity(a)proton.me> selinux: do not cancel a policy conversion that never started Bryam Vargas <hexlabsecurity(a)proton.me> selinux: reject a class permission count below its inherited common Bryam Vargas <hexlabsecurity(a)proton.me> selinux: require every boolean value to be defined Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> ipvs: separate destination availability state Zhan Xusheng <zhanxusheng(a)xiaomi.com> fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() Chao Yu <chao(a)kernel.org> f2fs: fix UAF issue in f2fs_merge_page_bio() Matthew Rosato <mjrosato(a)linux.ibm.com> KVM: s390: pci: Fix aisb calculation Farhan Ali <alifm(a)linux.ibm.com> KVM: s390: pci: Fix resource leak on IRQ registration failure Farhan Ali <alifm(a)linux.ibm.com> KVM: s390: pci: Fix missing error codes and memory unaccounting Farhan Ali <alifm(a)linux.ibm.com> KVM: s390: pci: Fix memory accounting for pinned/unpinned pages Jason Gunthorpe <jgg(a)ziepe.ca> kernel/user: Allow user_struct::locked_vm to be usable for iommufd Chao Shi <coshi036(a)gmail.com> block: stop the timeout timer when releasing a never added disk ------------- Diffstat: Makefile | 4 +- arch/arm64/boot/dts/nvidia/tegra194.dtsi | 2 + arch/arm64/kvm/arm.c | 2 +- arch/mips/kvm/mips.c | 2 +- arch/openrisc/include/asm/processor.h | 2 + arch/openrisc/kernel/signal.c | 5 +- arch/powerpc/kvm/powerpc.c | 2 +- arch/powerpc/platforms/pseries/lparcfg.c | 2 +- arch/powerpc/platforms/pseries/pci.c | 2 +- arch/riscv/include/asm/pgtable-32.h | 3 + arch/riscv/include/asm/pgtable.h | 1 - arch/riscv/kvm/vcpu.c | 2 +- arch/riscv/mm/init.c | 11 +- arch/s390/include/asm/cpu_mcf.h | 112 ------ arch/s390/kernel/Makefile | 2 +- arch/s390/kernel/perf_cpum_cf.c | 272 ++++++++++++- arch/s390/kernel/perf_cpum_cf_common.c | 233 ------------ arch/s390/kernel/perf_pai_ext.c | 2 +- arch/s390/kvm/kvm-s390.c | 2 +- arch/s390/kvm/pci.c | 86 +++-- arch/s390/kvm/pci.h | 2 + arch/x86/kernel/cpu/resctrl/rdtgroup.c | 12 +- arch/x86/kvm/lapic.c | 2 +- arch/x86/kvm/svm/sev.c | 34 +- arch/x86/kvm/svm/svm.h | 1 + arch/x86/kvm/x86.c | 4 +- block/genhd.c | 12 +- crypto/ccm.c | 2 +- drivers/ata/libata-core.c | 18 + drivers/ata/libata-scsi.c | 2 - drivers/ata/libata.h | 9 + drivers/bluetooth/btmrvl_main.c | 9 - drivers/bluetooth/btrsi.c | 1 - drivers/bluetooth/btsdio.c | 8 - drivers/bluetooth/btusb.c | 5 - drivers/bluetooth/hci_ldisc.c | 6 - drivers/bluetooth/hci_serdev.c | 5 - drivers/bluetooth/hci_uart.h | 1 - drivers/bluetooth/hci_vhci.c | 10 +- drivers/bluetooth/virtio_bt.c | 2 - drivers/char/ipmi/ipmi_msghandler.c | 8 + drivers/crypto/qce/core.c | 2 +- drivers/dma-buf/udmabuf.c | 21 +- drivers/fpga/dfl-afu-main.c | 3 + drivers/gpio/gpio-mt7621.c | 2 + drivers/gpio/gpio-mvebu.c | 4 +- drivers/gpio/gpio-pxa.c | 4 +- drivers/gpio/gpio-tegra.c | 18 +- drivers/gpio/gpio-vf610.c | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 30 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 21 ++ drivers/gpu/drm/amd/amdgpu/amdgpu_gtt_mgr.c | 30 +- drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 11 +- drivers/gpu/drm/amd/amdgpu/vce_v3_0.c | 26 +- drivers/gpu/drm/amd/pm/amdgpu_dpm.c | 27 +- drivers/gpu/drm/amd/pm/amdgpu_pm.c | 16 +- drivers/gpu/drm/amd/pm/inc/amdgpu_dpm.h | 6 +- drivers/gpu/drm/bridge/cdns-dsi.c | 11 +- drivers/gpu/drm/drm_connector.c | 12 +- drivers/gpu/drm/i915/display/intel_display_core.h | 3 + drivers/gpu/drm/i915/display/intel_hdcp.c | 22 +- drivers/gpu/drm/i915/display/intel_vrr.c | 10 +- drivers/gpu/drm/i915/i915_driver.c | 3 + drivers/gpu/drm/radeon/radeon_kms.c | 1 + drivers/gpu/drm/tegra/fb.c | 8 +- drivers/i2c/busses/i2c-bcm-iproc.c | 11 +- drivers/i2c/busses/i2c-davinci.c | 4 +- drivers/i2c/busses/i2c-imx.c | 126 +++++-- drivers/infiniband/sw/siw/siw_qp_tx.c | 17 +- drivers/input/joystick/iforce/iforce-packets.c | 11 +- drivers/input/joystick/iforce/iforce-usb.c | 3 + drivers/input/joystick/psxpad-spi.c | 1 + drivers/input/keyboard/atkbd.c | 8 + drivers/input/misc/ims-pcu.c | 5 +- drivers/input/mouse/focaltech.c | 2 +- drivers/input/rmi4/rmi_f54.c | 43 ++- drivers/input/rmi4/rmi_f55.c | 4 +- drivers/input/touchscreen/mms114.c | 21 +- drivers/input/touchscreen/sur40.c | 23 +- drivers/iommu/amd/iommu.c | 3 +- drivers/md/dm-bufio.c | 9 + drivers/md/dm-cache-metadata.c | 6 + drivers/md/dm-cache-policy-internal.h | 3 + drivers/md/dm-cache-policy-smq.c | 2 + drivers/md/dm-cache-target.c | 12 +- drivers/md/dm-crypt.c | 20 +- drivers/md/dm-era-target.c | 10 +- drivers/md/dm-flakey.c | 4 +- drivers/md/dm-integrity.c | 182 +++++---- drivers/md/dm-io.c | 25 +- drivers/md/dm-ioctl.c | 18 +- drivers/md/dm-kcopyd.c | 2 + drivers/md/dm-log.c | 6 + drivers/md/dm-mpath.c | 3 + drivers/md/dm-rq.c | 2 + drivers/md/dm-snap-persistent.c | 23 +- drivers/md/dm-snap.c | 10 +- drivers/md/dm-stats.c | 24 +- drivers/md/dm-stripe.c | 10 +- drivers/md/dm-sysfs.c | 1 + drivers/md/dm-table.c | 3 +- drivers/md/dm-thin-metadata.c | 5 +- drivers/md/dm-thin.c | 5 + drivers/md/dm-verity-target.c | 24 +- drivers/md/dm-verity.h | 2 +- drivers/md/dm-writecache.c | 54 ++- drivers/md/persistent-data/dm-array.c | 4 + drivers/md/persistent-data/dm-bitset.c | 1 + drivers/md/persistent-data/dm-block-manager.c | 7 +- drivers/md/persistent-data/dm-btree-internal.h | 1 + drivers/md/persistent-data/dm-btree-remove.c | 5 + drivers/md/persistent-data/dm-btree-spine.c | 6 +- drivers/md/persistent-data/dm-btree.c | 10 + drivers/md/persistent-data/dm-space-map-common.c | 6 + drivers/md/persistent-data/dm-space-map-disk.c | 12 +- drivers/md/persistent-data/dm-space-map-metadata.c | 3 + .../md/persistent-data/dm-transaction-manager.c | 1 + drivers/media/i2c/imx219.c | 47 +-- drivers/misc/mei/bus.c | 16 +- drivers/mmc/host/atmel-mci.c | 2 + drivers/mmc/host/omap_hsmmc.c | 2 +- drivers/mmc/host/sdhci.c | 16 + drivers/mmc/host/sdhci.h | 2 +- drivers/mmc/host/vub300.c | 36 +- drivers/mtd/maps/vmu-flash.c | 8 +- drivers/net/bonding/bond_main.c | 2 +- drivers/net/can/rcar/rcar_canfd.c | 177 +++++---- drivers/net/can/usb/gs_usb.c | 4 +- drivers/net/ethernet/cadence/macb_main.c | 22 +- drivers/net/ethernet/intel/ice/ice_ethtool.c | 10 +- drivers/net/ethernet/intel/ice/ice_vf_lib.c | 27 ++ .../net/ethernet/intel/ice/ice_vf_lib_private.h | 1 + drivers/net/ethernet/intel/ice/ice_virtchnl.c | 21 ++ drivers/net/ethernet/intel/igc/igc_main.c | 1 - drivers/net/ethernet/marvell/octeontx2/af/rvu.c | 14 +- drivers/net/ethernet/marvell/octeontx2/af/rvu.h | 1 + .../net/ethernet/marvell/octeontx2/af/rvu_cn10k.c | 9 + .../net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 14 +- .../net/ethernet/marvell/octeontx2/nic/otx2_vf.c | 13 +- drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 92 ++++- drivers/net/ethernet/microsoft/mana/mana_en.c | 13 + drivers/net/ethernet/ti/am65-cpsw-nuss.c | 2 + drivers/net/ipa/ipa_smp2p.c | 30 +- drivers/net/ipvlan/ipvlan_main.c | 4 + drivers/net/macvlan.c | 4 + drivers/net/thunderbolt.c | 8 +- drivers/net/veth.c | 78 ++-- drivers/net/wireless/ath/ath6kl/txrx.c | 2 +- .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 16 +- .../net/wireless/broadcom/brcm80211/brcmfmac/bus.h | 6 + .../wireless/broadcom/brcm80211/brcmfmac/core.c | 45 ++- .../wireless/broadcom/brcm80211/brcmfmac/pcie.c | 6 + .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 8 +- .../wireless/broadcom/brcm80211/brcmfmac/sdio.h | 1 + .../net/wireless/broadcom/brcm80211/brcmfmac/usb.c | 3 + drivers/net/wireless/marvell/libertas_tf/main.c | 2 +- drivers/pinctrl/cirrus/pinctrl-lochnagar.c | 2 +- drivers/pinctrl/core.c | 15 +- drivers/pinctrl/intel/pinctrl-cherryview.c | 4 +- drivers/pinctrl/intel/pinctrl-intel.c | 4 +- drivers/pinctrl/intel/pinctrl-lynxpoint.c | 4 +- drivers/pinctrl/mediatek/pinctrl-moore.c | 4 +- drivers/pinctrl/mediatek/pinctrl-mtk-common.c | 4 +- drivers/pinctrl/mediatek/pinctrl-paris.c | 4 +- drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c | 4 +- drivers/pinctrl/pinctrl-as3722.c | 4 +- drivers/pinctrl/pinctrl-axp209.c | 2 +- drivers/pinctrl/pinctrl-ingenic.c | 11 +- drivers/pinctrl/pinctrl-ocelot.c | 4 +- drivers/pinctrl/pinctrl-rk805.c | 4 +- drivers/pinctrl/pinctrl-st.c | 4 +- drivers/pinctrl/renesas/gpio.c | 4 +- drivers/pinctrl/stm32/pinctrl-stm32.c | 4 +- drivers/pinctrl/vt8500/pinctrl-wmt.c | 4 +- drivers/remoteproc/qcom_common.c | 31 +- drivers/remoteproc/qcom_common.h | 5 +- drivers/remoteproc/qcom_q6v5_pas.c | 20 +- drivers/s390/cio/vfio_ccw_async.c | 16 + drivers/s390/cio/vfio_ccw_chp.c | 15 + drivers/s390/cio/vfio_ccw_cp.c | 17 +- drivers/s390/cio/vfio_ccw_ops.c | 7 +- drivers/s390/net/qeth_core_main.c | 3 + drivers/s390/net/qeth_l3_main.c | 5 + drivers/soc/imx/imx8m-blk-ctrl.c | 27 +- drivers/thunderbolt/xdomain.c | 40 +- drivers/tty/serial/max310x.c | 20 +- drivers/usb/gadget/function/f_tcm.c | 192 ++++++++-- drivers/usb/gadget/function/tcm.h | 13 + drivers/usb/musb/omap2430.c | 25 +- drivers/usb/typec/ucsi/ucsi.c | 95 +++-- drivers/usb/typec/ucsi/ucsi.h | 1 + drivers/vdpa/vdpa_user/iova_domain.c | 161 +++++--- drivers/vdpa/vdpa_user/iova_domain.h | 13 +- drivers/vdpa/vdpa_user/vduse_dev.c | 16 +- drivers/video/fbdev/core/bitblit.c | 122 +++--- drivers/video/fbdev/core/fbcon.c | 420 ++++++++++----------- drivers/video/fbdev/core/fbcon.h | 6 +- drivers/video/fbdev/core/fbcon_ccw.c | 148 ++++---- drivers/video/fbdev/core/fbcon_cw.c | 148 ++++---- drivers/video/fbdev/core/fbcon_rotate.c | 44 +-- drivers/video/fbdev/core/fbcon_rotate.h | 6 +- drivers/video/fbdev/core/fbcon_ud.c | 164 ++++---- drivers/video/fbdev/core/softcursor.c | 18 +- drivers/video/fbdev/core/tileblit.c | 28 +- fs/9p/vfs_inode.c | 9 + fs/binfmt_elf.c | 4 +- fs/binfmt_elf_fdpic.c | 4 +- fs/binfmt_misc.c | 14 +- fs/ceph/addr.c | 20 +- fs/ceph/cache.c | 2 +- fs/ceph/caps.c | 70 ++-- fs/ceph/debugfs.c | 4 +- fs/ceph/dir.c | 24 +- fs/ceph/export.c | 10 +- fs/ceph/file.c | 35 +- fs/ceph/inode.c | 14 +- fs/ceph/ioctl.c | 8 +- fs/ceph/mds_client.c | 51 ++- fs/ceph/mds_client.h | 5 +- fs/ceph/mdsmap.c | 5 +- fs/ceph/snap.c | 18 +- fs/ceph/super.c | 22 +- fs/ceph/super.h | 13 +- fs/ceph/xattr.c | 12 +- fs/crypto/policy.c | 2 +- fs/erofs/Kconfig | 15 + fs/erofs/decompressor_lzma.c | 3 +- fs/erofs/fscache.c | 44 +-- fs/erofs/internal.h | 87 ++--- fs/exec.c | 6 +- fs/f2fs/data.c | 2 +- fs/namei.c | 43 +++ fs/ntfs3/index.c | 44 ++- fs/overlayfs/copy_up.c | 12 +- fs/smb/server/auth.c | 4 +- fs/smb/server/connection.c | 23 +- fs/smb/server/connection.h | 5 + fs/smb/server/oplock.c | 8 +- fs/smb/server/smb2pdu.c | 78 ++-- fs/smb/server/smb2pdu.h | 9 - fs/smb/server/smb_common.c | 43 ++- fs/smb/server/smb_common.h | 15 +- fs/smb/server/smbacl.c | 27 +- fs/super.c | 19 +- fs/xfs/libxfs/xfs_sb.c | 4 +- fs/xfs/xfs_dquot.c | 3 +- fs/xfs/xfs_dquot_item_recover.c | 2 +- include/drm/drm_connector.h | 6 +- include/drm/drm_displayid.h | 2 +- include/linux/audit.h | 6 +- include/linux/audit_arch.h | 12 +- include/linux/bootconfig.h | 3 + include/linux/bpf_lsm.h | 4 + include/linux/ceph/ceph_debug.h | 38 ++ include/linux/ceph/mdsmap.h | 5 +- include/linux/firmware.h | 3 + include/linux/fs.h | 33 ++ include/linux/kvm_host.h | 1 + include/linux/lsm_hooks.h | 1 + include/linux/mm.h | 12 + include/linux/mmc/sdio_ids.h | 2 +- include/linux/namei.h | 1 + include/linux/overflow.h | 68 ++++ include/linux/pinctrl/consumer.h | 13 +- include/linux/sched/user.h | 2 +- include/linux/thunderbolt.h | 3 + include/linux/vfio_pci_core.h | 13 +- include/net/bluetooth/hci.h | 114 ------ include/net/bluetooth/hci_core.h | 48 +-- include/net/bluetooth/hci_sync.h | 4 + include/net/gro.h | 1 + include/net/ip_vs.h | 7 + include/net/netfilter/nf_tables.h | 11 +- include/net/netfilter/nft_fib.h | 4 +- include/net/netfilter/nft_meta.h | 3 +- include/net/netfilter/nft_reject.h | 3 +- include/uapi/linux/ip_vs.h | 6 - include/uapi/linux/netfilter/nf_tables.h | 10 +- include/uapi/linux/virtio_bt.h | 1 - init/main.c | 39 -- kernel/audit.c | 2 +- kernel/audit.h | 32 +- kernel/audit_fsnotify.c | 39 +- kernel/audit_tree.c | 2 +- kernel/audit_watch.c | 42 ++- kernel/auditfilter.c | 17 +- kernel/auditsc.c | 6 +- kernel/bpf/bpf_inode_storage.c | 9 + kernel/fork.c | 20 +- kernel/locking/spinlock_rt.c | 27 +- kernel/taskstats.c | 67 ++-- kernel/trace/ftrace.c | 6 +- kernel/trace/trace_osnoise.c | 4 +- kernel/trace/trace_probe.c | 2 +- kernel/user.c | 1 + lib/bootconfig.c | 65 ++++ lib/compat_audit.c | 12 +- mm/huge_memory.c | 49 ++- mm/internal.h | 4 + mm/madvise.c | 3 +- mm/migrate_device.c | 42 ++- mm/mincore.c | 3 +- mm/mm_init.c | 150 ++++++++ mm/page_alloc.c | 160 +------- mm/pagewalk.c | 10 + mm/sparse-vmemmap.c | 3 +- mm/vmalloc.c | 75 +++- net/bluetooth/hci_conn.c | 24 +- net/bluetooth/hci_core.c | 145 ++----- net/bluetooth/hci_event.c | 150 +------- net/bluetooth/hci_sock.c | 11 +- net/bluetooth/hci_sync.c | 373 +++++++++--------- net/bluetooth/l2cap_core.c | 21 +- net/bluetooth/mgmt.c | 367 +++++++++--------- net/bluetooth/mgmt_util.c | 49 +-- net/bluetooth/mgmt_util.h | 8 +- net/bridge/netfilter/nft_reject_bridge.c | 3 +- net/ceph/cls_lock_client.c | 21 +- net/ceph/decode.c | 18 +- net/ceph/osdmap.c | 9 +- net/core/gro.c | 31 ++ net/core/pktgen.c | 43 ++- net/ipv4/netfilter/nft_dup_ipv4.c | 4 +- net/ipv4/tcp_bpf.c | 21 +- net/ipv4/udp_offload.c | 29 -- net/ipv6/ip6_tunnel.c | 3 + net/ipv6/netfilter/nft_dup_ipv6.c | 4 +- net/mptcp/options.c | 8 +- net/mptcp/pm.c | 9 +- net/mptcp/pm_netlink.c | 29 +- net/mptcp/pm_userspace.c | 87 +++-- net/mptcp/protocol.h | 6 +- net/netfilter/ipset/ip_set_bitmap_gen.h | 2 +- net/netfilter/ipset/ip_set_core.c | 19 +- net/netfilter/ipset/ip_set_list_set.c | 10 +- net/netfilter/ipvs/ip_vs_conn.c | 4 +- net/netfilter/ipvs/ip_vs_core.c | 6 +- net/netfilter/ipvs/ip_vs_ctl.c | 4 +- net/netfilter/ipvs/ip_vs_dh.c | 4 +- net/netfilter/ipvs/ip_vs_lblc.c | 2 +- net/netfilter/ipvs/ip_vs_lblcr.c | 8 +- net/netfilter/nf_conntrack_proto.c | 6 + net/netfilter/nf_conntrack_proto_sctp.c | 48 +-- net/netfilter/nf_conntrack_proto_tcp.c | 132 ++++--- net/netfilter/nf_conntrack_sip.c | 10 +- net/netfilter/nf_flow_table_core.c | 7 +- net/netfilter/nf_tables_api.c | 6 +- net/netfilter/nf_tables_offload.c | 2 +- net/netfilter/nft_bitwise.c | 38 +- net/netfilter/nft_byteorder.c | 2 +- net/netfilter/nft_cmp.c | 6 +- net/netfilter/nft_compat.c | 6 +- net/netfilter/nft_ct.c | 2 +- net/netfilter/nft_dup_netdev.c | 2 +- net/netfilter/nft_dynset.c | 4 +- net/netfilter/nft_exthdr.c | 2 +- net/netfilter/nft_fib.c | 3 +- net/netfilter/nft_flow_offload.c | 3 +- net/netfilter/nft_fwd_netdev.c | 9 +- net/netfilter/nft_hash.c | 2 +- net/netfilter/nft_immediate.c | 3 +- net/netfilter/nft_lookup.c | 5 +- net/netfilter/nft_masq.c | 7 +- net/netfilter/nft_meta.c | 8 +- net/netfilter/nft_nat.c | 11 +- net/netfilter/nft_objref.c | 41 +- net/netfilter/nft_osf.c | 3 +- net/netfilter/nft_payload.c | 2 +- net/netfilter/nft_queue.c | 5 +- net/netfilter/nft_range.c | 2 +- net/netfilter/nft_redir.c | 7 +- net/netfilter/nft_reject.c | 3 +- net/netfilter/nft_reject_inet.c | 3 +- net/netfilter/nft_reject_netdev.c | 3 +- net/netfilter/nft_rt.c | 3 +- net/netfilter/nft_set_pipapo.c | 259 ++++++++----- net/netfilter/nft_set_pipapo.h | 8 + net/netfilter/nft_socket.c | 3 +- net/netfilter/nft_synproxy.c | 3 +- net/netfilter/nft_tproxy.c | 7 +- net/netfilter/nft_xfrm.c | 3 +- net/openvswitch/conntrack.c | 39 +- net/packet/af_packet.c | 7 +- net/rxrpc/call_accept.c | 27 +- net/sched/act_ct.c | 41 +- net/sched/cls_u32.c | 3 + net/sched/sch_api.c | 24 +- net/sched/sch_cake.c | 2 +- net/sched/sch_taprio.c | 12 +- net/sctp/protocol.c | 20 +- net/sctp/sysctl.c | 9 +- net/smc/smc_tx.c | 6 +- net/tipc/socket.c | 6 +- net/tls/tls_device.c | 4 +- net/tls/tls_sw.c | 5 + net/x25/af_x25.c | 4 +- net/x25/x25_timer.c | 25 +- net/xfrm/espintcp.c | 42 +-- security/apparmor/include/net.h | 6 +- security/apparmor/lsm.c | 38 +- security/apparmor/net.c | 2 +- security/bpf/hooks.c | 3 + security/security.c | 47 ++- security/selinux/hooks.c | 95 +++-- security/selinux/include/objsec.h | 5 + security/selinux/netlabel.c | 23 +- security/selinux/ss/policydb.c | 31 ++ security/selinux/ss/services.c | 4 +- security/smack/smack.h | 5 + security/smack/smack_lsm.c | 70 ++-- security/smack/smack_netfilter.c | 4 +- sound/hda/hdac_regmap.c | 4 +- sound/pci/hda/patch_conexant.c | 3 - sound/pci/hda/patch_hdmi.c | 48 ++- sound/soc/codecs/cs35l41-lib.c | 2 +- sound/soc/codecs/cs4265.c | 4 +- sound/soc/codecs/lpass-wsa-macro.c | 8 +- sound/soc/fsl/fsl_sai.c | 29 +- sound/soc/mediatek/mt8183/mt8183-afe-pcm.c | 12 +- sound/soc/mediatek/mt8192/mt8192-afe-pcm.c | 118 +++--- sound/soc/sof/ipc3-control.c | 34 +- sound/soc/xilinx/xlnx_formatter_pcm.c | 10 +- tools/testing/selftests/net/mptcp/mptcp_join.sh | 4 +- virt/kvm/kvm_main.c | 3 + 424 files changed, 5764 insertions(+), 4185 deletions(-)

6 hours, 30 minutes

[PATCH 6.12 000/220] 6.12.105-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.12.105 release. There are 220 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat, 22 Aug 2026 14:51:11 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.105-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.12.105-rc1 Eric Dumazet <edumazet(a)google.com> ip_tunnel: adapt iptunnel_xmit_stats() to NETDEV_PCPU_STAT_DSTATS Paolo Abeni <pabeni(a)redhat.com> net: harmonize tstats and dstats Christian Brauner <brauner(a)kernel.org> binfmt_misc: use exe_file_deny_write_access() for the interpreter clone Darrick J. Wong <djwong(a)kernel.org> fs: unlock the superblock during iterate_supers_type Aditya Chillara <aditya.chillara(a)oss.qualcomm.com> perf/core: Fix group leader use-after-free after sibling detach Peter Zijlstra <peterz(a)infradead.org> perf: Unify perf_event_free_task() / perf_event_exit_task_context() Gao Xiang <xiang(a)kernel.org> erofs: fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms Linmao Li <lilinmao(a)kylinos.cn> drm/xe/oa: Fix sync entry leak on OA config emit failure Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: cls_bpf: reject dev-bound programs bound to a different device Siddharth Vadapalli <s-vadapalli(a)ti.com> net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG Uwe Kleine-König <ukleinek(a)kernel.org> m68k: Define NR_CPUS to 1 Zhang Changzhong <zhangchangzhong(a)huawei.com> net/sched: cls_u32: skip hash tables in u32_bind_class() Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain Eric Dumazet <edumazet(a)google.com> af_packet: Don't send zero-byte data in tpacket_snd(). Rosen Penev <rosenp(a)gmail.com> ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers Chuck Lever <chuck.lever(a)oracle.com> net/tls: Fail tls_sw_splice_read() after a failed async decrypt Wei Fang <wei.fang(a)nxp.com> net: packet: fix wrong transport_header when sending VLAN-tagged frame Jiayuan Chen <jiayuan.chen(a)linux.dev> tcp: fix icsk_ack.ato bitfield overflow Jonas Köppeler <j.koeppeler(a)tu-berlin.de> veth: fix queue index used to wake the peer txq in veth_poll Eric Dumazet <edumazet(a)google.com> macvlan: inherit needed_headroom and needed_tailroom from lowerdev Eric Dumazet <edumazet(a)google.com> ipvlan: inherit needed_headroom and needed_tailroom from phy_dev Florian Westphal <fw(a)strlen.de> netfilter: ipset: let destroy callbacks adjust ext mem size Florian Westphal <fw(a)strlen.de> netfilter: ipset: fix list type element drift bug Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> netfilter: flowtable: publish GC-visible tuple last Alexey Velichayshiy <a.velichayshiy(a)ispras.ru> netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path Xiang Mei (Microsoft) <xmei5(a)asu.edu> netfilter: ipset: fix refcount race between list:set GC and swap Vladislav Dronov <vdronov(a)redhat.com> crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() Herbert Xu <herbert(a)gondor.apana.org.au> crypto: ccm - Set rfc4309 maxauthsize from child Jon Hunter <jonathanh(a)nvidia.com> arm64: tegra: Add EL2 virtual timer interrupt for Tegra194 Baul Lee <baul.lee(a)xbow.com> net/x25: fix use-after-free of the socket by its timers Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: SOF: ipc4-topology: Refresh copier IPC payload before widget setup Eric Dumazet <edumazet(a)google.com> ipv4: start using dst_dev_rcu() Breno Leitao <leitao(a)debian.org> x86/mce: Set up the polling timer before CMCI discovery Yazen Ghannam <yazen.ghannam(a)amd.com> x86/mce: Set CR4.MCE last during init Yazen Ghannam <yazen.ghannam(a)amd.com> x86/mce: Remove __mcheck_cpu_init_early() Vincent Donnefort <vdonnefort(a)google.com> ring-buffer: Prevent resizing of persistent ring buffer Steven Rostedt <rostedt(a)goodmis.org> ring-buffer: Make ring_buffer_{un}map() simpler with guard(mutex) Steven Rostedt <rostedt(a)goodmis.org> ring-buffer: Simplify ring_buffer_read_page() with guard() Paolo Bonzini <pbonzini(a)redhat.com> KVM: SVM: Serialize accesses to the owner and mirror list with separate lock Lorenzo Stoakes (ARM) <ljs(a)kernel.org> mm/ptdump: always stabilise against page table freeing using init_mm Lorenzo Stoakes (ARM) <ljs(a)kernel.org> mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> mm/pagewalk: split walk_page_range_novma() into kernel/user parts Vincent Donnefort <vdonnefort(a)google.com> ring-buffer: Initialise reader page order in rb_allocate_cpu_buffer() Steven Rostedt <rostedt(a)goodmis.org> ring-buffer: Simplify functions with __free(kfree) to free allocations Zack Rusin <zack.rusin(a)broadcom.com> drm/vmwgfx: take fman->lock around fence list mutation in fifo_down Dongli Zhang <dongli.zhang(a)oracle.com> net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: fix pptable use-after-free Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: adjust the visibility of pp_table sysfs node Pierre-Eric Pelloux-Prayer <pierre-eric.pelloux-prayer(a)amd.com> drm/amdgpu: move debug_vm handling to amdgpu_cs_parser_fini Yunxiang Li <Yunxiang.Li(a)amd.com> drm/amdgpu: remove unused function parameter Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: fix torn gpu metrics reads Lijo Lazar <lijo.lazar(a)amd.com> drm/amd/pm: Use macro to initialize metrics table Asad Kamal <asad.kamal(a)amd.com> drm/amd/pm: Use same metric table for APU Tu Nguyen <tu.nguyen.xg(a)renesas.com> can: rcar_canfd: change the initializing flow for clocks and resets Frank Sorenson <sorenson(a)redhat.com> cifs: add fscache_resize_cookie() to cifs_setsize() Paulo Alcantara <pc(a)manguebit.org> smb: client: fix race with fallocate(2) and AIO+DIO Max Kellermann <max.kellermann(a)ionos.com> include/linux/fs.h: add inode_lock_killable() Dawid Osuchowski <dawid.osuchowski(a)linux.intel.com> ice: fix VF interrupts cleanup Eric Dumazet <edumazet(a)google.com> vxlan: use pskb_network_may_pull() for transmit path header pulls Guillaume Nault <gnault(a)redhat.com> vxlan: Handle stats using NETDEV_PCPU_STAT_DSTATS. Guillaume Nault <gnault(a)redhat.com> vrf: Make pcpu_dstats update functions available to other modules. Christian Brauner <brauner(a)kernel.org> binfmt_misc: restore write access when removing an entry Amir Goldstein <amir73il(a)gmail.com> fs: don't block write during exec on pre-content watched files Amir Goldstein <amir73il(a)gmail.com> fsnotify: opt-in for permission events at file open time Song Liu <song(a)kernel.org> fsnotify, lsm: Decouple fsnotify from lsm Christian Brauner <brauner(a)kernel.org> binfmt_misc: don't leak the user namespace when the mount fails Chengfeng Ye <nicoyip.dev(a)gmail.com> net: pktgen: fix proc entry use-after-free Peter Seiderer <ps.report(a)gmx.net> net: pktgen: fix code style (WARNING: Block comments) Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: reject repeated SMB2 NEGOTIATE requests Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: conn lock to serialize smb2 negotiate David Carlier <devnexen(a)gmail.com> igc: remove napi_synchronize() in igc_down() Damien Le Moal <dlemoal(a)kernel.org> ata: libata-scsi: terminate deferred commands on time out Mark Brown <broonie(a)kernel.org> ASoC: tas2562: Validate values for volume writes Weiming Shi <bestswngs(a)gmail.com> KVM: x86: Cancel delayed I/O APIC EOI handling before destroying vCPUs Guanghui Yang <3497809730(a)qq.com> btrfs: zoned: fix missing chunk metadata reservation Filipe Manana <fdmanana(a)suse.com> btrfs: remove fs_info argument from btrfs_zoned_activate_one_bg() Naohiro Aota <naohiro.aota(a)wdc.com> btrfs: add space_info argument to btrfs_chunk_alloc() David Sterba <dsterba(a)suse.com> btrfs: add debug build only WARN Peiyang He <peiyang_he(a)smail.nju.edu.cn> iommufd: Fix wrong hwpt passed to iommufd_auto_response_faults on replace Yuxiang Yang <yangyx22(a)mails.tsinghua.edu.cn> tcp: challenge ACK for non-exact RST in SYN-RECEIVED Chia-Yu Chang <chia-yu.chang(a)nokia-bell-labs.com> tcp: reorganize tcp_sock_write_txrx group for variables later Ilpo Järvinen <ij(a)kernel.org> tcp: fast path functions later Ilpo Järvinen <ij(a)kernel.org> tcp: Pass flags to __tcp_send_ack Guidong Han <2045gemini(a)gmail.com> eventpoll: pin files while checking reverse paths Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: validate minimum PDU size for transform requests ChenXiaoSong <chenxiaosong(a)kylinos.cn> smb/server: fix minimum SMB2 PDU size ChenXiaoSong <chenxiaosong(a)kylinos.cn> smb/server: fix minimum SMB1 PDU size Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: rename smb2_get_msg to smb_get_msg ChenXiaoSong <chenxiaosong(a)kylinos.cn> smb/server: rename include guard in smb_common.h ZhangGuoDong <zhangguodong(a)kylinos.cn> smb: move get_rfc1002_len() to common/smbglob.h ZhangGuoDong <zhangguodong(a)kylinos.cn> smb: move smb_version_values to common/smbglob.h Christian Brauner <brauner(a)kernel.org> super: fix emergency thaw deadlock on frozen block devices Chen Changcheng <chenchangcheng(a)kylinos.cn> fs/super: fix emergency thaw double-unlock of s_umount Christian Brauner <brauner(a)kernel.org> super: use common iterator (Part 2) Christian Brauner <brauner(a)kernel.org> super: use a common iterator (Part 1) Christian Brauner <brauner(a)kernel.org> super: skip dying superblocks early Christian Brauner <brauner(a)kernel.org> super: remove pointless s_root checks Aldo Ariel Panzardo <qwe.aldo(a)gmail.com> net/sched: serialize qdisc_rtab_list against concurrent get/put Pavitra Jha <jhapavitra98(a)gmail.com> libceph: fix two unsafe bare decodes in decode_lockers() Mike Rapoport (Microsoft) <rppt(a)kernel.org> userfaultfd: prevent registration of special VMAs Lance Yang <lance.yang(a)linux.dev> mm/khugepaged: guard is_zero_pfn() calls with pte_present() Xiang Mei <xmei5(a)asu.edu> libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> libceph: Amend checking to fix `make W=1` build breakage Max Kellermann <max.kellermann(a)ionos.com> ceph: fix hanging __ceph_get_caps() with stale mds_wanted Max Kellermann <max.kellermann(a)ionos.com> ceph: avoid fs reclaim while using current->journal_info Wentao Liang <vulab(a)iscas.ac.cn> ceph: fix writeback_count leak in write_folio_nounlock() Matthew Wilcox (Oracle) <willy(a)infradead.org> ceph: Convert writepage_nounlock() to write_folio_nounlock() Matthew Wilcox (Oracle) <willy(a)infradead.org> ceph: Convert ceph_find_incompatible() to take a folio Matthew Wilcox (Oracle) <willy(a)infradead.org> ceph: Use a folio in ceph_page_mkwrite() Matthew Wilcox (Oracle) <willy(a)infradead.org> ceph: Remove ceph_writepage() Christoph Hellwig <hch(a)lst.de> xfs: check v5 superblock features early Darrick J. Wong <djwong(a)kernel.org> xfs: check xfarray iteration errors when committing unlinked inode lists Long Li <leo.lilong(a)huawei.com> xfs: don't swallow dquot recovery verification errors Lin Jiapeng <ljp1205831794(a)gmail.com> xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN Darrick J. Wong <djwong(a)kernel.org> xfs: avoid UAF on sc->tempip in xrep_tempfile_create Darrick J. Wong <djwong(a)kernel.org> xfs: don't return EFSCORRUPTED when scrubbing corrupt parent pointers Darrick J. Wong <djwong(a)kernel.org> xfs: fix another iunlink infinite loop bug in online fsck Darrick J. Wong <djwong(a)kernel.org> xfs: fix allocated inodes that show up in the unlinked list Darrick J. Wong <djwong(a)kernel.org> xfs: don't walk off the end of a null sc->sa.agi_bp in AGI repair Darrick J. Wong <djwong(a)kernel.org> xfs: don't zap the attr fork on repair when there are queued pptr updates Long Li <leo.lilong(a)huawei.com> xfs: fix ilock leak on error in xfs_dq_get_next_id Darrick J. Wong <djwong(a)kernel.org> xfs: load next_agino from the correct xfarray in xrep_iunlink_relink_prev Darrick J. Wong <djwong(a)kernel.org> xfs: nlink scrub must take IOLOCK before determining ILOCK state Darrick J. Wong <djwong(a)kernel.org> xfs: pass runtime errors from xrep_iunlink_mark_ondisk_rec up to callers Darrick J. Wong <djwong(a)kernel.org> xfs: set the prev pointer when reinserting an inode on the unlinked list Darrick J. Wong <djwong(a)kernel.org> xfs: don't double-lock when deleting a self-referential directory Darrick J. Wong <djwong(a)kernel.org> xfs: only check mergeability of bnobt records Darrick J. Wong <djwong(a)kernel.org> xfs: zero i_nlink before repair puts inode on unlinked list Qiang Ma <maqianga(a)uniontech.com> xfs: clear zapped attr fork state when bmap repair finds no attr fork Junrui Luo <moonafterrain(a)outlook.com> drm/amdgpu: disallow multiple FENCE chunks in one submit David Rosca <david.rosca(a)amd.com> drm/amdgpu: Fix UVD decode image min size calculation David Rosca <david.rosca(a)amd.com> drm/amdgpu: Fix UVD dpb min size calculation for H264 David Rosca <david.rosca(a)amd.com> drm/amdgpu: Fix UVD min buffer sizes David Rosca <david.rosca(a)amd.com> drm/amdgpu: Implement insert_end for VCE 3 David Rosca <david.rosca(a)amd.com> drm/amdgpu: Reject UVD message with dimensions above 4096 Candice Li <candice.li(a)amd.com> drm/amdgpu: validate GEM_CREATE domain combinations Yang Wang <kevinyang.wang(a)amd.com> drm/amdgpu: check ASPM on the dGPU host link Yang Wang <kevinyang.wang(a)amd.com> drm/amdgpu: fix nbif 6.3.1 l1 low power not functional David Rosca <david.rosca(a)amd.com> drm/amdgpu: Reject UVD message with invalid number of h265 refs Nathan Lucas <nlucasgit(a)gmail.com> drm/amd/display: fix BT.2020 YCbCr output CSC matrices for DCE Nathan Lucas <nlucasgit(a)gmail.com> drm/amd/display: fix BT.2020 YCbCr limited output CSC matrix Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Implement a crw lock Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Calculate idal length based on idaw type Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Selectively expand io_mutex Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Move cp cleanup out of not operational Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Fix out of bounds check on CCW array Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Ensure first IDAW remains constant Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Ensure index for read/write regions are within range Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Cancel existing workqueues Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Limit the number of channel program segments Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Free all memory if cp_init() fails Guangshuo Li <lgs201920130244(a)gmail.com> drm/radeon: fix autosuspend cleanup during teardown Matthew Brost <matthew.brost(a)intel.com> drm/xe: Order ring writes before ring tail updates John Harrison <John.Harrison(a)Igalia.com> drm/connector/hdmi: Fix out of bounds memory read Pei Xiao <xiaopei01(a)kylinos.cn> mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition Haibo Chen <haibo.chen(a)nxp.com> mmc: sdhci: make tuning_err a signed int Myeonghun Pak <mhun512(a)gmail.com> mmc: sdhci: unmap the bounce buffer before device release Zhan Xusheng <zhanxusheng1024(a)gmail.com> mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit Kefu Chai <k.chai(a)proxmox.com> libceph: tolerate addrvecs with multiple entries of the same type Yiming Zhu <zhuyiming(a)kuaishou.com> ceph: fix MDS random selection readiness predicate Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Avoid using invalid osd indices from primary_temp Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: sur40 - fix V4L error path cleanup Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: sur40 - fix input device registration ordering Ali Ahmet Memis <ali(a)iusegentoo.com> openrisc: signal: do not restore privileged SR bits on sigreturn Josh Poimboeuf <jpoimboe(a)kernel.org> ftrace: Fix off-by-one fentry site disable in ftrace_free_mem() Leon Hwang <leon.hwang(a)linux.dev> ftrace: Protect direct_functions in ftrace_find_rec_direct Pavitra Jha <jhapavitra98(a)gmail.com> libceph: fix multiple unsafe decodes in decode_locker() Praveen Talari <praveen.talari(a)oss.qualcomm.com> pmdomain: arm: Fix -EINVAL from scmi_pd_set_perf_state() on state 0 Cengiz Can <cengiz.can(a)canonical.com> gpio: sloppy-logic-analyzer: fix use-after-free via debugfs trigger on unbind Thorsten Blum <thorsten.blum(a)linux.dev> crypto: qce - fix error path in devm_qce_register_algs Thorsten Blum <thorsten.blum(a)linux.dev> crypto: starfive - use scatterlist length before DMA mapping Jianing Li <m13940358460(a)163.com> Input: hynitron_cstxxx - validate touch count and finger IDs Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: synaptics-rmi4 - block s_input when F54 queue is busy Bryam Vargas <hexlabsecurity(a)proton.me> Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: synaptics-rmi4 - zero report size on F54 work error George Wilson <gcwilson(a)linux.ibm.com> powerpc/pseries: lparcfg - fix kbuf[] underflow Pengpeng Hou <pengpeng(a)iscas.ac.cn> Input: iforce - validate input packet lengths Zhefu Zhang <a723356(a)gmail.com> Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard Linmao Li <lilinmao(a)kylinos.cn> Input: psxpad-spi - set driver data before use Richard Davies <richard(a)arachsys.com> Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: synaptics-rmi4 - fix F55 transmitter electrode count typo George Wilson <gcwilson(a)linux.ibm.com> powerpc/pseries: pci - logic bug HyeongJun An <sammiee5311(a)gmail.com> Input: cs40l50-vibra - validate custom data from user space Kyohei Kadota <lufia(a)lufia.org> Input: xpad - add support for ZENAIM LEVERLESS Bard Liao <yung-chuan.liao(a)linux.intel.com> ASoC: SOF: topology: Use acpi mach from the machine driver Asad Kamal <asad.kamal(a)amd.com> drm/amdgpu: fix aperture iounmap skipped on device removal Qiang Yu <Qiang.Yu(a)amd.com> drm/amdgpu: read TRUNCATE_COORD_MODE on gfx12 Candice Li <candice.li(a)amd.com> drm/amdgpu: reject oversized IBs with per-ring packet limits Osama Abdelkader <osama.abdelkader(a)gmail.com> drm/panthor: skip zero-sized firmware sections Mingyu Wang <25181214217(a)stu.xidian.edu.cn> fbdev: core: Fix pointer desynchronization in fb_io_read() Dawid Wróbel <me(a)dawidwrobel.com> ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: cs35l41: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: cs35l45: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: cs4265: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked() Hidayath Khan <hidayath(a)linux.ibm.com> s390/qeth: validate user buffer length in SNMP and ARP query ioctls Wyatt Feng <bronzed_45_vested(a)icloud.com> mptcp: fastopen: only mark MPTFO subflows with SYN data Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: options: reset DSS fields in case of unexpected size Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: avoid combining some incoming suboptions Gang Yan <yangang(a)kylinos.cn> selftests: mptcp: join: mark tests with data corruption as failed Bryam Vargas <hexlabsecurity(a)proton.me> selinux: reject an unclaimed class value in security_get_classes() Bryam Vargas <hexlabsecurity(a)proton.me> selinux: do not cancel a policy conversion that never started Bryam Vargas <hexlabsecurity(a)proton.me> selinux: reject a class permission count below its inherited common Bryam Vargas <hexlabsecurity(a)proton.me> selinux: require every boolean value to be defined Sean Christopherson <seanjc(a)google.com> KVM: SVM: Ensure PSP module is initialized if KVM module is built-in Sean Christopherson <seanjc(a)google.com> crypto: ccp: Add external API interface for PSP module initialization Erni Sri Satya Vennela <ernis(a)linux.microsoft.com> net: mana: Fix EQ leak in mana_remove on NULL port Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> ipvs: separate destination availability state Philipp David <pd-lkml(a)3b.pm> igc: fix netdev not re-attached after resume if interface is down SJ Park <sj(a)kernel.org> mm/damon: adjust isolated pages stat for DAMOS_MIGRATE_{HOT,COLD} liyouhong <liyouhong(a)kylinos.cn> mm/damon/ops-common: putback folios on invalid migrate nid Liyuan Pang <pangliyuan1(a)huawei.com> ubi: fastmap: fix ubi->fm memory leak Cheng Ming Lin <chengminglin(a)mxic.com.tw> mtd: ubi: skip programming unused bits in ubi headers Chao Yu <chao(a)kernel.org> f2fs: fix UAF issue in f2fs_merge_page_bio() Daniel Borkmann <daniel(a)iogearbox.net> selftests/bpf: Add tests for stale delta leaking through id reassignment Daniel Borkmann <daniel(a)iogearbox.net> selftests/bpf: Add tests for delta tracking when src_reg == dst_reg Daniel Borkmann <daniel(a)iogearbox.net> bpf: Clear delta when clearing reg id for non-{add,sub} ops Daniel Borkmann <daniel(a)iogearbox.net> bpf: Fix linked reg delta tracking when src_reg == dst_reg Chao Shi <coshi036(a)gmail.com> block: stop the timeout timer when releasing a never added disk ------------- Diffstat: Makefile | 4 +- arch/arm64/boot/dts/nvidia/tegra194.dtsi | 2 + arch/loongarch/mm/pageattr.c | 2 +- arch/m68k/Kconfig.cpu | 4 + arch/openrisc/include/asm/processor.h | 2 + arch/openrisc/kernel/dma.c | 4 +- arch/openrisc/kernel/signal.c | 5 +- arch/powerpc/platforms/pseries/lparcfg.c | 2 +- arch/powerpc/platforms/pseries/pci.c | 2 +- arch/riscv/mm/pageattr.c | 8 +- arch/x86/kernel/cpu/mce/amd.c | 4 + arch/x86/kernel/cpu/mce/core.c | 21 +-- arch/x86/kvm/svm/sev.c | 49 ++++-- arch/x86/kvm/svm/svm.h | 1 + arch/x86/kvm/x86.c | 13 ++ block/genhd.c | 12 +- crypto/ccm.c | 2 +- drivers/ata/libata-eh.c | 29 +--- drivers/ata/libata-scsi.c | 115 +++++++++++++-- drivers/ata/libata.h | 3 +- drivers/crypto/ccp/sp-dev.c | 14 ++ drivers/crypto/qce/core.c | 2 +- drivers/crypto/starfive/jh7110-aes.c | 2 +- drivers/crypto/tegra/tegra-se-aes.c | 22 +-- drivers/gpio/gpio-sloppy-logic-analyzer.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 63 ++++++-- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 50 ++++++- drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 24 ++- drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 3 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 10 +- drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 85 +++-------- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h | 3 +- drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | 5 + drivers/gpu/drm/amd/amdgpu/nbif_v6_3_1.c | 42 +++--- drivers/gpu/drm/amd/amdgpu/vce_v3_0.c | 26 +++- .../gpu/drm/amd/display/dc/core/dc_hw_sequencer.c | 31 ++-- drivers/gpu/drm/amd/display/dc/dce/dce_transform.c | 7 +- .../drm/amd/display/dc/dce110/dce110_opp_csc_v.c | 7 +- drivers/gpu/drm/amd/pm/amdgpu_dpm.c | 36 ++++- drivers/gpu/drm/amd/pm/amdgpu_pm.c | 26 ++-- drivers/gpu/drm/amd/pm/inc/amdgpu_dpm.h | 6 +- drivers/gpu/drm/amd/pm/powerplay/amd_powerplay.c | 5 +- drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 2 +- .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c | 102 +++++++------ drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c | 58 -------- drivers/gpu/drm/amd/pm/swsmu/smu_cmn.h | 14 +- drivers/gpu/drm/display/drm_hdmi_state_helper.c | 3 +- drivers/gpu/drm/panthor/panthor_fw.c | 3 + drivers/gpu/drm/radeon/radeon_kms.c | 1 + drivers/gpu/drm/vmwgfx/vmwgfx_fence.c | 10 +- drivers/gpu/drm/xe/xe_lrc.c | 7 + drivers/gpu/drm/xe/xe_oa.c | 4 + drivers/input/joystick/iforce/iforce-packets.c | 11 +- drivers/input/joystick/iforce/iforce-usb.c | 3 + drivers/input/joystick/psxpad-spi.c | 1 + drivers/input/joystick/xpad.c | 2 + drivers/input/keyboard/atkbd.c | 8 + drivers/input/misc/cs40l50-vibra.c | 10 +- drivers/input/mouse/focaltech.c | 2 +- drivers/input/rmi4/rmi_f54.c | 43 ++++-- drivers/input/rmi4/rmi_f55.c | 4 +- drivers/input/touchscreen/hynitron_cstxxx.c | 13 +- drivers/input/touchscreen/sur40.c | 23 +-- drivers/iommu/iommufd/device.c | 2 +- drivers/mmc/host/atmel-mci.c | 2 + drivers/mmc/host/omap_hsmmc.c | 2 +- drivers/mmc/host/sdhci.c | 16 ++ drivers/mmc/host/sdhci.h | 2 +- drivers/mtd/ubi/attach.c | 4 +- drivers/mtd/ubi/fastmap-wl.c | 8 +- drivers/mtd/ubi/io.c | 10 ++ drivers/mtd/ubi/ubi.h | 12 ++ drivers/net/can/rcar/rcar_canfd.c | 28 ++-- drivers/net/ethernet/intel/ice/ice_vf_lib.c | 27 ++++ .../net/ethernet/intel/ice/ice_vf_lib_private.h | 1 + drivers/net/ethernet/intel/ice/ice_virtchnl.c | 21 +++ drivers/net/ethernet/intel/igc/igc_main.c | 9 +- drivers/net/ethernet/microsoft/mana/mana_en.c | 4 +- drivers/net/ethernet/ti/am65-cpsw-nuss.c | 2 + drivers/net/ipvlan/ipvlan_main.c | 4 + drivers/net/macvlan.c | 4 + drivers/net/tap.c | 24 +-- drivers/net/veth.c | 2 +- drivers/net/vrf.c | 49 ++---- drivers/net/vxlan/vxlan_core.c | 34 ++--- drivers/net/vxlan/vxlan_mdb.c | 4 +- drivers/pmdomain/arm/scmi_perf_domain.c | 2 +- drivers/s390/cio/vfio_ccw_async.c | 16 ++ drivers/s390/cio/vfio_ccw_chp.c | 31 +++- drivers/s390/cio/vfio_ccw_cp.c | 74 +++++++--- drivers/s390/cio/vfio_ccw_cp.h | 10 ++ drivers/s390/cio/vfio_ccw_drv.c | 21 ++- drivers/s390/cio/vfio_ccw_fsm.c | 8 +- drivers/s390/cio/vfio_ccw_ops.c | 39 ++++- drivers/s390/cio/vfio_ccw_private.h | 10 +- drivers/s390/net/qeth_core_main.c | 3 + drivers/s390/net/qeth_l3_main.c | 5 + drivers/video/fbdev/core/fb_io_fops.c | 8 + fs/binfmt_elf.c | 4 +- fs/binfmt_elf_fdpic.c | 4 +- fs/binfmt_misc.c | 46 +++--- fs/btrfs/block-group.c | 61 ++++---- fs/btrfs/block-group.h | 3 +- fs/btrfs/extent-tree.c | 6 +- fs/btrfs/messages.h | 7 + fs/btrfs/space-info.c | 2 +- fs/btrfs/transaction.c | 5 +- fs/btrfs/zoned.c | 5 +- fs/btrfs/zoned.h | 6 +- fs/ceph/addr.c | 164 ++++++++++----------- fs/ceph/caps.c | 17 ++- fs/ceph/file.c | 9 +- fs/ceph/mds_client.c | 11 ++ fs/ceph/mds_client.h | 1 + fs/ceph/mdsmap.c | 2 +- fs/erofs/Kconfig | 3 +- fs/eventpoll.c | 17 ++- fs/exec.c | 8 +- fs/f2fs/data.c | 2 +- fs/notify/fanotify/Kconfig | 1 - fs/notify/fsnotify.c | 38 +++++ fs/open.c | 12 +- fs/smb/client/cifsfs.c | 22 ++- fs/smb/client/cifsglob.h | 27 ---- fs/smb/client/cifssmb.c | 6 +- fs/smb/client/connect.c | 2 +- fs/smb/client/inode.c | 2 + fs/smb/client/smb2ops.c | 18 +-- fs/smb/client/transport.c | 8 +- fs/smb/common/cifsglob.h | 36 +++++ fs/smb/server/auth.c | 4 +- fs/smb/server/connection.c | 23 ++- fs/smb/server/connection.h | 5 + fs/smb/server/oplock.c | 8 +- fs/smb/server/smb2misc.c | 2 +- fs/smb/server/smb2ops.c | 32 ++-- fs/smb/server/smb2pdu.c | 88 ++++++----- fs/smb/server/smb2pdu.h | 9 -- fs/smb/server/smb_common.c | 43 ++++-- fs/smb/server/smb_common.h | 43 ++---- fs/super.c | 137 +++++++++-------- fs/xfs/libxfs/xfs_exchmaps.c | 10 ++ fs/xfs/libxfs/xfs_sb.c | 4 +- fs/xfs/scrub/agheader_repair.c | 120 ++++++++++++--- fs/xfs/scrub/alloc.c | 5 +- fs/xfs/scrub/attr_repair.c | 3 +- fs/xfs/scrub/bmap.c | 5 + fs/xfs/scrub/dirtree_repair.c | 22 ++- fs/xfs/scrub/nlinks.c | 13 +- fs/xfs/scrub/nlinks_repair.c | 7 +- fs/xfs/scrub/parent.c | 2 +- fs/xfs/scrub/tempfile.c | 1 + fs/xfs/scrub/trace.h | 2 + fs/xfs/xfs_dquot.c | 3 +- fs/xfs/xfs_dquot_item_recover.c | 2 +- include/linux/fs.h | 77 +++++++++- include/linux/fsnotify.h | 39 +++-- include/linux/libata.h | 2 + include/linux/netdevice.h | 45 +++++- include/linux/pagewalk.h | 7 +- include/linux/psp-sev.h | 9 ++ include/linux/tcp.h | 4 +- include/linux/userfaultfd_k.h | 6 + include/net/ip_tunnels.h | 28 +++- include/net/ip_vs.h | 7 + include/net/tcp.h | 58 ++++---- include/uapi/linux/ip_vs.h | 6 - kernel/bpf/verifier.c | 51 ++++--- kernel/events/core.c | 159 ++++++++------------ kernel/fork.c | 12 +- kernel/trace/ftrace.c | 9 +- kernel/trace/ring_buffer.c | 93 +++++------- mm/damon/paddr.c | 15 +- mm/hugetlb_vmemmap.c | 2 +- mm/internal.h | 6 + mm/khugepaged.c | 35 +++-- mm/pagewalk.c | 97 ++++++++---- mm/ptdump.c | 10 +- mm/vmalloc.c | 60 +++++++- net/ceph/cls_lock_client.c | 21 ++- net/ceph/decode.c | 18 +-- net/ceph/osdmap.c | 9 +- net/core/dev.c | 14 ++ net/core/pktgen.c | 43 +++--- net/ipv4/bpf_tcp_ca.c | 2 +- net/ipv4/icmp.c | 6 +- net/ipv4/ip_fragment.c | 6 +- net/ipv4/ipmr.c | 4 +- net/ipv4/route.c | 4 +- net/ipv4/tcp.c | 4 +- net/ipv4/tcp_dctcp.h | 2 +- net/ipv4/tcp_input.c | 62 ++++++-- net/ipv4/tcp_minisocks.c | 12 +- net/ipv4/tcp_output.c | 6 +- net/ipv4/tcp_timer.c | 4 +- net/mptcp/fastopen.c | 7 +- net/mptcp/options.c | 67 ++++++++- net/mptcp/protocol.h | 1 + net/netfilter/ipset/ip_set_bitmap_gen.h | 2 +- net/netfilter/ipset/ip_set_core.c | 19 ++- net/netfilter/ipset/ip_set_list_set.c | 10 +- net/netfilter/ipvs/ip_vs_conn.c | 4 +- net/netfilter/ipvs/ip_vs_core.c | 6 +- net/netfilter/ipvs/ip_vs_ctl.c | 4 +- net/netfilter/ipvs/ip_vs_dh.c | 4 +- net/netfilter/ipvs/ip_vs_lblc.c | 2 +- net/netfilter/ipvs/ip_vs_lblcr.c | 8 +- net/netfilter/nf_flow_table_core.c | 7 +- net/netfilter/nf_tables_offload.c | 2 +- net/packet/af_packet.c | 7 +- net/sched/act_api.c | 10 +- net/sched/cls_bpf.c | 18 ++- net/sched/cls_u32.c | 3 + net/sched/sch_api.c | 24 ++- net/tls/tls_sw.c | 5 + net/x25/af_x25.c | 4 +- net/x25/x25_timer.c | 25 ++-- security/security.c | 9 +- security/selinux/ss/policydb.c | 31 ++++ security/selinux/ss/services.c | 28 +++- sound/soc/codecs/cs35l41-lib.c | 2 +- sound/soc/codecs/cs35l45-tables.c | 32 ++-- sound/soc/codecs/cs4265.c | 4 +- sound/soc/codecs/lpass-wsa-macro.c | 8 +- sound/soc/codecs/tas2562.c | 9 +- sound/soc/intel/common/sof-function-topology-lib.c | 7 +- sound/soc/sof/ipc4-topology.c | 33 +++++ sound/soc/sof/sof-audio.c | 9 +- sound/soc/xilinx/xlnx_formatter_pcm.c | 10 +- .../selftests/bpf/progs/verifier_linked_scalars.c | 112 ++++++++++++++ tools/testing/selftests/net/mptcp/mptcp_join.sh | 4 +- 233 files changed, 2826 insertions(+), 1496 deletions(-)

6 hours, 32 minutes

[PATCH 6.18 000/217] 6.18.46-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.18.46 release. There are 217 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat, 22 Aug 2026 14:51:11 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.46-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.18.46-rc1 Takashi Sakamoto <o-takashi(a)sakamocchi.jp> firewire: ohci: initialize page array to use alloc_pages_bulk() correctly Thomas Zimmermann <tzimmermann(a)suse.de> drm/vmwgfx: Set surface-framebuffer GEM objects Gao Xiang <xiang(a)kernel.org> erofs: fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms Jasper Wise <jaspwise(a)amazon.co.uk> spi: virtio: mark device ready before registering the controller Shixiong Ou <oushixiong(a)kylinos.cn> drm/log: Fix infinite loop when scale is too large for display Thomas Zimmermann <tzimmermann(a)suse.de> drm/client: Remove drm_client_framebuffer_delete() Thomas Zimmermann <tzimmermann(a)suse.de> drm/client: Deprecate struct drm_client_buffer.gem Thomas Zimmermann <tzimmermann(a)suse.de> drm/client: Inline drm_client_buffer_addfb() and _rmfb() Thomas Zimmermann <tzimmermann(a)suse.de> drm/client: Move dumb-buffer handling to drm_client_framebuffer_create() Thomas Zimmermann <tzimmermann(a)suse.de> drm/client: Remove pitch from struct drm_client_buffer Shixiong Ou <oushixiong(a)kylinos.cn> drm/log: Fix out-of-bounds read on empty message length Linmao Li <lilinmao(a)kylinos.cn> drm/xe/oa: Fix sync entry leak on OA config emit failure Aleksandr Nogikh <nogikh(a)google.com> firewire: ohci: fix NULL pointer dereference in ar_context_release Takashi Sakamoto <o-takashi(a)sakamocchi.jp> firewire: ohci: split page allocation from dma mapping Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: cls_bpf: reject dev-bound programs bound to a different device Lizhi Hou <lizhi.hou(a)amd.com> accel/amdxdna: Skip unmapped range in aie2_populate_range() Siddharth Vadapalli <s-vadapalli(a)ti.com> net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG Andrey Golovko <andrey.golovko(a)gmail.com> regmap: sdw-mbq: don't call an unset readable_reg callback Uwe Kleine-König <ukleinek(a)kernel.org> m68k: Define NR_CPUS to 1 Zhang Changzhong <zhangchangzhong(a)huawei.com> net/sched: cls_u32: skip hash tables in u32_bind_class() Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain Eric Dumazet <edumazet(a)google.com> af_packet: Don't send zero-byte data in tpacket_snd(). Charles Keepax <ckeepax(a)opensource.cirrus.com> regmap: sdw-mbq: Fix swap of timeout and retry times Rosen Penev <rosenp(a)gmail.com> ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers Chuck Lever <chuck.lever(a)oracle.com> net/tls: Fail tls_sw_splice_read() after a failed async decrypt Jiawen Wu <jiawenwu(a)trustnetic.com> net: ngbe: fix NULL pointer dereference in non-MSI-X interrupt enabling Wei Fang <wei.fang(a)nxp.com> net: tap: fix wrong transport_header when sending VLAN-tagged frame Wei Fang <wei.fang(a)nxp.com> net: packet: fix wrong transport_header when sending VLAN-tagged frame Oleksij Rempel <o.rempel(a)pengutronix.de> net: phy: realtek: fix EEE advertisement write on the internal PHY MMD path Jiayuan Chen <jiayuan.chen(a)linux.dev> tcp: fix icsk_ack.ato bitfield overflow Jonas Köppeler <j.koeppeler(a)tu-berlin.de> veth: fix queue index used to wake the peer txq in veth_poll Eric Dumazet <edumazet(a)google.com> macvlan: inherit needed_headroom and needed_tailroom from lowerdev Eric Dumazet <edumazet(a)google.com> ipvlan: inherit needed_headroom and needed_tailroom from phy_dev Jakub Kicinski <kuba(a)kernel.org> eth: bnxt: keep the aRFS rmap updated when TPH is enabled Jakub Kicinski <kuba(a)kernel.org> eth: bnxt: cancel IRQ notifier before freeing affinity mask Florian Westphal <fw(a)strlen.de> netfilter: ipset: let destroy callbacks adjust ext mem size Florian Westphal <fw(a)strlen.de> netfilter: ipset: fix list type element drift bug Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> netfilter: flowtable: publish GC-visible tuple last Alexey Velichayshiy <a.velichayshiy(a)ispras.ru> netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path Xiang Mei (Microsoft) <xmei5(a)asu.edu> netfilter: ipset: fix refcount race between list:set GC and swap Shenghao Ding <shenghao-ding(a)ti.com> ASoC: tas2781: fix clang build error for goto bypassing cleanup variable Junjie Cao <junjie.cao(a)intel.com> gpio: ml-ioh: share the register lock across channels Kyle Zeng <kylebot(a)openai.com> perf: Reject exited events as group leaders Pu Lehui <pulehui(a)huawei.com> riscv: ftrace: Fix ftrace_modify_call failure on kprobed functions Ralf Lici <ralf(a)mandelbit.com> ovpn: finish crypto callback cleanup before peer release Ralf Lici <ralf(a)mandelbit.com> ovpn: fix NULL dereference when killing missing key Vladislav Dronov <vdronov(a)redhat.com> crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() Herbert Xu <herbert(a)gondor.apana.org.au> crypto: ccm - Set rfc4309 maxauthsize from child Jon Hunter <jonathanh(a)nvidia.com> arm64: tegra: Add EL2 virtual timer interrupt for Tegra194 Koichiro Den <den(a)valinux.co.jp> NTB: ntb_netdev: Preserve RX queue depth on allocation failure Koichiro Den <den(a)valinux.co.jp> net: ntb_netdev: Introduce per-queue context Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: SOF: ipc4-topology: Refresh copier IPC payload before widget setup Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: fix pptable use-after-free Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: adjust the visibility of pp_table sysfs node Zhiling Zou <zhilinz(a)nebusec.ai> mm/page_table_check: skip special zero mappings Vincent Donnefort <vdonnefort(a)google.com> ring-buffer: Prevent resizing of persistent ring buffer Vincent Donnefort <vdonnefort(a)google.com> ring-buffer: Store bpage pointers into subbuf_ids Steven Rostedt <rostedt(a)goodmis.org> ring-buffer: Add helper functions for allocations Tejun Heo <tj(a)kernel.org> sched_ext: Take cgroup_lock() first in scx_cgroup_lock() Tejun Heo <tj(a)kernel.org> sched_ext: Reorganize enable/disable path for multi-scheduler support Tejun Heo <tj(a)kernel.org> sched_ext: Update p->scx.disallow warning in scx_init_task() Yao Kai <yaokai34(a)huawei.com> futex: Fix race in futex_pivot_pending() during private hash resize Tu Nguyen <tu.nguyen.xg(a)renesas.com> can: rcar_canfd: change the initializing flow for clocks and resets Geert Uytterhoeven <geert+renesas(a)glider.be> can: rcar_canfd: Extract rcar_canfd_global_{,de}init() Biju Das <biju.das.jz(a)bp.renesas.com> can: rcar_canfd: Use devm_clk_get_optional() for RAM clk Geert Uytterhoeven <geert+renesas(a)glider.be> can: rcar_canfd: Invert global vs. channel teardown Geert Uytterhoeven <geert+renesas(a)glider.be> can: rcar_canfd: Invert reset assert order Christian Brauner <brauner(a)kernel.org> binfmt_misc: don't leak the user namespace when the mount fails Damien Le Moal <dlemoal(a)kernel.org> ata: libata-scsi: terminate deferred commands on time out Mark Brown <broonie(a)kernel.org> ASoC: tas2562: Validate values for volume writes Weiming Shi <bestswngs(a)gmail.com> KVM: x86: Cancel delayed I/O APIC EOI handling before destroying vCPUs Usama Arif <usama.arif(a)linux.dev> userfaultfd: wait on source PMD during UFFDIO_MOVE Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> mm: replace pmd_to_swp_entry() with softleaf_from_pmd() Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> fs/proc/task_mmu: refactor pagemap_pmd_range() Guanghui Yang <3497809730(a)qq.com> btrfs: zoned: fix missing chunk metadata reservation Filipe Manana <fdmanana(a)suse.com> btrfs: remove fs_info argument from btrfs_zoned_activate_one_bg() Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: validate minimum PDU size for transform requests ChenXiaoSong <chenxiaosong(a)kylinos.cn> smb/server: fix minimum SMB2 PDU size ChenXiaoSong <chenxiaosong(a)kylinos.cn> smb/server: fix minimum SMB1 PDU size Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: rename smb2_get_msg to smb_get_msg David Howells <dhowells(a)redhat.com> ksmbd: Fix to handle removal of rfc1002 header from smb_hdr ChenXiaoSong <chenxiaosong(a)kylinos.cn> smb/server: rename include guard in smb_common.h ZhangGuoDong <zhangguodong(a)kylinos.cn> smb: move get_rfc1002_len() to common/smbglob.h Aldo Ariel Panzardo <qwe.aldo(a)gmail.com> net/sched: serialize qdisc_rtab_list against concurrent get/put Pavitra Jha <jhapavitra98(a)gmail.com> libceph: fix two unsafe bare decodes in decode_lockers() Xiang Mei <xmei5(a)asu.edu> libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> libceph: Amend checking to fix `make W=1` build breakage Max Kellermann <max.kellermann(a)ionos.com> ceph: fix hanging __ceph_get_caps() with stale mds_wanted Max Kellermann <max.kellermann(a)ionos.com> ceph: avoid fs reclaim while using current->journal_info Christoph Hellwig <hch(a)lst.de> xfs: check v5 superblock features early Darrick J. Wong <djwong(a)kernel.org> xfs: check xfarray iteration errors when committing unlinked inode lists Darrick J. Wong <djwong(a)kernel.org> xfs: don't ignore runtime errors in xrep_iunlink_reload_next Long Li <leo.lilong(a)huawei.com> xfs: don't swallow dquot recovery verification errors Lin Jiapeng <ljp1205831794(a)gmail.com> xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN Darrick J. Wong <djwong(a)kernel.org> xfs: avoid UAF on sc->tempip in xrep_tempfile_create Darrick J. Wong <djwong(a)kernel.org> xfs: don't return EFSCORRUPTED when scrubbing corrupt parent pointers Darrick J. Wong <djwong(a)kernel.org> xfs: fix another iunlink infinite loop bug in online fsck Darrick J. Wong <djwong(a)kernel.org> xfs: fix allocated inodes that show up in the unlinked list Darrick J. Wong <djwong(a)kernel.org> xfs: don't walk off the end of a null sc->sa.agi_bp in AGI repair Darrick J. Wong <djwong(a)kernel.org> xfs: don't zap the attr fork on repair when there are queued pptr updates Long Li <leo.lilong(a)huawei.com> xfs: fix ilock leak on error in xfs_dq_get_next_id Darrick J. Wong <djwong(a)kernel.org> xfs: load next_agino from the correct xfarray in xrep_iunlink_relink_prev Darrick J. Wong <djwong(a)kernel.org> xfs: nlink scrub must take IOLOCK before determining ILOCK state Darrick J. Wong <djwong(a)kernel.org> xfs: pass runtime errors from xrep_iunlink_mark_ondisk_rec up to callers Darrick J. Wong <djwong(a)kernel.org> xfs: set the prev pointer when reinserting an inode on the unlinked list Darrick J. Wong <djwong(a)kernel.org> xfs: don't double-lock when deleting a self-referential directory Darrick J. Wong <djwong(a)kernel.org> xfs: only check mergeability of bnobt records Darrick J. Wong <djwong(a)kernel.org> xfs: zero i_nlink before repair puts inode on unlinked list Darrick J. Wong <djwong(a)kernel.org> xfs: fix transaction block reservation in xrep_rtbitmap Darrick J. Wong <djwong(a)kernel.org> xfs: check cowextsize in xrep_inode_cowextsize Qiang Ma <maqianga(a)uniontech.com> xfs: clear zapped attr fork state when bmap repair finds no attr fork Darrick J. Wong <djwong(a)kernel.org> xfs: mark nonzero sb_gquotino as corrupt on metadir filesystems Ibrahim Hashimov <security(a)auditcode.ai> xfs: bounds-check buffer log item's dirty bitmap Xiang Mei <xmei5(a)asu.edu> xfs: fix off-by-one in rtrefcount btree root level validation Guanghui Yang <3497809730(a)qq.com> xfs: propagate errors from xfs_rtginode_load Junrui Luo <moonafterrain(a)outlook.com> drm/amdgpu: disallow multiple FENCE chunks in one submit David Rosca <david.rosca(a)amd.com> drm/amdgpu: Fix UVD decode image min size calculation David Rosca <david.rosca(a)amd.com> drm/amdgpu: Fix UVD dpb min size calculation for H264 David Rosca <david.rosca(a)amd.com> drm/amdgpu: Fix UVD min buffer sizes David Rosca <david.rosca(a)amd.com> drm/amdgpu: Implement insert_end for VCE 3 David Rosca <david.rosca(a)amd.com> drm/amdgpu: Reject UVD message with dimensions above 4096 Candice Li <candice.li(a)amd.com> drm/amdgpu: validate GEM_CREATE domain combinations Yang Wang <kevinyang.wang(a)amd.com> drm/amdgpu: check ASPM on the dGPU host link Yang Wang <kevinyang.wang(a)amd.com> drm/amdgpu: fix nbif 6.3.1 l1 low power not functional David Rosca <david.rosca(a)amd.com> drm/amdgpu: Reject UVD message with invalid number of h265 refs Nathan Lucas <nlucasgit(a)gmail.com> drm/amd/display: fix BT.2020 YCbCr output CSC matrices for DCE Nathan Lucas <nlucasgit(a)gmail.com> drm/amd/display: fix BT.2020 YCbCr limited output CSC matrix Samuel Pitoiset <samuel.pitoiset(a)gmail.com> drm/amd/display: Fix NULL pointer dereference in amdgpu_dm_crtc_set_vblank() Harald Freudenberger <freude(a)linux.ibm.com> s390/zcrypt: Fix CPRB memory allocation in zcrypt misc code Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Implement a crw lock Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Calculate idal length based on idaw type Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Selectively expand io_mutex Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Move cp cleanup out of not operational Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Fix out of bounds check on CCW array Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Ensure first IDAW remains constant Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Ensure index for read/write regions are within range Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Cancel existing workqueues Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Limit the number of channel program segments Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Free all memory if cp_init() fails Jakub Kicinski <kuba(a)kernel.org> eth: bnxt: make sure we populate the qcfg defaults on old FW/HW Jakub Kicinski <kuba(a)kernel.org> eth: bnxt: always set the queue mgmt ops Guangshuo Li <lgs201920130244(a)gmail.com> drm/radeon: fix autosuspend cleanup during teardown Raag Jadav <raag.jadav(a)intel.com> drm/xe: Fix xe_device_probe() failure Matthew Brost <matthew.brost(a)intel.com> drm/xe: Order ring writes before ring tail updates Dmitry Osipenko <dmitry.osipenko(a)collabora.com> pmdomain: mediatek: Fix mt8183 hang on boot Binbin Zhou <zhoubinbin(a)loongson.cn> mmc: loongson2: Fix sg iteration in data reorder functions John Harrison <John.Harrison(a)Igalia.com> drm/connector/hdmi: Fix out of bounds memory read Pei Xiao <xiaopei01(a)kylinos.cn> mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition AngeloGioacchino Del Regno <angelogioacchino.delregno(a)collabora.com> pmdomains: mediatek: Avoid setting RTFF's CLK_DIS before NRESTORE Haibo Chen <haibo.chen(a)nxp.com> mmc: sdhci: make tuning_err a signed int Guangshuo Li <lgs201920130244(a)gmail.com> pmdomain: mediatek: fix remaining %pOF after of_node_put() Myeonghun Pak <mhun512(a)gmail.com> mmc: sdhci: unmap the bounce buffer before device release Zhan Xusheng <zhanxusheng1024(a)gmail.com> mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit Kefu Chai <k.chai(a)proxmox.com> libceph: tolerate addrvecs with multiple entries of the same type Yiming Zhu <zhuyiming(a)kuaishou.com> ceph: fix MDS random selection readiness predicate Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Avoid using invalid osd indices from primary_temp Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: sur40 - fix V4L error path cleanup Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: sur40 - fix input device registration ordering Ali Ahmet Memis <ali(a)iusegentoo.com> openrisc: signal: do not restore privileged SR bits on sigreturn Josh Poimboeuf <jpoimboe(a)kernel.org> ftrace: Fix off-by-one fentry site disable in ftrace_free_mem() Leon Hwang <leon.hwang(a)linux.dev> ftrace: Protect direct_functions in ftrace_find_rec_direct Pavitra Jha <jhapavitra98(a)gmail.com> libceph: fix multiple unsafe decodes in decode_locker() Praveen Talari <praveen.talari(a)oss.qualcomm.com> pmdomain: arm: Fix -EINVAL from scmi_pd_set_perf_state() on state 0 Junjie Cao <junjie.cao(a)intel.com> gpio: ml-ioh: use raw_spinlock_t for the register lock Jordan Rhee <jordanrhee(a)google.com> gve: fix zero-length skb frag with header-split Rui Qi <qirui.001(a)bytedance.com> selftests/ftrace: Convert ELF entry point to file offset in uprobe test Cengiz Can <cengiz.can(a)canonical.com> gpio: sloppy-logic-analyzer: fix use-after-free via debugfs trigger on unbind Jordan Rhee <jordanrhee(a)google.com> gve: fix NULL dereference due to missing ptp adjfine Thorsten Blum <thorsten.blum(a)linux.dev> crypto: qce - fix error path in devm_qce_register_algs Thorsten Blum <thorsten.blum(a)linux.dev> crypto: starfive - use scatterlist length before DMA mapping Jianing Li <m13940358460(a)163.com> Input: hynitron_cstxxx - validate touch count and finger IDs Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: synaptics-rmi4 - block s_input when F54 queue is busy Bryam Vargas <hexlabsecurity(a)proton.me> Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: synaptics-rmi4 - zero report size on F54 work error George Wilson <gcwilson(a)linux.ibm.com> powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak George Wilson <gcwilson(a)linux.ibm.com> powerpc/pseries: lparcfg - fix kbuf[] underflow Linmao Li <lilinmao(a)kylinos.cn> Input: byd - synchronize timer deletion before freeing private data Pengpeng Hou <pengpeng(a)iscas.ac.cn> Input: iforce - validate input packet lengths Zhefu Zhang <a723356(a)gmail.com> Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard Linmao Li <lilinmao(a)kylinos.cn> Input: psxpad-spi - set driver data before use Richard Davies <richard(a)arachsys.com> Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: synaptics-rmi4 - fix F55 transmitter electrode count typo George Wilson <gcwilson(a)linux.ibm.com> powerpc/pseries: pci - logic bug HyeongJun An <sammiee5311(a)gmail.com> Input: cs40l50-vibra - validate custom data from user space Kyohei Kadota <lufia(a)lufia.org> Input: xpad - add support for ZENAIM LEVERLESS Bard Liao <yung-chuan.liao(a)linux.intel.com> ASoC: SOF: topology: Use acpi mach from the machine driver Asad Kamal <asad.kamal(a)amd.com> drm/amdgpu: fix aperture iounmap skipped on device removal Jesse Zhang <Jesse.Zhang(a)amd.com> drm/amdgpu: fix JPEG v4.0.5 queue reset failure in DPG mode Jesse Zhang <Jesse.Zhang(a)amd.com> drm/amdgpu: fix JPEG v5.0.0 queue reset failure in DPG mode Qiang Yu <Qiang.Yu(a)amd.com> drm/amdgpu: read TRUNCATE_COORD_MODE on gfx12 Candice Li <candice.li(a)amd.com> drm/amdgpu: reject oversized IBs with per-ring packet limits Osama Abdelkader <osama.abdelkader(a)gmail.com> drm/panthor: skip zero-sized firmware sections Mingyu Wang <25181214217(a)stu.xidian.edu.cn> fbdev: core: Fix pointer desynchronization in fb_io_read() Dawid Wróbel <me(a)dawidwrobel.com> ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: cs35l41: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: cs35l45: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: cs4265: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: SOF: ipc4-pcm: Continue the pipeline trigger in case of IPC timeout Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked() Hidayath Khan <hidayath(a)linux.ibm.com> s390/qeth: validate user buffer length in SNMP and ARP query ioctls Wyatt Feng <bronzed_45_vested(a)icloud.com> mptcp: fastopen: only mark MPTFO subflows with SYN data Qing Luo <luoqing(a)kylinos.cn> mptcp: pm: fix data race in add_addr timer callback Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: options: reset DSS fields in case of unexpected size Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: avoid combining some incoming suboptions Gang Yan <yangang(a)kylinos.cn> selftests: mptcp: join: mark tests with data corruption as failed Paolo Abeni <pabeni(a)redhat.com> mptcp: reclaim forward-allocated memory on RX path errors Bryam Vargas <hexlabsecurity(a)proton.me> selinux: reject a permission value exceeding the class permission count Bryam Vargas <hexlabsecurity(a)proton.me> selinux: reject an unclaimed class value in security_get_classes() Bryam Vargas <hexlabsecurity(a)proton.me> selinux: do not cancel a policy conversion that never started Bryam Vargas <hexlabsecurity(a)proton.me> selinux: reject a class permission count below its inherited common Bryam Vargas <hexlabsecurity(a)proton.me> selinux: require every boolean value to be defined Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> ipvs: separate destination availability state Liyuan Pang <pangliyuan1(a)huawei.com> ubi: fastmap: fix ubi->fm memory leak Cheng Ming Lin <chengminglin(a)mxic.com.tw> mtd: ubi: skip programming unused bits in ubi headers Chao Shi <coshi036(a)gmail.com> block: stop the timeout timer when releasing a never added disk Michael Diesen <michael.diesen(a)posteo.de> ALSA: hda/realtek: Add quirk for HP Dragonfly Folio G3 2-in-1 (103c:8a05) ------------- Diffstat: Makefile | 4 +- arch/arm64/boot/dts/nvidia/tegra194.dtsi | 2 + arch/m68k/Kconfig.cpu | 4 + arch/openrisc/include/asm/processor.h | 2 + arch/openrisc/kernel/signal.c | 5 +- arch/powerpc/platforms/pseries/lparcfg.c | 2 +- arch/powerpc/platforms/pseries/papr-phy-attest.c | 12 +- arch/powerpc/platforms/pseries/pci.c | 2 +- arch/riscv/kernel/ftrace.c | 5 +- arch/x86/kvm/x86.c | 6 + block/genhd.c | 12 +- crypto/ccm.c | 2 +- drivers/accel/amdxdna/aie2_ctx.c | 16 ++ drivers/ata/libata-eh.c | 29 +- drivers/ata/libata-scsi.c | 115 ++++++-- drivers/ata/libata.h | 3 +- drivers/base/regmap/regmap-sdw-mbq.c | 4 +- drivers/crypto/qce/core.c | 2 +- drivers/crypto/starfive/jh7110-aes.c | 2 +- drivers/crypto/tegra/tegra-se-aes.c | 22 +- drivers/firewire/ohci.c | 83 ++++-- drivers/gpio/gpio-ml-ioh.c | 71 ++--- drivers/gpio/gpio-sloppy-logic-analyzer.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 31 ++- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 50 +++- drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 21 ++ drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 10 +- drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 85 ++---- drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | 5 + drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_5.c | 21 +- drivers/gpu/drm/amd/amdgpu/jpeg_v5_0_0.c | 21 +- drivers/gpu/drm/amd/amdgpu/nbif_v6_3_1.c | 42 ++- drivers/gpu/drm/amd/amdgpu/vce_v3_0.c | 26 +- .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c | 2 +- .../gpu/drm/amd/display/dc/core/dc_hw_sequencer.c | 31 ++- drivers/gpu/drm/amd/display/dc/dce/dce_transform.c | 7 +- .../drm/amd/display/dc/dce110/dce110_opp_csc_v.c | 7 +- drivers/gpu/drm/amd/pm/amdgpu_dpm.c | 24 +- drivers/gpu/drm/amd/pm/amdgpu_pm.c | 18 +- drivers/gpu/drm/amd/pm/inc/amdgpu_dpm.h | 3 +- drivers/gpu/drm/amd/pm/powerplay/amd_powerplay.c | 5 +- drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 2 +- drivers/gpu/drm/clients/drm_log.c | 13 +- drivers/gpu/drm/display/drm_hdmi_state_helper.c | 3 +- drivers/gpu/drm/drm_client.c | 181 ++++++------- drivers/gpu/drm/drm_fbdev_dma.c | 6 +- drivers/gpu/drm/drm_fbdev_shmem.c | 4 +- drivers/gpu/drm/drm_fbdev_ttm.c | 8 +- drivers/gpu/drm/panthor/panthor_fw.c | 3 + drivers/gpu/drm/radeon/radeon_kms.c | 1 + drivers/gpu/drm/vmwgfx/vmwgfx_kms.c | 3 + drivers/gpu/drm/xe/xe_device.c | 6 +- drivers/gpu/drm/xe/xe_lrc.c | 7 + drivers/gpu/drm/xe/xe_oa.c | 4 + drivers/input/joystick/iforce/iforce-packets.c | 11 +- drivers/input/joystick/iforce/iforce-usb.c | 3 + drivers/input/joystick/psxpad-spi.c | 1 + drivers/input/joystick/xpad.c | 2 + drivers/input/keyboard/atkbd.c | 8 + drivers/input/misc/cs40l50-vibra.c | 10 +- drivers/input/mouse/byd.c | 2 +- drivers/input/mouse/focaltech.c | 2 +- drivers/input/rmi4/rmi_f54.c | 43 ++- drivers/input/rmi4/rmi_f55.c | 4 +- drivers/input/touchscreen/hynitron_cstxxx.c | 13 +- drivers/input/touchscreen/sur40.c | 23 +- drivers/mmc/host/atmel-mci.c | 2 + drivers/mmc/host/loongson2-mmc.c | 8 +- drivers/mmc/host/omap_hsmmc.c | 2 +- drivers/mmc/host/sdhci.c | 16 ++ drivers/mmc/host/sdhci.h | 2 +- drivers/mtd/ubi/attach.c | 4 +- drivers/mtd/ubi/fastmap-wl.c | 8 +- drivers/mtd/ubi/io.c | 10 + drivers/mtd/ubi/ubi.h | 12 + drivers/net/can/rcar/rcar_canfd.c | 181 ++++++++----- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 30 ++- drivers/net/ethernet/google/gve/gve_ptp.c | 6 + drivers/net/ethernet/google/gve/gve_rx_dqo.c | 5 + drivers/net/ethernet/ti/am65-cpsw-nuss.c | 2 + drivers/net/ethernet/wangxun/ngbe/ngbe_main.c | 4 +- drivers/net/ipvlan/ipvlan_main.c | 4 + drivers/net/macvlan.c | 4 + drivers/net/ntb_netdev.c | 294 ++++++++++++++------- drivers/net/ovpn/crypto.c | 16 +- drivers/net/ovpn/io.c | 10 +- drivers/net/phy/realtek/realtek_main.c | 2 +- drivers/net/tap.c | 3 +- drivers/net/veth.c | 2 +- drivers/pmdomain/arm/scmi_perf_domain.c | 2 +- drivers/pmdomain/mediatek/mt8183-pm-domains.h | 7 +- drivers/pmdomain/mediatek/mtk-pm-domains.c | 30 +-- drivers/s390/cio/vfio_ccw_async.c | 16 ++ drivers/s390/cio/vfio_ccw_chp.c | 31 ++- drivers/s390/cio/vfio_ccw_cp.c | 74 ++++-- drivers/s390/cio/vfio_ccw_cp.h | 10 + drivers/s390/cio/vfio_ccw_drv.c | 21 +- drivers/s390/cio/vfio_ccw_fsm.c | 8 +- drivers/s390/cio/vfio_ccw_ops.c | 39 ++- drivers/s390/cio/vfio_ccw_private.h | 10 +- drivers/s390/crypto/zcrypt_ccamisc.c | 20 +- drivers/s390/crypto/zcrypt_ep11misc.c | 16 +- drivers/s390/net/qeth_core_main.c | 3 + drivers/s390/net/qeth_l3_main.c | 5 + drivers/spi/spi-virtio.c | 2 + drivers/video/fbdev/core/fb_io_fops.c | 8 + fs/binfmt_misc.c | 32 ++- fs/btrfs/block-group.c | 36 +-- fs/btrfs/zoned.c | 5 +- fs/btrfs/zoned.h | 6 +- fs/ceph/caps.c | 17 +- fs/ceph/file.c | 9 +- fs/ceph/mds_client.c | 11 + fs/ceph/mds_client.h | 1 + fs/ceph/mdsmap.c | 2 +- fs/erofs/Kconfig | 3 +- fs/proc/task_mmu.c | 148 ++++++----- fs/smb/client/cifsglob.h | 6 - fs/smb/client/cifssmb.c | 6 +- fs/smb/client/connect.c | 2 +- fs/smb/client/smb1transport.c | 8 +- fs/smb/common/cifsglob.h | 5 + fs/smb/server/auth.c | 4 +- fs/smb/server/connection.c | 23 +- fs/smb/server/oplock.c | 8 +- fs/smb/server/server.c | 2 +- fs/smb/server/smb2pdu.c | 70 ++--- fs/smb/server/smb2pdu.h | 9 - fs/smb/server/smb_common.c | 26 +- fs/smb/server/smb_common.h | 14 +- fs/xfs/libxfs/xfs_exchmaps.c | 10 + fs/xfs/libxfs/xfs_rtrefcount_btree.c | 4 +- fs/xfs/libxfs/xfs_sb.c | 4 +- fs/xfs/scrub/agheader.c | 2 +- fs/xfs/scrub/agheader_repair.c | 152 +++++++++-- fs/xfs/scrub/alloc.c | 5 +- fs/xfs/scrub/attr_repair.c | 3 +- fs/xfs/scrub/bmap.c | 5 + fs/xfs/scrub/dirtree_repair.c | 22 +- fs/xfs/scrub/inode_repair.c | 2 +- fs/xfs/scrub/nlinks.c | 13 +- fs/xfs/scrub/nlinks_repair.c | 7 +- fs/xfs/scrub/parent.c | 2 +- fs/xfs/scrub/rtbitmap_repair.c | 46 ++-- fs/xfs/scrub/tempfile.c | 1 + fs/xfs/scrub/trace.h | 2 + fs/xfs/xfs_buf_item_recover.c | 57 ++-- fs/xfs/xfs_dquot.c | 3 +- fs/xfs/xfs_dquot_item_recover.c | 2 +- fs/xfs/xfs_rtalloc.c | 2 +- include/drm/drm_client.h | 16 +- include/linux/libata.h | 2 + include/linux/swapops.h | 4 +- include/net/ip_vs.h | 7 + include/uapi/linux/ip_vs.h | 6 - kernel/events/core.c | 8 +- kernel/futex/core.c | 4 +- kernel/sched/ext.c | 97 ++++--- kernel/trace/ftrace.c | 9 +- kernel/trace/ring_buffer.c | 118 +++++---- mm/hmm.c | 2 +- mm/huge_memory.c | 22 +- mm/khugepaged.c | 2 +- mm/madvise.c | 2 +- mm/memory.c | 4 +- mm/mempolicy.c | 2 +- mm/migrate.c | 2 +- mm/page_table_check.c | 20 +- mm/page_vma_mapped.c | 2 +- mm/pagewalk.c | 2 +- mm/pgtable-generic.c | 2 +- net/ceph/cls_lock_client.c | 21 +- net/ceph/decode.c | 18 +- net/ceph/osdmap.c | 9 +- net/ipv4/tcp_input.c | 6 +- net/ipv4/tcp_timer.c | 4 +- net/mptcp/fastopen.c | 7 +- net/mptcp/options.c | 67 ++++- net/mptcp/pm.c | 6 +- net/mptcp/protocol.c | 6 + net/mptcp/protocol.h | 1 + net/netfilter/ipset/ip_set_bitmap_gen.h | 2 +- net/netfilter/ipset/ip_set_core.c | 19 +- net/netfilter/ipset/ip_set_list_set.c | 10 +- net/netfilter/ipvs/ip_vs_conn.c | 4 +- net/netfilter/ipvs/ip_vs_core.c | 6 +- net/netfilter/ipvs/ip_vs_ctl.c | 4 +- net/netfilter/ipvs/ip_vs_dh.c | 4 +- net/netfilter/ipvs/ip_vs_lblc.c | 2 +- net/netfilter/ipvs/ip_vs_lblcr.c | 8 +- net/netfilter/nf_flow_table_core.c | 7 +- net/netfilter/nf_tables_offload.c | 2 +- net/packet/af_packet.c | 7 +- net/sched/act_api.c | 10 +- net/sched/cls_bpf.c | 18 +- net/sched/cls_u32.c | 3 + net/sched/sch_api.c | 24 +- net/tls/tls_sw.c | 5 + security/selinux/ss/policydb.c | 34 +++ security/selinux/ss/services.c | 28 +- sound/hda/codecs/realtek/alc269.c | 1 + sound/soc/codecs/cs35l41-lib.c | 2 +- sound/soc/codecs/cs35l45-tables.c | 32 +-- sound/soc/codecs/cs4265.c | 4 +- sound/soc/codecs/lpass-wsa-macro.c | 8 +- sound/soc/codecs/tas2562.c | 9 +- sound/soc/codecs/tas2781-i2c.c | 18 +- sound/soc/intel/common/sof-function-topology-lib.c | 7 +- sound/soc/sof/ipc4-pcm.c | 25 +- sound/soc/sof/ipc4-topology.c | 33 +++ sound/soc/sof/sof-audio.c | 9 +- sound/soc/xilinx/xlnx_formatter_pcm.c | 10 +- .../ftrace/test.d/dynevent/add_remove_uprobe.tc | 27 +- tools/testing/selftests/net/mptcp/mptcp_join.sh | 4 +- 214 files changed, 2504 insertions(+), 1265 deletions(-)

6 hours, 33 minutes

[PATCH 7.1 000/228] 7.1.10-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 7.1.10 release. There are 228 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat, 22 Aug 2026 14:51:11 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.1.10-rc1… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.1.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 7.1.10-rc1 Gao Xiang <xiang(a)kernel.org> erofs: fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms Jasper Wise <jaspwise(a)amazon.co.uk> spi: virtio: mark device ready before registering the controller Shixiong Ou <oushixiong(a)kylinos.cn> drm/log: Fix infinite loop when scale is too large for display Shixiong Ou <oushixiong(a)kylinos.cn> drm/log: Fix out-of-bounds read on empty message length Shixiong Ou <oushixiong(a)kylinos.cn> drm/log: Fix division by zero when scale module parameter is 0 Vinay Belgaumkar <vinay.belgaumkar(a)intel.com> drm/xe: Fix a bug in pc_adjust_freq_bounds() Nareshkumar Gollakoti <naresh.kumar.g(a)intel.com> drm/xe: Set GT rp min frequency as 1.2GHz default for BMG/CRI Linmao Li <lilinmao(a)kylinos.cn> drm/xe/oa: Check managed mutex initialization errors Linmao Li <lilinmao(a)kylinos.cn> drm/xe/oa: Fix sync entry leak on OA config emit failure Daniele Ceraolo Spurio <daniele.ceraolospurio(a)intel.com> drm/xe/pxp: add termination on resume Aleksandr Nogikh <nogikh(a)google.com> firewire: ohci: fix NULL pointer dereference in ar_context_release Eric Dumazet <edumazet(a)google.com> l2tp: fix tunnel and session refcount leak on seq_file release Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: cls_bpf: reject dev-bound programs bound to a different device Lizhi Hou <lizhi.hou(a)amd.com> accel/amdxdna: Skip unmapped range in aie2_populate_range() Siddharth Vadapalli <s-vadapalli(a)ti.com> net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG Andrey Golovko <andrey.golovko(a)gmail.com> regmap: sdw-mbq: don't call an unset readable_reg callback Uwe Kleine-König <ukleinek(a)kernel.org> m68k: Define NR_CPUS to 1 Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> pid: reject allocations through dead ancestor pid namespaces Zhang Changzhong <zhangchangzhong(a)huawei.com> net/sched: cls_u32: skip hash tables in u32_bind_class() Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain Eric Dumazet <edumazet(a)google.com> af_packet: Don't send zero-byte data in tpacket_snd(). Charles Keepax <ckeepax(a)opensource.cirrus.com> regmap: sdw-mbq: Fix swap of timeout and retry times Rosen Penev <rosenp(a)gmail.com> ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers Chuck Lever <chuck.lever(a)oracle.com> net/tls: Fail tls_sw_splice_read() after a failed async decrypt Jiawen Wu <jiawenwu(a)trustnetic.com> net: ngbe: fix NULL pointer dereference in non-MSI-X interrupt enabling Wei Fang <wei.fang(a)nxp.com> net: tap: fix wrong transport_header when sending VLAN-tagged frame Wei Fang <wei.fang(a)nxp.com> net: packet: fix wrong transport_header when sending VLAN-tagged frame Oleksij Rempel <o.rempel(a)pengutronix.de> net: phy: realtek: fix EEE advertisement write on the internal PHY MMD path Jiayuan Chen <jiayuan.chen(a)linux.dev> tcp: fix icsk_ack.ato bitfield overflow Jonas Köppeler <j.koeppeler(a)tu-berlin.de> veth: fix queue index used to wake the peer txq in veth_poll Eric Dumazet <edumazet(a)google.com> macvlan: inherit needed_headroom and needed_tailroom from lowerdev Eric Dumazet <edumazet(a)google.com> ipvlan: inherit needed_headroom and needed_tailroom from phy_dev Jakub Kicinski <kuba(a)kernel.org> eth: bnxt: avoid deadlock when canceling IRQ affinity notifier Jakub Kicinski <kuba(a)kernel.org> eth: bnxt: decrease indent in bnxt_request_irq() Jakub Kicinski <kuba(a)kernel.org> eth: bnxt: keep the aRFS rmap updated when TPH is enabled Jakub Kicinski <kuba(a)kernel.org> eth: bnxt: cancel IRQ notifier before freeing affinity mask Florian Westphal <fw(a)strlen.de> netfilter: ipset: let destroy callbacks adjust ext mem size Florian Westphal <fw(a)strlen.de> netfilter: ipset: fix list type element drift bug Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> netfilter: flowtable: publish GC-visible tuple last Alexey Velichayshiy <a.velichayshiy(a)ispras.ru> netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path Julian Anastasov <ja(a)ssi.bg> ipvs: revalidate ihl to prevent out-of-bounds access Xiang Mei (Microsoft) <xmei5(a)asu.edu> netfilter: ipset: fix refcount race between list:set GC and swap Karl Mehltretter <kmehltretter(a)gmail.com> tick: Include ktime.h and jiffies.h in linux/tick.h Shenghao Ding <shenghao-ding(a)ti.com> ASoC: tas2781: fix clang build error for goto bypassing cleanup variable Junjie Cao <junjie.cao(a)intel.com> gpio: ml-ioh: share the register lock across channels Niels Pressel <npressel(a)ethz.ch> rseq: Prevent hard lockup on granted time slice extension Ralf Lici <ralf(a)mandelbit.com> ovpn: defer key slot crypto freeing to workqueue Ralf Lici <ralf(a)mandelbit.com> ovpn: run deferred work on a module-owned workqueue Michael Neuling <mikey(a)neuling.org> riscv: lib: Fix ZBB strnlen reading past count boundary Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Fix mixer regression on SteelSeries Arctis Nova 5 Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> sctp: validate cookie AUTH state before use Kyle Zeng <kylebot(a)openai.com> perf: Reject exited events as group leaders Hongjie Fang <hongjiefang(a)asrmicro.com> scsi: core: pair EH runtime PM get and put Pu Lehui <pulehui(a)huawei.com> riscv: ftrace: Fix ftrace_modify_call failure on kprobed functions Ralf Lici <ralf(a)mandelbit.com> ovpn: finish crypto callback cleanup before peer release Ralf Lici <ralf(a)mandelbit.com> ovpn: fix NULL dereference when killing missing key Kuniyuki Iwashima <kuniyu(a)google.com> af_unix: Unlink scc_entry in unix_del_edge(). Robby Cai <robby.cai(a)nxp.com> regulator: fp9931: Fix VPOS/VNEG voltage selector table Christophe Leroy (CS GROUP) <chleroy(a)kernel.org> gpiolib: Check gc->get_direction() before calling gpiod_get_direction() Florian Westphal <fw(a)strlen.de> rhashtable: fix false-positive lockdep splat on rhltable destruction Vladislav Dronov <vdronov(a)redhat.com> crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() Herbert Xu <herbert(a)gondor.apana.org.au> crypto: ccm - Set rfc4309 maxauthsize from child Jon Hunter <jonathanh(a)nvidia.com> arm64: tegra: Add EL2 virtual timer interrupt for Tegra194 Yixun Lan <dlan(a)kernel.org> clk: spacemit: k3: set hdma clock as critical Yixun Lan <dlan(a)kernel.org> clk: spacemit: k3: fix USB2 bus clock Mostafa Saleh <smostafa(a)google.com> optee: ffa: Add NULL check in optee_ffa_lend_protmem Krzysztof Kozlowski <krzysztof.kozlowski(a)oss.qualcomm.com> clk: qcom: dispcc-eliza: Fix disp_cc_mdss_mdp_clk_src RCG stall on Eliza EVK Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: SOF: ipc4-topology: Refresh copier IPC payload before widget setup Jakub Kicinski <kuba(a)kernel.org> net: expect instance lock in netdev_queue_get_dma_dev() Jakub Kicinski <kuba(a)kernel.org> net: rename netdev_ops_assert_locked() William Palacek <William.Palacek(a)amd.com> drm/amdkfd: Add bounds check for CRAT subtype length AngeloGioacchino Del Regno <angelogioacchino.delregno(a)collabora.com> drm/mediatek: mtk_dsi: Enable HS clock only at pre-enable Abhishek Rajput <abhiraj21put(a)gmail.com> drm/mediatek: Convert legacy DRM logging to drm_* helpers in mtk_dsi.c Mark Brown <broonie(a)kernel.org> ASoC: tas2562: Validate values for volume writes Max Kellermann <max.kellermann(a)ionos.com> ceph: fix hanging __ceph_get_caps() with stale mds_wanted Max Kellermann <max.kellermann(a)ionos.com> ceph: avoid fs reclaim while using current->journal_info Clay King <clayking(a)amd.com> drm/amd/display: Fix warnings Gaghik Khachatrian <gaghik.khachatrian(a)amd.com> drm/amd/display: Fix type mismatches in DML and normalize loop bounds Christoph Hellwig <hch(a)lst.de> xfs: check v5 superblock features early Darrick J. Wong <djwong(a)kernel.org> xfs: check xfarray iteration errors when committing unlinked inode lists Darrick J. Wong <djwong(a)kernel.org> xfs: don't ignore runtime errors in xrep_iunlink_reload_next Long Li <leo.lilong(a)huawei.com> xfs: don't swallow dquot recovery verification errors Lin Jiapeng <ljp1205831794(a)gmail.com> xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN Darrick J. Wong <djwong(a)kernel.org> xfs: avoid UAF on sc->tempip in xrep_tempfile_create Darrick J. Wong <djwong(a)kernel.org> xfs: don't return EFSCORRUPTED when scrubbing corrupt parent pointers Darrick J. Wong <djwong(a)kernel.org> xfs: fix another iunlink infinite loop bug in online fsck Darrick J. Wong <djwong(a)kernel.org> xfs: fix allocated inodes that show up in the unlinked list Darrick J. Wong <djwong(a)kernel.org> xfs: don't walk off the end of a null sc->sa.agi_bp in AGI repair Darrick J. Wong <djwong(a)kernel.org> xfs: don't zap the attr fork on repair when there are queued pptr updates Long Li <leo.lilong(a)huawei.com> xfs: fix ilock leak on error in xfs_dq_get_next_id Darrick J. Wong <djwong(a)kernel.org> xfs: load next_agino from the correct xfarray in xrep_iunlink_relink_prev Darrick J. Wong <djwong(a)kernel.org> xfs: nlink scrub must take IOLOCK before determining ILOCK state Darrick J. Wong <djwong(a)kernel.org> xfs: pass runtime errors from xrep_iunlink_mark_ondisk_rec up to callers Darrick J. Wong <djwong(a)kernel.org> xfs: set the prev pointer when reinserting an inode on the unlinked list Darrick J. Wong <djwong(a)kernel.org> xfs: don't double-lock when deleting a self-referential directory Darrick J. Wong <djwong(a)kernel.org> xfs: only check mergeability of bnobt records Darrick J. Wong <djwong(a)kernel.org> xfs: zero i_nlink before repair puts inode on unlinked list Darrick J. Wong <djwong(a)kernel.org> xfs: fix transaction block reservation in xrep_rtbitmap Darrick J. Wong <djwong(a)kernel.org> xfs: check cowextsize in xrep_inode_cowextsize Qiang Ma <maqianga(a)uniontech.com> xfs: clear zapped attr fork state when bmap repair finds no attr fork Darrick J. Wong <djwong(a)kernel.org> xfs: mark nonzero sb_gquotino as corrupt on metadir filesystems Ibrahim Hashimov <security(a)auditcode.ai> xfs: bounds-check buffer log item's dirty bitmap Xiang Mei <xmei5(a)asu.edu> xfs: fix off-by-one in rtrefcount btree root level validation Guanghui Yang <3497809730(a)qq.com> xfs: propagate errors from xfs_rtginode_load Junrui Luo <moonafterrain(a)outlook.com> drm/amdgpu: disallow multiple FENCE chunks in one submit David Rosca <david.rosca(a)amd.com> drm/amdgpu: Fix UVD decode image min size calculation David Rosca <david.rosca(a)amd.com> drm/amdgpu: Fix UVD dpb min size calculation for H264 David Rosca <david.rosca(a)amd.com> drm/amdgpu: Fix UVD min buffer sizes David Rosca <david.rosca(a)amd.com> drm/amdgpu: Implement insert_end for VCE 3 David Rosca <david.rosca(a)amd.com> drm/amdgpu: Reject UVD message with dimensions above 4096 Candice Li <candice.li(a)amd.com> drm/amdgpu: validate GEM_CREATE domain combinations Yang Wang <kevinyang.wang(a)amd.com> drm/amdgpu: check ASPM on the dGPU host link Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu: fix missing check in vm_flush() Yang Wang <kevinyang.wang(a)amd.com> drm/amdgpu: fix nbif 6.3.1 l1 low power not functional Lijo Lazar <lijo.lazar(a)amd.com> drm/amdgpu: Prefer default discovery offset David Rosca <david.rosca(a)amd.com> drm/amdgpu: Reject UVD message with invalid number of h265 refs Nathan Lucas <nlucasgit(a)gmail.com> drm/amd/display: fix BT.2020 YCbCr output CSC matrices for DCE Nathan Lucas <nlucasgit(a)gmail.com> drm/amd/display: fix BT.2020 YCbCr limited output CSC matrix Samuel Pitoiset <samuel.pitoiset(a)gmail.com> drm/amd/display: Fix NULL pointer dereference in amdgpu_dm_crtc_set_vblank() Harald Freudenberger <freude(a)linux.ibm.com> s390/zcrypt: Pad trailing CCA or EP11 message with zeros Harald Freudenberger <freude(a)linux.ibm.com> s390/zcrypt: Improve EP11 CPRB domain handling with ASN.1 parsing Harald Freudenberger <freude(a)linux.ibm.com> s390/zcrypt: Improve EP11 CPRB length and overflow checks Harald Freudenberger <freude(a)linux.ibm.com> s390/zcrypt: Improve CCA CPRB length and overflow checks Harald Freudenberger <freude(a)linux.ibm.com> s390/zcrypt: Fix CPRB memory allocation in zcrypt misc code Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Implement a crw lock Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Calculate idal length based on idaw type Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Selectively expand io_mutex Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Move cp cleanup out of not operational Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Fix out of bounds check on CCW array Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Ensure first IDAW remains constant Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Ensure index for read/write regions are within range Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Cancel existing workqueues Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Limit the number of channel program segments Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Free all memory if cp_init() fails Guangshuo Li <lgs201920130244(a)gmail.com> drm/radeon: fix autosuspend cleanup during teardown Jia Yao <jia.yao(a)intel.com> drm/xe/guc_ads: use uncached mapping for UM queue BO Jia Yao <jia.yao(a)intel.com> drm/xe/guc_ads: allocate UM queues in VRAM on dGFX Jia Yao <jia.yao(a)intel.com> drm/xe/guc_ads: allocate UM queues in a separate BO Raag Jadav <raag.jadav(a)intel.com> drm/xe: Fix xe_device_probe() failure Matthew Brost <matthew.brost(a)intel.com> drm/xe: Order ring writes before ring tail updates Rui Qi <qirui.001(a)bytedance.com> riscv: hwprobe: Register unaligned probes before usermode Dmitry Osipenko <dmitry.osipenko(a)collabora.com> pmdomain: mediatek: Fix mt8183 hang on boot Binbin Zhou <zhoubinbin(a)loongson.cn> mmc: loongson2: Fix sg iteration in data reorder functions John Harrison <John.Harrison(a)Igalia.com> drm/connector/hdmi: Fix out of bounds memory read Pei Xiao <xiaopei01(a)kylinos.cn> mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition AngeloGioacchino Del Regno <angelogioacchino.delregno(a)collabora.com> pmdomains: mediatek: Avoid setting RTFF's CLK_DIS before NRESTORE Haibo Chen <haibo.chen(a)nxp.com> mmc: sdhci: make tuning_err a signed int Guangshuo Li <lgs201920130244(a)gmail.com> pmdomain: mediatek: fix remaining %pOF after of_node_put() Myeonghun Pak <mhun512(a)gmail.com> mmc: sdhci: unmap the bounce buffer before device release Zhan Xusheng <zhanxusheng1024(a)gmail.com> mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit Kefu Chai <k.chai(a)proxmox.com> libceph: tolerate addrvecs with multiple entries of the same type Pavitra Jha <jhapavitra98(a)gmail.com> libceph: fix OOB read in decode_watchers() via missing bounds check Yiming Zhu <zhuyiming(a)kuaishou.com> ceph: fix MDS random selection readiness predicate Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Avoid using invalid osd indices from primary_temp Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: sur40 - fix V4L error path cleanup Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: sur40 - fix input device registration ordering Ali Ahmet Memis <ali(a)iusegentoo.com> openrisc: signal: do not restore privileged SR bits on sigreturn Josh Poimboeuf <jpoimboe(a)kernel.org> ftrace: Fix off-by-one fentry site disable in ftrace_free_mem() Leon Hwang <leon.hwang(a)linux.dev> ftrace: Protect direct_functions in update_ftrace_direct_mod Leon Hwang <leon.hwang(a)linux.dev> ftrace: Protect direct_functions in update_ftrace_direct_del Leon Hwang <leon.hwang(a)linux.dev> ftrace: Protect direct_functions in ftrace_find_rec_direct Karl Mehltretter <kmehltretter(a)gmail.com> pmdomain: mediatek: mfg: initialize prev_o in mtk_mfg_attach_dev() Pavitra Jha <jhapavitra98(a)gmail.com> libceph: fix multiple unsafe decodes in decode_locker() Praveen Talari <praveen.talari(a)oss.qualcomm.com> pmdomain: arm: Fix -EINVAL from scmi_pd_set_perf_state() on state 0 Abel Vesa <abel.vesa(a)oss.qualcomm.com> pmdomain: qcom: rpmhpd: Add missing MXC and MMCX power domains for Eliza Junjie Cao <junjie.cao(a)intel.com> gpio: ml-ioh: use raw_spinlock_t for the register lock Jordan Rhee <jordanrhee(a)google.com> gve: fix zero-length skb frag with header-split Rui Qi <qirui.001(a)bytedance.com> selftests/ftrace: Convert ELF entry point to file offset in uprobe test Cengiz Can <cengiz.can(a)canonical.com> gpio: sloppy-logic-analyzer: fix use-after-free via debugfs trigger on unbind Jordan Rhee <jordanrhee(a)google.com> gve: fix NULL dereference due to missing ptp adjfine Thorsten Blum <thorsten.blum(a)linux.dev> crypto: qce - fix error path in devm_qce_register_algs Thorsten Blum <thorsten.blum(a)linux.dev> crypto: starfive - use scatterlist length before DMA mapping Jianing Li <m13940358460(a)163.com> Input: hynitron_cstxxx - validate touch count and finger IDs Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: synaptics-rmi4 - block s_input when F54 queue is busy Bryam Vargas <hexlabsecurity(a)proton.me> Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: synaptics-rmi4 - zero report size on F54 work error George Wilson <gcwilson(a)linux.ibm.com> powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak George Wilson <gcwilson(a)linux.ibm.com> powerpc/pseries: lparcfg - fix kbuf[] underflow Linmao Li <lilinmao(a)kylinos.cn> Input: byd - synchronize timer deletion before freeing private data Pengpeng Hou <pengpeng(a)iscas.ac.cn> Input: iforce - validate input packet lengths Donglin Lyu <DongLin_Lyu(a)outlook.com> Input: atkbd - skip deactivate for HONOR ZQC-P Zhefu Zhang <a723356(a)gmail.com> Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard Linmao Li <lilinmao(a)kylinos.cn> Input: psxpad-spi - set driver data before use Richard Davies <richard(a)arachsys.com> Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: synaptics-rmi4 - fix F55 transmitter electrode count typo George Wilson <gcwilson(a)linux.ibm.com> powerpc/pseries: pci - logic bug HyeongJun An <sammiee5311(a)gmail.com> Input: cs40l50-vibra - validate custom data from user space Kyohei Kadota <lufia(a)lufia.org> Input: xpad - add support for ZENAIM LEVERLESS Bard Liao <yung-chuan.liao(a)linux.intel.com> ASoC: SOF: topology: Use acpi mach from the machine driver Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/gmc12.1: fix MMHUB0 check in pasid tlb flush Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/gmc12.1: implement tlb inv semaphore Asad Kamal <asad.kamal(a)amd.com> drm/amdgpu: fix aperture iounmap skipped on device removal Jesse Zhang <Jesse.Zhang(a)amd.com> drm/amdgpu: fix JPEG v4.0.5 queue reset failure in DPG mode Jesse Zhang <Jesse.Zhang(a)amd.com> drm/amdgpu: fix JPEG v5.0.0 queue reset failure in DPG mode Jesse Zhang <Jesse.Zhang(a)amd.com> drm/amdgpu: fix JPEG v5.3.0 queue reset failure in DPG mode Lijo Lazar <lijo.lazar(a)amd.com> drm/amdgpu: Use virtual alloc during coredump Wang Jiang <jiangwang(a)kylinos.cn> drm/radeon: restore hardware polling in fence_is_signaled to fix performance regression Travis K. Bangs <tbangs89(a)gmail.com> drm/amd: Disable DP audio spread spectrum for Cyan Skillfish Jesse Zhang <Jesse.Zhang(a)amd.com> drm/amdgpu/userq: serialize queue map against GPU reset Qiang Yu <Qiang.Yu(a)amd.com> drm/amdgpu: read TRUNCATE_COORD_MODE on gfx12 Candice Li <candice.li(a)amd.com> drm/amdgpu: reject oversized IBs with per-ring packet limits Osama Abdelkader <osama.abdelkader(a)gmail.com> drm/panthor: skip zero-sized firmware sections Mingyu Wang <25181214217(a)stu.xidian.edu.cn> fbdev: core: Fix pointer desynchronization in fb_io_read() Melbin K Mathew <mlbnkm1(a)gmail.com> fbdev: clear fb_info->mode before deleting a videomode Melbin K Mathew <mlbnkm1(a)gmail.com> fbdev: bound mode sysfs output to the sysfs buffer Dawid Wróbel <me(a)dawidwrobel.com> ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: cs35l41: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: cs35l45: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: cs4265: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: SOF: ipc4-pcm: Continue the pipeline trigger in case of IPC timeout Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked() Christian A. Ehrhardt <lk(a)c--e.de> drm/shmem_helper: Check VMA boundaries for PMD mappings Dawid Wróbel <me(a)dawidwrobel.com> ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses Ramin Moussavi <ramin.moussavi(a)yacoub.de> microblaze: restore the page alignment of swapper_pg_dir Hidayath Khan <hidayath(a)linux.ibm.com> s390/qeth: validate user buffer length in SNMP and ARP query ioctls Wyatt Feng <bronzed_45_vested(a)icloud.com> mptcp: fastopen: only mark MPTFO subflows with SYN data Qing Luo <luoqing(a)kylinos.cn> mptcp: pm: fix data race in add_addr timer callback Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: options: reset DSS fields in case of unexpected size Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: avoid combining some incoming suboptions Gang Yan <yangang(a)kylinos.cn> selftests: mptcp: join: mark tests with data corruption as failed Paolo Abeni <pabeni(a)redhat.com> mptcp: reclaim forward-allocated memory on RX path errors Bryam Vargas <hexlabsecurity(a)proton.me> selinux: reject a permission value exceeding the class permission count Bryam Vargas <hexlabsecurity(a)proton.me> selinux: reject an unclaimed class value in security_get_classes() Bryam Vargas <hexlabsecurity(a)proton.me> selinux: do not cancel a policy conversion that never started Bryam Vargas <hexlabsecurity(a)proton.me> selinux: reject a class permission count below its inherited common Bryam Vargas <hexlabsecurity(a)proton.me> selinux: require every boolean value to be defined Chao Shi <coshi036(a)gmail.com> block: stop the timeout timer when releasing a never added disk ------------- Diffstat: Makefile | 4 +- arch/arm64/boot/dts/nvidia/tegra194.dtsi | 2 + arch/m68k/Kconfig.cpu | 4 + arch/microblaze/kernel/head.S | 2 + arch/openrisc/include/asm/processor.h | 2 + arch/openrisc/kernel/signal.c | 5 +- arch/powerpc/platforms/pseries/lparcfg.c | 2 +- arch/powerpc/platforms/pseries/papr-phy-attest.c | 12 +- arch/powerpc/platforms/pseries/pci.c | 2 +- arch/riscv/kernel/ftrace.c | 5 +- arch/riscv/kernel/unaligned_access_speed.c | 8 +- arch/riscv/lib/strnlen.S | 10 +- block/genhd.c | 12 +- crypto/ccm.c | 2 +- drivers/accel/amdxdna/aie2_ctx.c | 16 + drivers/base/regmap/regmap-sdw-mbq.c | 4 +- drivers/clk/qcom/dispcc-eliza.c | 2 +- drivers/clk/spacemit/ccu-k3.c | 4 +- drivers/crypto/qce/core.c | 2 +- drivers/crypto/starfive/jh7110-aes.c | 2 +- drivers/crypto/tegra/tegra-se-aes.c | 22 +- drivers/firewire/ohci.c | 4 +- drivers/gpio/gpio-ml-ioh.c | 71 +-- drivers/gpio/gpio-sloppy-logic-analyzer.c | 2 +- drivers/gpio/gpiolib.c | 3 +- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 31 +- drivers/gpu/drm/amd/amdgpu/amdgpu_dev_coredump.c | 10 +- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 50 +- drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 13 + drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 21 + drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 10 +- drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c | 5 + drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 85 +--- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 3 +- drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | 5 + drivers/gpu/drm/amd/amdgpu/gmc_v12_1.c | 48 +- drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_5.c | 21 +- drivers/gpu/drm/amd/amdgpu/jpeg_v5_0_0.c | 21 +- drivers/gpu/drm/amd/amdgpu/jpeg_v5_3_0.c | 21 +- drivers/gpu/drm/amd/amdgpu/nbif_v6_3_1.c | 42 +- drivers/gpu/drm/amd/amdgpu/vce_v3_0.c | 26 +- drivers/gpu/drm/amd/amdkfd/kfd_crat.c | 9 + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 5 + .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c | 2 +- .../amd/display/dc/clk_mgr/dce100/dce_clk_mgr.c | 6 +- .../amd/display/dc/clk_mgr/dce100/dce_clk_mgr.h | 2 +- .../amd/display/dc/clk_mgr/dcn20/dcn20_clk_mgr.c | 8 +- .../dc/clk_mgr/dcn30/dcn30_clk_mgr_smu_msg.c | 4 +- .../dc/clk_mgr/dcn30/dcn30_clk_mgr_smu_msg.h | 2 +- .../amd/display/dc/clk_mgr/dcn32/dcn32_clk_mgr.c | 2 +- .../amd/display/dc/clk_mgr/dcn401/dcn401_clk_mgr.c | 2 +- .../amd/display/dc/clk_mgr/dcn401/dcn401_clk_mgr.h | 4 +- .../dc/clk_mgr/dcn401/dcn401_clk_mgr_smu_msg.c | 4 +- .../dc/clk_mgr/dcn401/dcn401_clk_mgr_smu_msg.h | 2 +- .../amd/display/dc/clk_mgr/dcn42/dcn42_clk_mgr.c | 2 +- drivers/gpu/drm/amd/display/dc/core/dc.c | 4 +- .../gpu/drm/amd/display/dc/core/dc_hw_sequencer.c | 31 +- .../gpu/drm/amd/display/dc/core/dc_link_exports.c | 2 +- drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 18 +- drivers/gpu/drm/amd/display/dc/core/dc_vm_helper.c | 4 +- drivers/gpu/drm/amd/display/dc/dc.h | 68 +-- drivers/gpu/drm/amd/display/dc/dc_dsc.h | 2 +- drivers/gpu/drm/amd/display/dc/dc_stream.h | 4 +- drivers/gpu/drm/amd/display/dc/dc_types.h | 2 +- drivers/gpu/drm/amd/display/dc/dce/dce_transform.c | 7 +- .../drm/amd/display/dc/dce110/dce110_opp_csc_v.c | 7 +- .../drm/amd/display/dc/dcn21/dcn21_link_encoder.c | 2 +- .../amd/display/dc/dio/dcn10/dcn10_link_encoder.c | 2 +- .../gpu/drm/amd/display/dc/dml/calcs/dcn_calcs.c | 9 +- .../gpu/drm/amd/display/dc/dml/dcn20/dcn20_fpu.c | 38 +- .../amd/display/dc/dml/dcn20/display_mode_vba_20.c | 36 +- .../display/dc/dml/dcn20/display_mode_vba_20v2.c | 36 +- .../amd/display/dc/dml/dcn21/display_mode_vba_21.c | 64 +-- .../gpu/drm/amd/display/dc/dml/dcn30/dcn30_fpu.c | 14 +- .../amd/display/dc/dml/dcn30/display_mode_vba_30.c | 425 +++++++++-------- .../gpu/drm/amd/display/dc/dml/dcn301/dcn301_fpu.c | 5 +- .../gpu/drm/amd/display/dc/dml/dcn302/dcn302_fpu.c | 2 +- .../gpu/drm/amd/display/dc/dml/dcn303/dcn303_fpu.c | 2 +- .../gpu/drm/amd/display/dc/dml/dcn31/dcn31_fpu.c | 15 +- .../amd/display/dc/dml/dcn31/display_mode_vba_31.c | 527 +++++++++++---------- .../gpu/drm/amd/display/dc/dml/dcn314/dcn314_fpu.c | 5 +- .../display/dc/dml/dcn314/display_mode_vba_314.c | 527 +++++++++++---------- .../gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c | 77 +-- .../amd/display/dc/dml/dcn32/display_mode_vba_32.c | 21 +- .../dc/dml/dcn32/display_mode_vba_util_32.c | 10 +- .../dc/dml/dcn32/display_mode_vba_util_32.h | 8 +- .../gpu/drm/amd/display/dc/dml/dcn321/dcn321_fpu.c | 46 +- .../gpu/drm/amd/display/dc/dml/dcn35/dcn35_fpu.c | 5 +- .../gpu/drm/amd/display/dc/dml/dcn351/dcn351_fpu.c | 5 +- .../gpu/drm/amd/display/dc/dml/display_mode_vba.c | 4 +- .../gpu/drm/amd/display/dc/dml/display_mode_vba.h | 12 +- .../drm/amd/display/dc/dpp/dcn10/dcn10_dpp_cm.c | 2 +- .../gpu/drm/amd/display/dc/dpp/dcn30/dcn30_dpp.c | 2 +- .../drm/amd/display/dc/dpp/dcn30/dcn30_dpp_cm.c | 4 +- drivers/gpu/drm/amd/display/dc/dsc/dc_dsc.c | 2 +- .../gpu/drm/amd/display/dc/dsc/dcn20/dcn20_dsc.c | 8 +- .../gpu/drm/amd/display/dc/dsc/dcn35/dcn35_dsc.c | 8 +- .../gpu/drm/amd/display/dc/dsc/dcn401/dcn401_dsc.c | 10 +- .../drm/amd/display/dc/hubp/dcn401/dcn401_hubp.c | 4 +- .../drm/amd/display/dc/hubp/dcn401/dcn401_hubp.h | 2 +- .../drm/amd/display/dc/hwss/dcn10/dcn10_hwseq.c | 6 +- .../drm/amd/display/dc/hwss/dcn314/dcn314_hwseq.c | 2 +- .../drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c | 2 +- .../drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c | 2 +- drivers/gpu/drm/amd/display/dc/inc/bw_fixed.h | 2 +- drivers/gpu/drm/amd/display/dc/inc/hw/hubp.h | 2 +- drivers/gpu/drm/amd/display/dc/inc/hw/opp.h | 4 +- .../drm/amd/display/dc/inc/hw/timing_generator.h | 8 +- drivers/gpu/drm/amd/display/dc/inc/link_service.h | 2 +- drivers/gpu/drm/amd/display/dc/inc/reg_helper.h | 72 +-- .../gpu/drm/amd/display/dc/link/link_detection.c | 2 +- .../gpu/drm/amd/display/dc/link/link_detection.h | 2 +- .../dc/link/protocols/link_edp_panel_control.c | 8 +- .../gpu/drm/amd/display/dc/mpc/dcn10/dcn10_mpc.c | 2 +- .../gpu/drm/amd/display/dc/mpc/dcn30/dcn30_mpc.c | 6 +- .../gpu/drm/amd/display/dc/opp/dcn20/dcn20_opp.c | 2 +- .../gpu/drm/amd/display/dc/opp/dcn20/dcn20_opp.h | 2 +- .../gpu/drm/amd/display/dc/optc/dcn32/dcn32_optc.c | 2 +- drivers/gpu/drm/amd/display/include/fixed31_32.h | 6 +- .../gpu/drm/amd/display/modules/hdcp/hdcp_log.c | 2 +- drivers/gpu/drm/clients/drm_log.c | 12 + drivers/gpu/drm/display/drm_hdmi_state_helper.c | 3 +- drivers/gpu/drm/drm_gem_shmem_helper.c | 6 +- drivers/gpu/drm/mediatek/mtk_dsi.c | 32 +- drivers/gpu/drm/panthor/panthor_fw.c | 3 + drivers/gpu/drm/radeon/radeon_fence.c | 7 + drivers/gpu/drm/radeon/radeon_kms.c | 1 + drivers/gpu/drm/xe/xe_bo.h | 14 + drivers/gpu/drm/xe/xe_device.c | 6 +- drivers/gpu/drm/xe/xe_guc_ads.c | 93 ++-- drivers/gpu/drm/xe/xe_guc_ads_types.h | 5 + drivers/gpu/drm/xe/xe_guc_pc.c | 43 +- drivers/gpu/drm/xe/xe_lrc.c | 7 + drivers/gpu/drm/xe/xe_oa.c | 13 +- drivers/gpu/drm/xe/xe_pxp.c | 162 +++++-- drivers/gpu/drm/xe/xe_pxp_types.h | 27 +- drivers/input/joystick/iforce/iforce-packets.c | 11 +- drivers/input/joystick/iforce/iforce-usb.c | 3 + drivers/input/joystick/psxpad-spi.c | 1 + drivers/input/joystick/xpad.c | 2 + drivers/input/keyboard/atkbd.c | 20 +- drivers/input/misc/cs40l50-vibra.c | 10 +- drivers/input/mouse/byd.c | 2 +- drivers/input/mouse/focaltech.c | 2 +- drivers/input/rmi4/rmi_f54.c | 43 +- drivers/input/rmi4/rmi_f55.c | 4 +- drivers/input/touchscreen/hynitron_cstxxx.c | 13 +- drivers/input/touchscreen/sur40.c | 23 +- drivers/mmc/host/atmel-mci.c | 2 + drivers/mmc/host/loongson2-mmc.c | 8 +- drivers/mmc/host/omap_hsmmc.c | 2 +- drivers/mmc/host/sdhci.c | 16 + drivers/mmc/host/sdhci.h | 2 +- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 131 +++-- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 3 + drivers/net/ethernet/google/gve/gve_ptp.c | 6 + drivers/net/ethernet/google/gve/gve_rx_dqo.c | 5 + drivers/net/ethernet/ti/am65-cpsw-nuss.c | 2 + drivers/net/ethernet/wangxun/ngbe/ngbe_main.c | 4 +- drivers/net/ipvlan/ipvlan_main.c | 4 + drivers/net/macvlan.c | 4 + drivers/net/ovpn/crypto.c | 26 +- drivers/net/ovpn/crypto.h | 4 +- drivers/net/ovpn/crypto_aead.c | 19 +- drivers/net/ovpn/crypto_aead.h | 1 - drivers/net/ovpn/io.c | 10 +- drivers/net/ovpn/main.c | 19 +- drivers/net/ovpn/ovpnpriv.h | 4 + drivers/net/ovpn/peer.c | 8 +- drivers/net/ovpn/tcp.c | 9 +- drivers/net/phy/realtek/realtek_main.c | 2 +- drivers/net/tap.c | 3 +- drivers/net/veth.c | 2 +- drivers/pmdomain/arm/scmi_perf_domain.c | 2 +- drivers/pmdomain/mediatek/mt8183-pm-domains.h | 7 +- drivers/pmdomain/mediatek/mtk-mfg-pmdomain.c | 2 +- drivers/pmdomain/mediatek/mtk-pm-domains.c | 30 +- drivers/pmdomain/qcom/rpmhpd.c | 4 + drivers/regulator/fp9931.c | 54 +-- drivers/s390/cio/vfio_ccw_async.c | 16 + drivers/s390/cio/vfio_ccw_chp.c | 31 +- drivers/s390/cio/vfio_ccw_cp.c | 74 ++- drivers/s390/cio/vfio_ccw_cp.h | 10 + drivers/s390/cio/vfio_ccw_drv.c | 21 +- drivers/s390/cio/vfio_ccw_fsm.c | 8 +- drivers/s390/cio/vfio_ccw_ops.c | 39 +- drivers/s390/cio/vfio_ccw_private.h | 10 +- drivers/s390/crypto/zcrypt_ccamisc.c | 20 +- drivers/s390/crypto/zcrypt_ep11misc.c | 16 +- drivers/s390/crypto/zcrypt_msgtype6.c | 364 +++++++++----- drivers/s390/net/qeth_core_main.c | 3 + drivers/s390/net/qeth_l3_main.c | 5 + drivers/scsi/scsi_error.c | 6 +- drivers/spi/spi-virtio.c | 2 + drivers/tee/optee/ffa_abi.c | 3 + drivers/ufs/core/ufshcd.c | 4 +- drivers/video/fbdev/core/fb_io_fops.c | 8 + drivers/video/fbdev/core/fbmem.c | 5 +- drivers/video/fbdev/core/fbsysfs.c | 15 +- fs/ceph/caps.c | 17 +- fs/ceph/file.c | 9 +- fs/ceph/mds_client.c | 11 + fs/ceph/mds_client.h | 1 + fs/ceph/mdsmap.c | 2 +- fs/erofs/Kconfig | 3 +- fs/xfs/libxfs/xfs_exchmaps.c | 10 + fs/xfs/libxfs/xfs_rtrefcount_btree.c | 4 +- fs/xfs/libxfs/xfs_sb.c | 4 +- fs/xfs/scrub/agheader.c | 2 +- fs/xfs/scrub/agheader_repair.c | 152 ++++-- fs/xfs/scrub/alloc.c | 5 +- fs/xfs/scrub/attr_repair.c | 3 +- fs/xfs/scrub/bmap.c | 5 + fs/xfs/scrub/dirtree_repair.c | 22 +- fs/xfs/scrub/inode_repair.c | 2 +- fs/xfs/scrub/nlinks.c | 13 +- fs/xfs/scrub/nlinks_repair.c | 7 +- fs/xfs/scrub/parent.c | 2 +- fs/xfs/scrub/rtbitmap_repair.c | 46 +- fs/xfs/scrub/tempfile.c | 1 + fs/xfs/scrub/trace.h | 2 + fs/xfs/xfs_buf_item_recover.c | 57 ++- fs/xfs/xfs_dquot.c | 3 +- fs/xfs/xfs_dquot_item_recover.c | 2 +- fs/xfs/xfs_rtalloc.c | 2 +- include/linux/rseq_entry.h | 1 + include/linux/tick.h | 2 + include/net/ip_vs.h | 2 +- include/net/netdev_lock.h | 6 +- include/net/sctp/auth.h | 3 + include/scsi/scsi_host.h | 6 +- kernel/events/core.c | 8 +- kernel/pid.c | 6 +- kernel/trace/ftrace.c | 33 +- lib/rhashtable.c | 2 +- net/ceph/cls_lock_client.c | 13 +- net/ceph/decode.c | 18 +- net/ceph/osd_client.c | 5 +- net/ceph/osdmap.c | 5 +- net/core/dev.c | 26 +- net/core/dev_addr_lists.c | 2 +- net/core/link_watch.c | 2 +- net/core/lock_debug.c | 2 +- net/core/netdev_queues.c | 2 +- net/ethtool/netlink.c | 4 +- net/ipv4/tcp_input.c | 6 +- net/ipv4/tcp_timer.c | 4 +- net/ipv6/addrconf.c | 2 +- net/l2tp/l2tp_debugfs.c | 4 + net/l2tp/l2tp_ppp.c | 56 ++- net/mptcp/fastopen.c | 7 +- net/mptcp/options.c | 67 ++- net/mptcp/pm.c | 6 +- net/mptcp/protocol.c | 6 + net/mptcp/protocol.h | 1 + net/netfilter/ipset/ip_set_bitmap_gen.h | 2 +- net/netfilter/ipset/ip_set_core.c | 19 +- net/netfilter/ipset/ip_set_list_set.c | 10 +- net/netfilter/ipvs/ip_vs_core.c | 11 +- net/netfilter/ipvs/ip_vs_xmit.c | 3 +- net/netfilter/nf_flow_table_core.c | 7 +- net/netfilter/nf_tables_offload.c | 2 +- net/packet/af_packet.c | 7 +- net/sched/act_api.c | 10 +- net/sched/cls_bpf.c | 18 +- net/sched/cls_u32.c | 3 + net/sctp/auth.c | 75 +++ net/sctp/sm_make_chunk.c | 3 + net/tls/tls_sw.c | 5 + net/unix/garbage.c | 1 + net/xdp/xsk_buff_pool.c | 2 +- security/selinux/ss/policydb.c | 34 ++ security/selinux/ss/services.c | 28 +- sound/soc/codecs/cs35l41-lib.c | 2 +- sound/soc/codecs/cs35l45-tables.c | 32 +- sound/soc/codecs/cs4265.c | 4 +- sound/soc/codecs/lpass-tx-macro.c | 4 +- sound/soc/codecs/lpass-wsa-macro.c | 8 +- sound/soc/codecs/tas2562.c | 9 +- sound/soc/codecs/tas2781-i2c.c | 18 +- sound/soc/intel/common/sof-function-topology-lib.c | 7 +- sound/soc/sof/ipc4-pcm.c | 25 +- sound/soc/sof/ipc4-topology.c | 33 ++ sound/soc/sof/sof-audio.c | 9 +- sound/soc/xilinx/xlnx_formatter_pcm.c | 10 +- sound/usb/quirks.c | 2 + .../ftrace/test.d/dynevent/add_remove_uprobe.tc | 27 +- tools/testing/selftests/net/mptcp/mptcp_join.sh | 4 +- 288 files changed, 3633 insertions(+), 2012 deletions(-)

6 hours, 33 minutes

[PATCH 5.10 000/235] 5.10.266-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 5.10.266 release. There are 235 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat, 22 Aug 2026 14:51:11 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.266-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 5.10.266-rc1 Johan Hovold <johan(a)kernel.org> USB: serial: keyspan_pda: fix information leak Zhang Changzhong <zhangchangzhong(a)huawei.com> net: ethernet: ti: am65-cpsw: fix error handling in am65_cpsw_nuss_probe() Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> i2c: smbus: Check for parent device before dereference Robert Mader <robert.mader(a)collabora.com> udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf() Christian Brauner <brauner(a)kernel.org> binfmt_misc: use exe_file_deny_write_access() for the interpreter clone Daming Li <d4n.for.sec(a)gmail.com> net: smc: fix splice entry lifetime imbalance in smc_rx_splice Guangguan Wang <guangguan.wang(a)linux.alibaba.com> net/smc: rdma write inline if qp has sufficient inline space Siddharth Vadapalli <s-vadapalli(a)ti.com> net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG Grygorii Strashko <grygorii.strashko(a)ti.com> net: ethernet: ti: am65-cpsw: add multi port support in mac-only mode Grygorii Strashko <grygorii.strashko(a)ti.com> net: ethernet: ti: am65-cpsw: move free desc queue mode selection in pdata Grygorii Strashko <grygorii.strashko(a)ti.com> net: ethernet: ti: am65-cpsw: move ale selection in pdata Eric Dumazet <edumazet(a)google.com> af_packet: Don't send zero-byte data in tpacket_snd(). Rosen Penev <rosenp(a)gmail.com> ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers Wei Fang <wei.fang(a)nxp.com> net: packet: fix wrong transport_header when sending VLAN-tagged frame Florian Westphal <fw(a)strlen.de> netfilter: ipset: fix list type element drift bug Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> netfilter: flowtable: publish GC-visible tuple last Alexey Velichayshiy <a.velichayshiy(a)ispras.ru> netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path Xiang Mei (Microsoft) <xmei5(a)asu.edu> netfilter: ipset: fix refcount race between list:set GC and swap Herbert Xu <herbert(a)gondor.apana.org.au> crypto: ccm - Set rfc4309 maxauthsize from child Jon Hunter <jonathanh(a)nvidia.com> arm64: tegra: Add EL2 virtual timer interrupt for Tegra194 Yangyu Chen <cyy(a)cyyself.name> net: atlantic: free stranded TX buffers on ring deinit Lorenzo Stoakes (ARM) <ljs(a)kernel.org> mm/ptdump: always stabilise against page table freeing using init_mm Hyunjung Ko <hj351016(a)gmail.com> net/sched: act_gact, act_police: range check the fallback control action Tejun Heo <tj(a)kernel.org> sched/psi: Shut down rtpoll_timer in psi_cgroup_free() Baul Lee <baul.lee(a)xbow.com> ALSA: usx2y: bound the hwdep mmap fault offset Takashi Iwai <tiwai(a)suse.de> ALSA: usx2y: Fix potential leaks of uninitialized memory Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: fix torn gpu metrics reads Hongyan Xu <getshell(a)seu.edu.cn> hwmon: (npcm750-pwm-fan): stop fan timer on device detach Marc Kleine-Budde <mkl(a)pengutronix.de> can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure Christian Brauner <brauner(a)kernel.org> binfmt_misc: restore write access when removing an entry Amir Goldstein <amir73il(a)gmail.com> fs: don't block write during exec on pre-content watched files Amir Goldstein <amir73il(a)gmail.com> fsnotify: opt-in for permission events at file open time Jonas Gorski <jonas.gorski(a)bisdn.de> i2c: iproc: reset bus after timeout if START_BUSY is stuck Wolfram Sang <wsa+renesas(a)sang-engineering.com> i2c: bcm-iproc: remove printout on handled timeouts Dawei Feng <dawei.feng(a)seu.edu.cn> ice: fix memory leak in ice_lbtest_prepare_rings() Dawid Osuchowski <dawid.osuchowski(a)linux.intel.com> ice: fix VF interrupts cleanup Ibrahim Hashimov <security(a)auditcode.ai> scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write Damien Le Moal <damien.lemoal(a)opensource.wdc.com> scsi: scsi_debug: Rename zone type constants Damien Le Moal <damien.lemoal(a)opensource.wdc.com> scsi: sd: sd_zbc: Return early in sd_zbc_check_zoned_characteristics() Damien Le Moal <damien.lemoal(a)opensource.wdc.com> scsi: sd: sd_zbc: Use logical blocks as unit when querying zones Bart Van Assche <bvanassche(a)acm.org> scsi: sd: sd_zbc: Improve source code documentation Chengfeng Ye <nicoyip.dev(a)gmail.com> net: pktgen: fix proc entry use-after-free Peter Seiderer <ps.report(a)gmx.net> net: pktgen: fix code style (WARNING: Block comments) Gregory Price <gourry(a)gourry.net> mm/vmstat: fold stranded per-cpu node stats when a node comes online Sangho Lee <kudo3228(a)gmail.com> Bluetooth: HIDP: reject frames without a transaction header Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> skbuff: introduce skb_pull_data Tengda Wu <wutengda(a)huaweicloud.com> ftrace: Add global mutex to serialize trace_parser access Christian Brauner <brauner(a)kernel.org> super: fix emergency thaw deadlock on frozen block devices Shiming Cheng <shiming.cheng(a)mediatek.com> net: gro: fix double aggregation of flush-marked skbs Aldo Ariel Panzardo <qwe.aldo(a)gmail.com> net/sched: serialize qdisc_rtab_list against concurrent get/put Max Kellermann <max.kellermann(a)ionos.com> ceph: fix hanging __ceph_get_caps() with stale mds_wanted Xiubo Li <xiubli(a)redhat.com> ceph: rename _to_client() to _to_fs_client() Xiubo Li <xiubli(a)redhat.com> libceph: add doutc and *_client debug macros support Pavitra Jha <jhapavitra98(a)gmail.com> libceph: fix two unsafe bare decodes in decode_lockers() Xiang Mei <xmei5(a)asu.edu> libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> libceph: Amend checking to fix `make W=1` build breakage Max Kellermann <max.kellermann(a)ionos.com> ceph: avoid fs reclaim while using current->journal_info Zhiling Zou <roxy520tt(a)gmail.com> sctp: avoid auth_enable sysctl UAF during netns teardown Chenguang Zhao <zhaochenguang(a)kylinos.cn> mptcp: decrement subflows counter on failed passive join Paolo Abeni <pabeni(a)redhat.com> mptcp: fix subflow accounting on close Hugo Villeneuve <hvilleneuve(a)dimonoff.com> serial: sc16is7xx: implement gpio get_direction() callback Hugo Villeneuve <hvilleneuve(a)dimonoff.com> serial: sc16is7xx: fix regression with GPIO configuration Hugo Villeneuve <hvilleneuve(a)dimonoff.com> serial: sc16is7xx: remove obsolete out_thread label Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com> serial: sc16is7xx: Fill in rs485_supported Tomasz Moń <tomasz.mon(a)camlingroup.com> sc16is7xx: Properly resume TX after stop Michael Bommarito <michael.bommarito(a)gmail.com> mptcp: only set DATA_FIN when a mapping is present Jiangshan Yi <yijiangshan(a)kylinos.cn> serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> serial: 8250_mid: Remove unneeded test for ->setup() presence Norbert Szetei <norbert(a)doyensec.com> ALSA: seq: close a re-opened queue timer in the destructor Fan Wu <fanwu01(a)zju.edu.cn> wifi: brcmfmac: drain bus_reset work on device removal Mirela Rabulea <mirela.rabulea(a)nxp.com> media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor() Sakari Ailus <sakari.ailus(a)linux.intel.com> media: v4l: async: Set owner for async sub-devices Daniel Hodges <git(a)danielhodges.dev> wifi: ath6kl: fix use-after-free in aggr_reset_state() Sakari Ailus <sakari.ailus(a)linux.intel.com> media: imx219: Fix maximum frame length in lines Jai Luthra <jai.luthra(a)ideasonboard.com> media: i2c: imx219: Rename VTS to FRM_LENGTH David Plowman <david.plowman(a)raspberrypi.com> media: i2c: imx219: Correct the minimum vblanking value Laurent Pinchart <laurent.pinchart(a)ideasonboard.com> media: i2c: imx219: Drop IMX219_VTS_* macros Guangshuo Li <lgs201920130244(a)gmail.com> media: marvell-cam: fix missing pci_disable_device() on remove Jani Nikula <jani.nikula(a)intel.com> drm/i915/hdcp: require monotonically increasing seq_num_v David Carlier <devnexen(a)gmail.com> media: aspeed: fix missing of_reserved_mem_device_release() on probe failure Bryam Vargas <hexlabsecurity(a)proton.me> drm/virtio: bound EDID block reads to the response buffer Dmitry Osipenko <dmitry.osipenko(a)collabora.com> drm/virtio: Return proper error codes instead of -1 Thomas Zimmermann <tzimmermann(a)suse.de> drm/tegra: fbdev: Remove offset into framebuffer memory Jani Nikula <jani.nikula(a)intel.com> drm/displayid: fix Tiled Display Topology ID size Deepanshu Kartikey <kartikey406(a)gmail.com> drm/virtio: use uninterruptible resv lock for plane updates Christian König <christian.koenig(a)amd.com> dma-buf/drivers: make reserving a shared slot mandatory v4 Ashutosh Desai <ashutoshdesai993(a)gmail.com> drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers Ashutosh Desai <ashutoshdesai993(a)gmail.com> drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers Cen Zhang <zzzccc427(a)gmail.com> usb: gadget: f_tcm: synchronize delayed set_alt with teardown Ashutosh Desai <ashutoshdesai993(a)gmail.com> drm/dp/mst: fix buffer overflows in sideband chunk accumulation Venkatesh Srinivas <venkateshs(a)chromium.org> KVM: x86: Only reset TSC Deadline Timer in apic_timer_expired on KVM_RUN David Matlack <dmatlack(a)google.com> KVM: Introduce vcpu->wants_to_run Sean Christopherson <seanjc(a)google.com> KVM: x86: Move "apicv_active" into "struct kvm_lapic" Sean Christopherson <seanjc(a)google.com> KVM: x86: Check for in-kernel xAPIC when querying APICv for directed yield Sean Christopherson <seanjc(a)google.com> KVM: x86: Drop @vcpu parameter from kvm_x86_ops.hwapic_isr_update() Johan Hovold <johan(a)kernel.org> USB: serial: keyspan_pda: fix data loss on receive throttling Johan Hovold <johan(a)kernel.org> USB: serial: keyspan_pda: clean up comments and whitespace Johan Hovold <johan(a)kernel.org> USB: serial: keyspan_pda: add write-fifo support Johan Hovold <johan(a)kernel.org> USB: serial: keyspan_pda: fix write implementation Johan Hovold <johan(a)kernel.org> USB: serial: keyspan_pda: refactor write-room handling Fan Wu <fanwu01(a)zju.edu.cn> usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown Chunfeng Yun <chunfeng.yun(a)mediatek.com> usb: gadget: bdc: fix checkpatch.pl spacing error Reinette Chatre <reinette.chatre(a)intel.com> fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list Dawei Feng <dawei.feng(a)seu.edu.cn> octeontx2-pf: fix SQB pointer leak on init failure Haoxiang Li <haoxiang_li2024(a)163.com> net: ipa: fix SMEM state handle leaks in SMP2P init Sabrina Dubroca <sd(a)queasysnail.net> espintcp: use sk_msg_free_partial to fix partial send Breno Leitao <leitao(a)debian.org> bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline() Breno Leitao <leitao(a)debian.org> bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c Rasmus Villemoes <linux(a)rasmusvillemoes.dk> bootconfig: do not put quotes on cmdline items unless necessary Runyu Xiao <runyu.xiao(a)seu.edu.cn> gpio: tegra: do not call pinctrl for GPIO direction Bryam Vargas <hexlabsecurity(a)proton.me> net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked Vladimir Oltean <vladimir.oltean(a)nxp.com> net/sched: taprio: avoid calling child->ops->dequeue(child) twice Maoyi Xie <maoyixie.tju(a)gmail.com> net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink Maoyi Xie <maoyixie.tju(a)gmail.com> net: ipip: require CAP_NET_ADMIN in the device netns for changelink Liu Jian <liujian56(a)huawei.com> net: Add helper function to parse netlink msg of ip_tunnel_encap Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: ims-pcu - fix firmware leak in async update Dmitry Torokhov <dmitry.torokhov(a)gmail.com> firmware_loader: introduce __free() cleanup hanler Guangshuo Li <lgs201920130244(a)gmail.com> mmc: vub300: fix use-after-free on probe failure Johan Hovold <johan(a)kernel.org> mmc: vub300: rename probe error labels Johan Hovold <johan(a)kernel.org> mmc: vub300: fix use-after-free on disconnect Maoyi Xie <maoyixie.tju(a)gmail.com> wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: ims-pcu - fix race condition in reset_device sysfs callback Mikulas Patocka <mpatocka(a)redhat.com> dm-verity: make error counter atomic Mikulas Patocka <mpatocka(a)redhat.com> dm-integrity: don't increment hash_offset twice Bryam Vargas <hexlabsecurity(a)proton.me> scsi: target: Bound PR-OUT TransportID parsing to the received buffer Maurizio Lombardi <mlombard(a)redhat.com> scsi: target: core: Generate correct identifiers for PR OUT transport IDs Chaitanya Kulkarni <chaitanya.kulkarni(a)wdc.com> scsi: target: core: pr: Initialize arrays at declaration time Souvik Banerjee <souvik(a)amlalabs.com> ovl: use linked upper dentry in copy-up tmpfile Abdun Nihaal <nihaal(a)cse.iitm.ac.in> scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup() Michael Bommarito <michael.bommarito(a)gmail.com> thunderbolt: Prevent XDomain delayed work use-after-free on disconnect Mika Westerberg <mika.westerberg(a)linux.intel.com> thunderbolt: Remove XDomain from the bus without holding tb->lock Mika Westerberg <mika.westerberg(a)linux.intel.com> thunderbolt: Keep XDomain reference during the lifetime of a service Vincent Jardin <vjardin(a)free.fr> i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) Stefan Eichenberger <stefan.eichenberger(a)toradex.com> i2c: imx: separate atomic, dma and non-dma use case Frank Li <Frank.Li(a)nxp.com> dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK Frank Li <Frank.Li(a)nxp.com> dmaengine: dw-edma: Remove unused irq field in struct dw_edma_chip Gustavo Pimentel <Gustavo.Pimentel(a)synopsys.com> dmaengine: dw-edma: Improve the linked list and data blocks definition Gustavo Pimentel <Gustavo.Pimentel(a)synopsys.com> PCI: Add pci_find_vsec_capability() to find a specific VSEC Jarkko Sakkinen <jarkko(a)kernel.org> tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat() Fredric Cover <fredric.cover.lkernel(a)gmail.com> smb: client: use kvzalloc() for megabyte buffer in simple fallocate Miquel Raynal <miquel.raynal(a)bootlin.com> mtd: spi-nor: swp: Improve locking user experience Michael Walle <mwalle(a)kernel.org> mtd: spi-nor: Fix spi_nor_try_unlock_all() Tudor Ambarus <tudor.ambarus(a)microchip.com> mtd: spi-nor: Move Software Write Protection logic out of the core Michael Walle <michael(a)walle.cc> mtd: spi-nor: intel: remove global protection flag Michael Walle <michael(a)walle.cc> mtd: spi-nor: sst: remove global protection flag Yiyang Chen <cyyzero16(a)gmail.com> taskstats: retain dead thread stats in TGID queries Oleg Nesterov <oleg(a)redhat.com> taskstats: fill_stats_for_tgid: use for_each_thread() Maoyi Xie <maoyixie.tju(a)gmail.com> net: thunderbolt: Fix frags[] overflow by bounding frame_count Florian Fuchs <fuchsfl(a)gmail.com> mtd: maps: vmu-flash: fix fault in unaligned fixup Breno Leitao <leitao(a)debian.org> 9p: skip nlink update in cacheless mode to fix WARN_ON Vasiliy Kovalev <kovalev(a)altlinux.org> net/9p: fix infinite loop in p9_client_rpc on fatal signal Tristan Madani <tristan(a)talencesecurity.com> selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() Casey Schaufler <casey(a)schaufler-ca.com> lsm: infrastructure management of the sock security Ondrej Mosnacek <omosnace(a)redhat.com> lsm: use default hook return value in call_int_hook() Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo: don't leak bad clone into future transaction Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo: move cloning of match info to insert/removal path Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo: merge deactivate helper into caller Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo: prepare walk function for on-demand clone Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo: make pipapo_clone helper return NULL Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo: use GFP_KERNEL for insertions Junrui Luo <moonafterrain(a)outlook.com> jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit() Harshad Shirwadkar <harshadshirwadkar(a)gmail.com> jbd2: add a helper to find out number of fast commit blocks Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_conntrack_sip: validate skb_dst() before accessing it Florian Westphal <fw(a)strlen.de> netfilter: nf_conntrack_sip: remove net variable shadowing Runyu Xiao <runyu.xiao(a)seu.edu.cn> octeontx2-vf: clear stale mailbox IRQ state before request_irq() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: mediatek: mt8183: Check runtime resume during probe Runyu Xiao <runyu.xiao(a)seu.edu.cn> octeontx2-pf: clear stale mailbox IRQ state before request_irq() Subbaraya Sundeep <sbhatta(a)marvell.com> octeontx2: Annotate mmio regions as __iomem Wentao Liang <vulab(a)iscas.ac.cn> mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() Petr Machata <petrm(a)nvidia.com> mlxsw: spectrum: On port enslavement to a LAG, join upper's bridges Ido Schimmel <idosch(a)nvidia.com> mlxsw: spectrum: Apply RIF configuration when joining a LAG David Howells <dhowells(a)redhat.com> rxrpc: Fix socket notification race David Howells <dhowells(a)redhat.com> rxrpc: Fix notification vs call-release vs recvmsg David Howells <dhowells(a)redhat.com> rxrpc: Fix recv-recv race of completed call Li Xiasong <lixiasong1(a)huawei.com> tipc: restrict socket queue dumps in enqueue tracepoints Li Daming <d4n.for.sec(a)gmail.com> rxrpc: serialize kernel accept preallocation with socket teardown Tapio Reijonen <tapio.reijonen(a)vaisala.com> serial: max310x: implement gpio_chip::get_direction() Hugo Villeneuve <hvilleneuve(a)dimonoff.com> serial: max310x: replace bare use of 'unsigned' with 'unsigned int' (checkpatch) Xu Rao <raoxu(a)uniontech.com> ALSA: hda: Fix cached processing coefficient verbs Ricardo Robaina <rrobaina(a)redhat.com> audit: fix recursive locking deadlock in audit_dupe_exe() Ricardo Robaina <rrobaina(a)redhat.com> audit: use 'unsigned int' instead of 'unsigned' Jeff Layton <jlayton(a)kernel.org> audit: widen ino fields to u64 NeilBrown <neil(a)brown.name> VFS/audit: introduce kern_path_parent() for audit Bryam Vargas <hexlabsecurity(a)proton.me> Input: mms114 - reject an oversized device packet size Zhenhao Wan <whi4ed0g(a)gmail.com> RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg Akhil R <akhilrajeev(a)nvidia.com> i2c: smbus: Use device_*() functions instead of of_*() Akhil R <akhilrajeev(a)nvidia.com> device property: Add fwnode_irq_get_byname Haoxiang Li <haoxiang_li2024(a)163.com> i2c: davinci: Unregister cpufreq notifier on probe failure Sebastian Alba Vives <sebasjosue84(a)gmail.com> fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() Mikhail Gavrilov <mikhail.v.gavrilov(a)gmail.com> dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning Jason Gunthorpe <jgg(a)ziepe.ca> udmabuf: Do not create malformed scatterlists Matt Bobrowski <mattbobrowski(a)google.com> bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized Chao Yu <chao(a)kernel.org> f2fs: fix UAF issue in f2fs_merge_page_bio() Xiang Mei <xmei5(a)asu.edu> net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot Christoph Hellwig <hch(a)lst.de> xfs: check v5 superblock features early David Rosca <david.rosca(a)amd.com> drm/amdgpu: Fix UVD decode image min size calculation David Rosca <david.rosca(a)amd.com> drm/amdgpu: Implement insert_end for VCE 3 David Rosca <david.rosca(a)amd.com> drm/amdgpu: Reject UVD message with dimensions above 4096 Candice Li <candice.li(a)amd.com> drm/amdgpu: validate GEM_CREATE domain combinations David Rosca <david.rosca(a)amd.com> drm/amdgpu: Reject UVD message with invalid number of h265 refs Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Fix out of bounds check on CCW array Guangshuo Li <lgs201920130244(a)gmail.com> drm/radeon: fix autosuspend cleanup during teardown Pei Xiao <xiaopei01(a)kylinos.cn> mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition Haibo Chen <haibo.chen(a)nxp.com> mmc: sdhci: make tuning_err a signed int Myeonghun Pak <mhun512(a)gmail.com> mmc: sdhci: unmap the bounce buffer before device release Zhan Xusheng <zhanxusheng1024(a)gmail.com> mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit Yiming Zhu <zhuyiming(a)kuaishou.com> ceph: fix MDS random selection readiness predicate Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Avoid using invalid osd indices from primary_temp Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: sur40 - fix V4L error path cleanup Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: sur40 - fix input device registration ordering Ali Ahmet Memis <ali(a)iusegentoo.com> openrisc: signal: do not restore privileged SR bits on sigreturn Josh Poimboeuf <jpoimboe(a)kernel.org> ftrace: Fix off-by-one fentry site disable in ftrace_free_mem() Pavitra Jha <jhapavitra98(a)gmail.com> libceph: fix multiple unsafe decodes in decode_locker() Thorsten Blum <thorsten.blum(a)linux.dev> crypto: qce - fix error path in devm_qce_register_algs Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: synaptics-rmi4 - block s_input when F54 queue is busy Bryam Vargas <hexlabsecurity(a)proton.me> Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: synaptics-rmi4 - zero report size on F54 work error George Wilson <gcwilson(a)linux.ibm.com> powerpc/pseries: lparcfg - fix kbuf[] underflow Pengpeng Hou <pengpeng(a)iscas.ac.cn> Input: iforce - validate input packet lengths Zhefu Zhang <a723356(a)gmail.com> Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard Linmao Li <lilinmao(a)kylinos.cn> Input: psxpad-spi - set driver data before use Richard Davies <richard(a)arachsys.com> Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: synaptics-rmi4 - fix F55 transmitter electrode count typo George Wilson <gcwilson(a)linux.ibm.com> powerpc/pseries: pci - logic bug Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: cs4265: sort the register default table Hidayath Khan <hidayath(a)linux.ibm.com> s390/qeth: validate user buffer length in SNMP and ARP query ioctls Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: options: reset DSS fields in case of unexpected size Bryam Vargas <hexlabsecurity(a)proton.me> selinux: do not cancel a policy conversion that never started Bryam Vargas <hexlabsecurity(a)proton.me> selinux: reject a class permission count below its inherited common Bryam Vargas <hexlabsecurity(a)proton.me> selinux: require every boolean value to be defined Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> ipvs: separate destination availability state Jiasheng Jiang <jiashengjiangcool(a)gmail.com> media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization Fullway Wang <fullwaywang(a)outlook.com> media: mtk-vcodec: potential null pointer deference in SCP ------------- Diffstat: Makefile | 4 +- arch/arm64/boot/dts/nvidia/tegra194.dtsi | 2 + arch/arm64/kvm/arm.c | 2 +- arch/mips/kvm/mips.c | 2 +- arch/openrisc/include/asm/processor.h | 2 + arch/openrisc/kernel/signal.c | 5 +- arch/powerpc/kvm/powerpc.c | 2 +- arch/powerpc/platforms/pseries/lparcfg.c | 2 +- arch/powerpc/platforms/pseries/pci.c | 2 +- arch/s390/kvm/kvm-s390.c | 2 +- arch/x86/include/asm/kvm_host.h | 3 +- arch/x86/kernel/cpu/resctrl/rdtgroup.c | 12 +- arch/x86/kvm/lapic.c | 41 +- arch/x86/kvm/lapic.h | 3 +- arch/x86/kvm/svm/avic.c | 4 +- arch/x86/kvm/svm/svm.h | 2 +- arch/x86/kvm/vmx/vmx.c | 9 +- arch/x86/kvm/x86.c | 19 +- crypto/ccm.c | 2 +- drivers/base/property.c | 29 ++ drivers/char/tpm/tpm_tis_core.c | 38 +- drivers/crypto/qce/core.c | 2 +- drivers/dma-buf/dma-resv.c | 8 +- drivers/dma-buf/udmabuf.c | 21 +- drivers/dma/dw-edma/dw-edma-core.c | 77 ++-- drivers/dma/dw-edma/dw-edma-core.h | 20 +- drivers/dma/dw-edma/dw-edma-pcie.c | 180 ++++++-- drivers/dma/dw-edma/dw-edma-v0-core.c | 76 ++-- drivers/fpga/dfl-afu-main.c | 3 + drivers/gpio/gpio-tegra.c | 18 +- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 21 + drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 11 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 2 +- drivers/gpu/drm/amd/amdgpu/vce_v3_0.c | 26 +- drivers/gpu/drm/amd/pm/amdgpu_pm.c | 14 +- drivers/gpu/drm/drm_connector.c | 12 +- drivers/gpu/drm/drm_dp_mst_topology.c | 32 +- drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c | 2 +- drivers/gpu/drm/i915/display/intel_hdcp.c | 7 +- drivers/gpu/drm/i915/i915_vma.c | 2 +- drivers/gpu/drm/lima/lima_gem.c | 2 +- drivers/gpu/drm/msm/msm_gem_submit.c | 2 +- drivers/gpu/drm/nouveau/nouveau_fence.c | 2 +- drivers/gpu/drm/qxl/qxl_release.c | 2 +- drivers/gpu/drm/radeon/radeon_kms.c | 1 + drivers/gpu/drm/radeon/radeon_vm.c | 2 +- drivers/gpu/drm/tegra/fb.c | 8 +- drivers/gpu/drm/ttm/ttm_bo.c | 4 +- drivers/gpu/drm/ttm/ttm_execbuf_util.c | 4 +- drivers/gpu/drm/vc4/vc4_gem.c | 2 +- drivers/gpu/drm/vgem/vgem_fence.c | 2 +- drivers/gpu/drm/virtio/virtgpu_drv.h | 1 + drivers/gpu/drm/virtio/virtgpu_gem.c | 17 + drivers/gpu/drm/virtio/virtgpu_plane.c | 5 +- drivers/gpu/drm/virtio/virtgpu_vq.c | 9 +- drivers/hwmon/npcm750-pwm-fan.c | 11 + drivers/i2c/busses/i2c-bcm-iproc.c | 11 +- drivers/i2c/busses/i2c-davinci.c | 4 +- drivers/i2c/busses/i2c-imx.c | 126 +++-- drivers/i2c/i2c-core-base.c | 2 +- drivers/i2c/i2c-core-smbus.c | 15 +- drivers/i2c/i2c-smbus.c | 5 +- drivers/infiniband/ulp/rtrs/rtrs-srv.c | 5 +- drivers/input/joystick/iforce/iforce-packets.c | 11 +- drivers/input/joystick/iforce/iforce-usb.c | 3 + drivers/input/joystick/psxpad-spi.c | 1 + drivers/input/keyboard/atkbd.c | 8 + drivers/input/misc/ims-pcu.c | 7 +- drivers/input/mouse/focaltech.c | 2 +- drivers/input/rmi4/rmi_f54.c | 43 +- drivers/input/rmi4/rmi_f55.c | 4 +- drivers/input/touchscreen/mms114.c | 6 + drivers/input/touchscreen/sur40.c | 23 +- drivers/md/dm-integrity.c | 4 - drivers/md/dm-verity-target.c | 12 +- drivers/md/dm-verity.h | 2 +- drivers/media/i2c/imx219.c | 47 +- drivers/media/platform/aspeed-video.c | 1 + drivers/media/platform/marvell-ccic/cafe-driver.c | 1 + .../media/platform/mtk-vcodec/mtk_vcodec_fw_scp.c | 5 + drivers/media/v4l2-core/v4l2-async.c | 8 +- drivers/media/v4l2-core/v4l2-fwnode.c | 7 +- drivers/mmc/host/atmel-mci.c | 2 + drivers/mmc/host/omap_hsmmc.c | 2 +- drivers/mmc/host/sdhci.c | 16 + drivers/mmc/host/sdhci.h | 2 +- drivers/mmc/host/vub300.c | 36 +- drivers/mtd/maps/vmu-flash.c | 8 +- drivers/mtd/spi-nor/Makefile | 2 +- drivers/mtd/spi-nor/core.c | 406 +---------------- drivers/mtd/spi-nor/core.h | 5 + drivers/mtd/spi-nor/intel.c | 16 +- drivers/mtd/spi-nor/sst.c | 30 +- drivers/mtd/spi-nor/swp.c | 426 +++++++++++++++++ drivers/net/can/usb/gs_usb.c | 2 +- drivers/net/ethernet/aquantia/atlantic/aq_ring.c | 25 + drivers/net/ethernet/aquantia/atlantic/aq_ring.h | 1 + drivers/net/ethernet/aquantia/atlantic/aq_vec.c | 2 +- drivers/net/ethernet/intel/ice/ice_ethtool.c | 10 +- drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c | 48 ++ .../net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 13 +- .../net/ethernet/marvell/octeontx2/nic/otx2_vf.c | 8 +- drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 109 ++++- drivers/net/ethernet/mellanox/mlxsw/spectrum.h | 4 + .../net/ethernet/mellanox/mlxsw/spectrum_router.c | 31 +- drivers/net/ethernet/ti/am65-cpsw-nuss.c | 139 ++++-- drivers/net/ethernet/ti/am65-cpsw-nuss.h | 4 + drivers/net/ipa/ipa_smp2p.c | 30 +- drivers/net/thunderbolt.c | 8 +- drivers/net/wireless/ath/ath6kl/txrx.c | 2 +- .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 13 + .../net/wireless/broadcom/brcm80211/brcmfmac/bus.h | 6 + .../wireless/broadcom/brcm80211/brcmfmac/core.c | 45 +- .../wireless/broadcom/brcm80211/brcmfmac/pcie.c | 6 + .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 6 + .../wireless/broadcom/brcm80211/brcmfmac/sdio.h | 1 + .../net/wireless/broadcom/brcm80211/brcmfmac/usb.c | 3 + drivers/net/wireless/marvell/libertas_tf/main.c | 2 +- drivers/pci/pci.c | 30 ++ drivers/s390/cio/vfio_ccw_cp.c | 17 +- drivers/s390/net/qeth_core_main.c | 3 + drivers/s390/net/qeth_l3_main.c | 5 + drivers/scsi/lpfc/lpfc_init.c | 3 +- drivers/scsi/scsi_debug.c | 27 +- drivers/scsi/sd.h | 5 +- drivers/scsi/sd_zbc.c | 79 +++- drivers/target/target_core_fabric_lib.c | 146 ++++-- drivers/target/target_core_internal.h | 5 +- drivers/target/target_core_pr.c | 54 +-- drivers/thunderbolt/domain.c | 30 ++ drivers/thunderbolt/icm.c | 5 + drivers/thunderbolt/switch.c | 14 + drivers/thunderbolt/tb.c | 58 +-- drivers/thunderbolt/tb.h | 2 + drivers/thunderbolt/xdomain.c | 71 ++- drivers/tty/serial/8250/8250_mid.c | 6 +- drivers/tty/serial/max310x.c | 20 +- drivers/tty/serial/sc16is7xx.c | 192 ++++++-- drivers/usb/gadget/function/f_tcm.c | 192 ++++++-- drivers/usb/gadget/function/tcm.h | 13 + drivers/usb/gadget/udc/bdc/bdc_core.c | 20 + drivers/usb/gadget/udc/bdc/bdc_udc.c | 7 +- drivers/usb/serial/keyspan_pda.c | 471 ++++++++++--------- fs/9p/vfs_inode.c | 9 + fs/binfmt_elf.c | 4 +- fs/binfmt_elf_fdpic.c | 4 +- fs/binfmt_misc.c | 14 +- fs/ceph/addr.c | 24 +- fs/ceph/cache.c | 2 +- fs/ceph/caps.c | 53 ++- fs/ceph/dir.c | 20 +- fs/ceph/export.c | 10 +- fs/ceph/file.c | 33 +- fs/ceph/inode.c | 20 +- fs/ceph/ioctl.c | 8 +- fs/ceph/mds_client.c | 11 + fs/ceph/mds_client.h | 2 + fs/ceph/mdsmap.c | 2 +- fs/ceph/super.c | 22 +- fs/ceph/super.h | 8 +- fs/ceph/xattr.c | 8 +- fs/cifs/smb2ops.c | 4 +- fs/exec.c | 6 +- fs/f2fs/data.c | 2 +- fs/jbd2/journal.c | 10 +- fs/namei.c | 42 ++ fs/overlayfs/copy_up.c | 14 +- fs/super.c | 19 +- fs/xfs/libxfs/xfs_sb.c | 4 +- include/drm/drm_connector.h | 6 +- include/drm/drm_displayid.h | 2 +- include/linux/audit.h | 18 +- include/linux/bootconfig.h | 3 + include/linux/bpf_lsm.h | 4 + include/linux/ceph/ceph_debug.h | 38 ++ include/linux/dma-resv.h | 2 +- include/linux/dma/edma.h | 2 - include/linux/firmware.h | 3 + include/linux/fs.h | 28 ++ include/linux/i2c-smbus.h | 6 +- include/linux/jbd2.h | 9 +- include/linux/kvm_host.h | 1 + include/linux/lsm_hooks.h | 1 + include/linux/namei.h | 1 + include/linux/pci.h | 1 + include/linux/property.h | 1 + include/linux/skbuff.h | 2 + include/linux/thunderbolt.h | 3 + include/media/v4l2-async.h | 9 +- include/net/act_api.h | 20 + include/net/ip_tunnels.h | 3 + include/net/ip_vs.h | 7 + include/trace/events/rxrpc.h | 2 + include/uapi/linux/ip_vs.h | 6 - init/main.c | 39 -- kernel/audit.c | 2 +- kernel/audit.h | 32 +- kernel/audit_fsnotify.c | 39 +- kernel/audit_tree.c | 2 +- kernel/audit_watch.c | 42 +- kernel/auditfilter.c | 17 +- kernel/auditsc.c | 6 +- kernel/bpf/bpf_inode_storage.c | 10 + kernel/sched/psi.c | 6 + kernel/taskstats.c | 67 +-- kernel/trace/ftrace.c | 21 +- lib/bootconfig.c | 65 +++ lib/compat_audit.c | 12 +- mm/memory_hotplug.c | 15 +- mm/pagewalk.c | 8 + mm/ptdump.c | 7 + net/9p/client.c | 2 + net/bluetooth/hidp/core.c | 25 +- net/ceph/cls_lock_client.c | 21 +- net/ceph/osdmap.c | 9 +- net/core/pktgen.c | 43 +- net/core/skbuff.c | 28 +- net/ipv4/ip_tunnel_core.c | 35 ++ net/ipv4/ipip.c | 41 +- net/ipv6/ip6_tunnel.c | 40 +- net/ipv6/sit.c | 38 +- net/mptcp/options.c | 21 +- net/mptcp/protocol.c | 4 +- net/mptcp/protocol.h | 14 + net/mptcp/subflow.c | 12 +- net/netfilter/ipset/ip_set_core.c | 19 +- net/netfilter/ipset/ip_set_list_set.c | 7 +- net/netfilter/ipvs/ip_vs_conn.c | 4 +- net/netfilter/ipvs/ip_vs_core.c | 6 +- net/netfilter/ipvs/ip_vs_ctl.c | 4 +- net/netfilter/ipvs/ip_vs_dh.c | 4 +- net/netfilter/ipvs/ip_vs_lblc.c | 2 +- net/netfilter/ipvs/ip_vs_lblcr.c | 8 +- net/netfilter/nf_conntrack_sip.c | 10 +- net/netfilter/nf_flow_table_core.c | 7 +- net/netfilter/nf_tables_offload.c | 2 +- net/netfilter/nft_set_pipapo.c | 252 ++++++---- net/netfilter/nft_set_pipapo.h | 8 + net/packet/af_packet.c | 7 +- net/rxrpc/call_accept.c | 28 +- net/rxrpc/call_object.c | 27 +- net/rxrpc/recvmsg.c | 23 +- net/sched/act_gact.c | 5 + net/sched/act_police.c | 6 + net/sched/sch_api.c | 24 +- net/sched/sch_taprio.c | 12 +- net/sctp/protocol.c | 20 +- net/sctp/sysctl.c | 9 +- net/smc/af_smc.c | 3 +- net/smc/smc_rx.c | 12 +- net/smc/smc_tx.c | 17 +- net/tipc/socket.c | 6 +- net/xfrm/espintcp.c | 32 +- security/apparmor/include/net.h | 6 +- security/apparmor/lsm.c | 38 +- security/bpf/hooks.c | 3 + security/security.c | 506 +++++++++++++-------- security/selinux/hooks.c | 91 ++-- security/selinux/include/objsec.h | 5 + security/selinux/netlabel.c | 23 +- security/selinux/ss/policydb.c | 31 ++ security/selinux/ss/services.c | 4 +- security/smack/smack.h | 5 + security/smack/smack_lsm.c | 66 ++- security/smack/smack_netfilter.c | 8 +- sound/core/seq/seq_timer.c | 13 +- sound/hda/hdac_regmap.c | 4 +- sound/soc/codecs/cs4265.c | 4 +- sound/soc/mediatek/mt8183/mt8183-afe-pcm.c | 12 +- sound/soc/xilinx/xlnx_formatter_pcm.c | 10 +- sound/usb/usx2y/usX2Yhwdep.c | 10 +- sound/usb/usx2y/usbus428ctldefs.h | 2 + sound/usb/usx2y/usbusx2y.c | 2 +- sound/usb/usx2y/usx2yhwdeppcm.c | 15 +- virt/kvm/kvm_main.c | 3 + 276 files changed, 4340 insertions(+), 2447 deletions(-)

7 hours, 17 minutes

Payment Notification - SWIFT Copy Attached

by Accounting Dept

PDF SWIFT_PAYMENT_MT103_01.pdf 672 KB ▼   ↑ 1 attachment (672 KB)   ▼ Payment Notification Good day, Payment has been processed for the outstanding invoices. The SWIFT copy is attached for your reference. Please click here to view. Thank you, Accounts Department

1 day, 4 hours

Payment Notification - SWIFT Copy Attached

by Virtru Notifications

admin(a)ugasaf.org

1 day, 8 hours

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

Lkft-triage