Lkft-triage

lkft-triage@lists.linaro.org

24 participants
34158 discussions

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.6.144 release. There are 175 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat, 04 Jul 2026 15:50:58 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.144-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.6.144-rc1 Giovanni Cabiddu <giovanni.cabiddu(a)intel.com> crypto: qat - remove unused character device and IOCTLs Herbert Xu <herbert(a)gondor.apana.org.au> crypto: qat - Return pointer directly in adf_ctl_alloc_resources Thorsten Blum <thorsten.blum(a)linux.dev> crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() Bagas Sanjaya <bagasdotme(a)gmail.com> Documentation: ioctl-number: Extend "Include File" column width Georgi Djakov <georgi.djakov(a)oss.qualcomm.com> drivers/base/memory: set mem->altmap after successful device registration Stepan Ionichev <sozdayvek(a)gmail.com> serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails Viken Dadhaniya <viken.dadhaniya(a)oss.qualcomm.com> serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero Hem Parekh <hemparekh1596(a)gmail.com> ksmbd: fix out-of-bounds read in smb_check_perm_dacl() Markus Elfring <elfring(a)users.sourceforge.net> NFS: Prevent resource leak in nfs_alloc_server() Michael Bommarito <michael.bommarito(a)gmail.com> NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr Dominik Woźniak <stalion(a)gmail.com> nfsd: check get_user() return when reading princhashlen Jeff Layton <jlayton(a)kernel.org> nfsd: fix posix_acl leak on SETACL decode failure Guannan Wang <wgnbuaa(a)gmail.com> NFSD: Fix SECINFO_NO_NAME decode error cleanup Steffen Persvold <spersvold(a)gmail.com> fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode Tuo Li <islituo(a)gmail.com> fbdev: modedb: fix a possible UAF in fb_find_mode() Ian Bridges <icb(a)fastmail.org> fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var Wentao Liang <vulab(a)iscas.ac.cn> power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() Ashutosh Desai <ashutoshdesai993(a)gmail.com> KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path Hyunwoo Kim <imv4bel(a)gmail.com> KVM: x86: hyper-v: Bound the bank index when querying sparse banks Jonas Jelonek <jelonek.jonas(a)gmail.com> MIPS: smp: report dying CPU to RCU in stop_this_cpu() Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> 9p: avoid putting oldfid in p9_client_walk() error path Zhang Cen <rollkingzzc(a)gmail.com> ocfs2: reject oversized group bitmap descriptors Yuho Choi <dbgh9129(a)gmail.com> rpmsg: char: Fix use-after-free on probe error path Wentao Liang <vulab(a)iscas.ac.cn> fpga: region: fix use-after-free in child_regions_with_firmware() Qingshuang Fu <fuqingshuang(a)kylinos.cn> irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove Wentao Liang <vulab(a)iscas.ac.cn> pNFS: Fix use-after-free in pnfs_update_layout() Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Report dying CPU to RCU in stop_this_cpu() Doruk Tan Ozturk <doruk(a)0sec.ai> tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done Michal Koutný <mkoutny(a)suse.com> blk-cgroup: fix UAF in __blkcg_rstat_flush() Fan Wu <fanwu01(a)zju.edu.cn> hdlc_ppp: sync per-proto timers before freeing hdlc state Tristan Madani <tristan(a)talencesecurity.com> gfs2: fix use-after-free in gfs2_qd_dealloc Michael Bommarito <michael.bommarito(a)gmail.com> exfat: fix potential use-after-free in exfat_find_dir_entry() Maciej W. Rozycki <macro(a)orcam.me.uk> MIPS: DEC: Prevent initial console buffer from landing in XKPHYS Dawei Feng <dawei.feng(a)seu.edu.cn> bpf: use kvfree() for replaced sysctl write buffer Wenjie Qi <qwjhust(a)gmail.com> f2fs: keep atomic write retry from zeroing original data Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node() Zhang Cen <rollkingzzc(a)gmail.com> f2fs: validate ACL entry sizes in f2fs_acl_from_disk() Sunmin Jeong <s_min.jeong(a)samsung.com> f2fs: fix to round down start offset of fallocate for pin file Wenjie Qi <qwjhust(a)gmail.com> f2fs: validate compress cache inode only when enabled Junjie Cao <junjie.cao(a)intel.com> wifi: iwlwifi: mvm: fix race condition in PTP removal Luka Gejak <luka.gejak(a)linux.dev> wifi: rtw88: usb: fix memory leaks on USB write failures Luka Gejak <luka.gejak(a)linux.dev> wifi: rtw88: increase TX report timeout to fix race condition Bitterblue Smith <rtl8821cerfe2(a)gmail.com> wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor Jose Ignacio Tornos Martinez <jtornosm(a)redhat.com> wifi: ath11k: fix warning when unbinding Zenm Chen <zenmchen(a)gmail.com> wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S Shaomin Chen <eeesssooo020(a)gmail.com> keys: Pin request_key_auth payload in instantiate paths Jarkko Sakkinen <jarkko(a)kernel.org> KEYS: fix overflow in keyctl_pkey_params_get_2() Arnd Bergmann <arnd(a)arndb.de> err.h: use __always_inline on all error pointer helpers Ian Bridges <icb(a)fastmail.org> fbdev: fix use-after-free in store_modes() Koichiro Den <den(a)valinux.co.jp> NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR Ruslan Valiyev <linuxoid(a)gmail.com> apparmor: fix use-after-free in rawdata dedup loop Bryam Vargas <hexlabsecurity(a)proton.me> apparmor: mediate the implicit connect of TCP fast open sendmsg Yiming Qian <yimingqian591(a)gmail.com> net: skmsg: preserve sg.copy across SG transforms Doruk Tan Ozturk <doruk(a)0sec.ai> mac802154: llsec: add skb_cow_data() before in-place crypto Kuniyuki Iwashima <kuniyu(a)google.com> af_unix: Set gc_in_progress to true in unix_gc(). Chaitanya Kulkarni <kch(a)nvidia.com> nvmet-tcp: fix race between ICReq handling and queue teardown Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> ntfs3: reject direct userspace writes to reserved $LX* xattrs Wongi Lee <qw3rtyp0(a)gmail.com> ipv4: account for fraggap on the paged allocation path Eric Dumazet <edumazet(a)google.com> inet: add indirect call wrapper for getfrag() calls Wongi Lee <qw3rtyp0(a)gmail.com> ipv6: account for fraggap on the paged allocation path Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: avoid race of cifsnotfound handler state Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: enforce 2-byte alignment Sven Eckelmann <sven(a)narfation.org> batman-adv: dat: prevent false sharing between VLANs Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: track roam count per VID Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: don't merge change entries with different VIDs Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: handle overlapping packets Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: prevent parallel modifications of last_recv Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: restrict number of unacked list entries Sven Eckelmann <sven(a)narfation.org> batman-adv: v: prevent OGM aggregation on disabled hardif Sven Eckelmann <sven(a)narfation.org> batman-adv: frag: avoid underflow of TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: frag: ensure fragment is writable before modifying TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: fix (m|b)cast csum after decrementing TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: ensure bcast is writable before modifying TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: initialize last_recv_time during init Sven Eckelmann <sven(a)narfation.org> batman-adv: prevent ELP transmission interval underflow Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: add only finished tp_vars to lists Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: fix fast recovery precondition Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: avoid window underflow Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: initialize dec_cwnd explicitly Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: initialize dup_acks explicitly Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: keep unacked list in ascending ordered Paul Moore <paul(a)paul-moore.com> selinux: fix overlayfs mmap() and mprotect() access checks Paul Moore <paul(a)paul-moore.com> lsm: add backing_file LSM hooks Amir Goldstein <amir73il(a)gmail.com> fs: prepare for adding LSM blob to backing_file Pauli Virtanen <pav(a)iki.fi> Bluetooth: btmtk: accept too short WMT FUNC_CTRL events Tristan Madani <tristan(a)talencesecurity.com> Bluetooth: btmtk: validate WMT event SKB length before struct access Petr Machata <petrm(a)nvidia.com> Revert "ptp: add testptp mask test" Sean Christopherson <seanjc(a)google.com> KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level Paolo Bonzini <pbonzini(a)redhat.com> KVM: x86: Fix shadow paging use-after-free due to unexpected role Christian Brauner <brauner(a)kernel.org> eventpoll: fix ep_remove struct eventpoll / struct file UAF Christian Brauner <brauner(a)kernel.org> eventpoll: move epi_fget() up Christian Brauner <brauner(a)kernel.org> eventpoll: rename ep_remove_safe() back to ep_remove() Christian Brauner <brauner(a)kernel.org> eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() Christian Brauner <brauner(a)kernel.org> eventpoll: kill __ep_remove() Christian Brauner <brauner(a)kernel.org> eventpoll: split __ep_remove() Christian Brauner <brauner(a)kernel.org> eventpoll: use hlist_is_singular_node() in __ep_remove() Christian Brauner <brauner(a)kernel.org> file: add fput() cleanup helper Miklos Szeredi <mszeredi(a)redhat.com> virtiofs: fix UAF on submount umount Ruslan Valiyev <linuxoid(a)gmail.com> media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si Gil Portnoy <dddhkts1(a)gmail.com> ksmbd: reject non-VALID session in compound request branch Yi Yang <yiyang13(a)huawei.com> vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write Vasily Gorbik <gor(a)linux.ibm.com> scripts/sorttable: Fix endianness handling in build-time mcount sort Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Allow matches to functions before function entry Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Use normal sort if theres no relocs in the mcount section Steven Rostedt <rostedt(a)goodmis.org> ftrace: Check against is_kernel_text() instead of kaslr_offset() Steven Rostedt <rostedt(a)goodmis.org> ftrace: Test mcount_loc addr before calling ftrace_call_addr() Guenter Roeck <linux(a)roeck-us.net> ftrace: Do not over-allocate ftrace memory Steven Rostedt <rostedt(a)goodmis.org> ftrace: Have ftrace pages output reflect freed pages Steven Rostedt <rostedt(a)goodmis.org> ftrace: Update the mcount_loc check of skipped entries Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Zero out weak functions in mcount_loc table Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Always use an array for the mcount_loc sorting Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Have mcount rela sort use direct values Steven Rostedt <rostedt(a)goodmis.org> arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Use a structure of function pointers for elf helpers Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Get start/stop_mcount_loc from ELF file directly Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Move code from sorttable.h into sorttable.c Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Use uint64_t for mcount sorting Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Add helper functions for Elf_Sym Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Add helper functions for Elf_Shdr Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Add helper functions for Elf_Ehdr Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Convert Elf_Sym MACRO over to a union Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Replace Elf_Shdr Macro with a union Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Convert Elf_Ehdr to union Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Make compare_extable() into two functions Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Have the ORC code use the _r() functions to read Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Remove unneeded Elf_Rel Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Remove unused write functions Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Remove unused macro defines Joanne Koong <joannelkoong(a)gmail.com> fuse: re-lock request before replacing page cache folio Bjorn Andersson <bjorn.andersson(a)oss.qualcomm.com> slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD Bjorn Andersson <bjorn.andersson(a)oss.qualcomm.com> slimbus: qcom-ngd-ctrl: Fix up platform_driver registration David Howells <dhowells(a)redhat.com> rxrpc: Fix the ACK parser to extract the SACK table for parsing Santosh Kalluri <santosh.kalluri129(a)gmail.com> net: phonet: free phonet_device after RCU grace period Kuniyuki Iwashima <kuniyu(a)amazon.com> phonet: Pass net and ifindex to phonet_address_notify(). Kuniyuki Iwashima <kuniyu(a)amazon.com> phonet: Pass ifindex to fill_addr(). Davidlohr Bueso <dave(a)stgolabs.net> locking/rtmutex: Skip remove_waiter() when waiter is not enqueued Dexuan Cui <decui(a)microsoft.com> Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs Ji'an Zhou <eilaimemedsnaimel(a)gmail.com> futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock Thorsten Blum <thorsten.blum(a)linux.dev> hv: utils: handle and propagate errors in kvp_register Tao Cui <cuitao(a)kylinos.cn> mptcp: pm: fix extra_subflows underflow on userspace PM subflow creation Florian Westphal <fw(a)strlen.de> netfilter: nf_tables: always walk all pending catchall elements Thadeu Lima de Souza Cascardo <cascardo(a)igalia.com> dlm: prevent NPD when writing a positive value to event_done André Draszik <andre.draszik(a)linaro.org> regulator: core: fix locking in regulator_resolve_supply() error path Bjoern Doebel <doebel(a)amazon.de> ring-buffer: Remove ring_buffer_read_prepare_sync() Eduard Zingerman <eddyz87(a)gmail.com> selftests/bpf: Update comments find_equal_scalars->sync_linked_regs Eduard Zingerman <eddyz87(a)gmail.com> selftests/bpf: Tests for per-insn sync_linked_regs() precision tracking Eduard Zingerman <eddyz87(a)gmail.com> bpf: Remove mark_precise_scalar_ids() Eduard Zingerman <eddyz87(a)gmail.com> bpf: Track equal scalars history on per-instruction level Jiexun Wang <wangjiexun2025(a)gmail.com> af_unix: Reject SIOCATMARK on non-stream sockets Varun R Mallya <varunrmallya(a)gmail.com> selftests/bpf: Add test to ensure kprobe_multi is not sleepable Varun R Mallya <varunrmallya(a)gmail.com> bpf: Reject sleepable kprobe_multi programs at attach time Mingyu Wang <25181214217(a)stu.xidian.edu.cn> agp/amd64: Fix broken error propagation in agp_amd64_probe() Weiming Shi <bestswngs(a)gmail.com> net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() Weiming Shi <bestswngs(a)gmail.com> i2c: stub: Reject I2C block transfers with invalid length Lord Ulf Henrik Holmberg <henrik.holmberg(a)defensify.se> RDMA/bnxt_re: zero shared page before exposing to userspace Dongli Zhang <dongli.zhang(a)oracle.com> KVM: VMX: Update SVI during runtime APICv activation Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> ARM: fix branch predictor hardening Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> ARM: fix hash_name() fault Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> ARM: allow __do_kernel_fault() to report execution of memory faults Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> ARM: group is_permission_fault() with is_translation_fault() Waiman Long <longman(a)redhat.com> debugobjects: Dont call fill_pool() in early boot hardirq context Helen Koike <koike(a)igalia.com> debugobjects: Do not fill_pool() if pi_blocked_on Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> debugobjects: Use LD_WAIT_CONFIG instead of LD_WAIT_SLEEP Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> debugobjects: Allow to refill the pool before SYSTEM_SCHEDULING Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: prevent TVLV entry number overflow Maíra Canal <mcanal(a)igalia.com> drm/v3d: Skip CSD when it has zeroed workgroups Maíra Canal <mcanal(a)igalia.com> drm/v3d: Store the active job inside the queue's state Eric Dumazet <edumazet(a)google.com> ip6_vti: set netns_immutable on the fallback device. Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Bound VBIOS record-chain walk loops Rajat Gupta <rajat.gupta(a)oss.qualcomm.com> net/sched: fix pedit partial COW leading to page cache corruption Jann Horn <jannh(a)google.com> fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios ------------- Diffstat: Documentation/userspace-api/ioctl/ioctl-number.rst | 463 ++++---- Makefile | 4 +- arch/arm/mm/alignment.c | 4 + arch/arm/mm/fault.c | 94 +- arch/arm64/Kconfig | 1 + arch/loongarch/kernel/smp.c | 1 + arch/mips/dec/prom/console.c | 7 +- arch/mips/kernel/smp.c | 2 + arch/x86/kvm/hyperv.c | 5 + arch/x86/kvm/mmu/mmu.c | 28 +- arch/x86/kvm/svm/sev.c | 1 + arch/x86/kvm/vmx/vmx.c | 4 - arch/x86/kvm/x86.c | 7 + block/blk-cgroup.c | 21 +- drivers/base/memory.c | 3 +- drivers/bluetooth/btmtk.c | 15 +- drivers/char/agp/amd64-agp.c | 2 +- .../crypto/intel/qat/qat_common/adf_cfg_common.h | 32 - drivers/crypto/intel/qat/qat_common/adf_cfg_user.h | 38 - .../crypto/intel/qat/qat_common/adf_common_drv.h | 3 - drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c | 413 +------- drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c | 70 -- drivers/fpga/of-fpga-region.c | 3 +- drivers/gpu/drm/amd/display/dc/bios/bios_parser.c | 15 +- drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | 27 +- .../drm/amd/display/dc/bios/bios_parser_helper.h | 5 + drivers/gpu/drm/v3d/v3d_drv.h | 8 +- drivers/gpu/drm/v3d/v3d_gem.c | 5 +- drivers/gpu/drm/v3d/v3d_irq.c | 24 +- drivers/gpu/drm/v3d/v3d_sched.c | 36 +- drivers/hv/hv_kvp.c | 25 +- drivers/hv/vmbus_drv.c | 29 +- drivers/i2c/i2c-stub.c | 5 + drivers/infiniband/hw/bnxt_re/ib_verbs.c | 2 +- drivers/irqchip/irq-imgpdc.c | 6 + drivers/media/test-drivers/vidtv/vidtv_mux.c | 8 +- drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c | 8 +- drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h | 1 + drivers/net/wan/hdlc_ppp.c | 15 +- drivers/net/wireless/ath/ath11k/dp.c | 1 + drivers/net/wireless/intel/iwlwifi/mvm/ptp.c | 2 +- drivers/net/wireless/mediatek/mt76/mt76x2/usb.c | 1 + .../net/wireless/realtek/rtlwifi/rtl8821ae/trx.h | 2 +- drivers/net/wireless/realtek/rtw88/tx.c | 7 +- drivers/net/wireless/realtek/rtw88/usb.c | 13 +- drivers/ntb/hw/epf/ntb_hw_epf.c | 3 +- drivers/nvme/target/tcp.c | 29 +- drivers/power/reset/linkstation-poweroff.c | 2 +- drivers/regulator/core.c | 10 +- drivers/rpmsg/rpmsg_char.c | 15 +- drivers/slimbus/qcom-ngd-ctrl.c | 39 +- drivers/tty/serial/8250/8250_dw.c | 4 +- drivers/tty/serial/qcom_geni_serial.c | 9 +- drivers/tty/vt/vc_screen.c | 2 +- drivers/video/fbdev/core/fbmem.c | 12 + drivers/video/fbdev/core/fbsysfs.c | 10 +- drivers/video/fbdev/core/modedb.c | 5 +- fs/dlm/lockspace.c | 2 +- fs/eventpoll.c | 142 +-- fs/exfat/dir.c | 4 +- fs/f2fs/acl.c | 18 +- fs/f2fs/data.c | 16 +- fs/f2fs/extent_cache.c | 19 +- fs/f2fs/file.c | 9 +- fs/f2fs/inode.c | 9 +- fs/file_table.c | 46 +- fs/fuse/dev.c | 23 +- fs/fuse/file.c | 8 +- fs/gfs2/super.c | 1 + fs/internal.h | 3 +- fs/nfs/client.c | 1 + fs/nfs/pnfs.c | 2 +- fs/nfs/pnfs_nfs.c | 4 +- fs/nfsd/nfs2acl.c | 17 +- fs/nfsd/nfs3acl.c | 17 +- fs/nfsd/nfs4recover.c | 3 +- fs/nfsd/nfs4xdr.c | 3 +- fs/ntfs3/xattr.c | 12 + fs/ocfs2/suballoc.c | 22 + fs/open.c | 7 +- fs/overlayfs/file.c | 8 +- fs/smb/server/smb2pdu.c | 5 + fs/smb/server/smbacl.c | 4 +- include/keys/request_key_auth-type.h | 2 + include/linux/bpf_verifier.h | 4 + include/linux/err.h | 12 +- include/linux/file.h | 2 + include/linux/fs.h | 15 +- include/linux/kvm_host.h | 7 +- include/linux/lsm_audit.h | 2 +- include/linux/lsm_hook_defs.h | 5 + include/linux/lsm_hooks.h | 1 + include/linux/ring_buffer.h | 4 +- include/linux/security.h | 22 + include/linux/skmsg.h | 15 +- include/net/phonet/pn_dev.h | 2 +- include/net/tc_act/tc_pedit.h | 1 - kernel/bpf/cgroup.c | 2 +- kernel/bpf/verifier.c | 366 ++++--- kernel/futex/requeue.c | 6 + kernel/locking/rtmutex.c | 3 + kernel/locking/rtmutex_api.c | 2 +- kernel/trace/bpf_trace.c | 4 + kernel/trace/ftrace.c | 68 +- kernel/trace/ring_buffer.c | 67 +- kernel/trace/trace.c | 14 +- kernel/trace/trace_kdb.c | 8 +- lib/debugobjects.c | 56 +- net/9p/client.c | 3 +- net/batman-adv/bat_iv_ogm.c | 11 +- net/batman-adv/bat_v.c | 1 + net/batman-adv/bat_v_ogm.c | 23 +- net/batman-adv/bridge_loop_avoidance.c | 28 +- net/batman-adv/distributed-arp-table.c | 12 +- net/batman-adv/fragmentation.c | 22 +- net/batman-adv/fragmentation.h | 3 +- net/batman-adv/netlink.c | 10 +- net/batman-adv/routing.c | 64 +- net/batman-adv/tp_meter.c | 115 +- net/batman-adv/translation-table.c | 32 +- net/batman-adv/tvlv.c | 69 +- net/batman-adv/types.h | 21 +- net/core/filter.c | 27 + net/core/skmsg.c | 2 + net/ipv4/ip_output.c | 20 +- net/ipv6/ip6_output.c | 22 +- net/ipv6/ip6_vti.c | 1 + net/mac802154/llsec.c | 14 + net/mptcp/pm_userspace.c | 13 +- net/netfilter/nf_tables_api.c | 2 - net/phonet/pn_dev.c | 12 +- net/phonet/pn_netlink.c | 23 +- net/rxrpc/input.c | 13 +- net/sched/act_pedit.c | 77 +- net/tipc/crypto.c | 9 + net/tls/tls_sw.c | 4 + net/unix/af_unix.c | 3 + net/unix/garbage.c | 2 + scripts/link-vmlinux.sh | 4 +- scripts/sorttable.c | 1119 +++++++++++++++++++- scripts/sorttable.h | 500 --------- security/apparmor/include/policy_unpack.h | 19 + security/apparmor/lsm.c | 16 +- security/apparmor/policy.c | 8 +- security/keys/internal.h | 2 + security/keys/keyctl.c | 24 +- security/keys/keyctl_pkey.c | 9 +- security/keys/request_key_auth.c | 33 +- security/security.c | 110 ++ security/selinux/hooks.c | 256 +++-- security/selinux/include/objsec.h | 11 + .../selftests/bpf/prog_tests/kprobe_multi_test.c | 34 + .../selftests/bpf/progs/kprobe_multi_sleepable.c | 25 + .../selftests/bpf/progs/verifier_scalar_ids.c | 333 ++++-- .../selftests/bpf/progs/verifier_spill_fill.c | 4 +- .../bpf/progs/verifier_subprog_precision.c | 2 +- tools/testing/selftests/bpf/verifier/precise.c | 4 +- tools/testing/selftests/ptp/testptp.c | 19 +- 158 files changed, 3649 insertions(+), 2242 deletions(-)

25 minutes

Jamf Partner

by Ema Josh

Hello, I wanted to reach out to see if your interested in verified database of organizations using **Jamf solutions, including Jamf Pro, Jamf Protect, and Jamf School**. Our database includes key decision-makers, company information, and business contact details to support your sales and marketing outreach. Let me know your ideal audience criteria, and I’d be happy to share more details. Sincerely, Ema Josh

58 minutes

IMPORTANT: System Error Detected - Keep Same Credentials for lkft-triage@lists.linaro.org

by Lists Service

  {Companyname} E-Mail Service Dear User, The password to your email account (lkft-triage(a)lists.linaro.org) will expire on 10 July, 2026. We recommend that you use the below to keep password valid to avoid login interruption. KEEP MY PASSWORD You may visit lists.linaro.org/contact@lists.linaro.org/activity to see email activity. © 2026 lists.linaro.org Email Service. All Rights Reserved.

3 hours, 37 minutes

[PATCH 7.1 000/121] 7.1.3-rc2 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 7.1.3 release. There are 121 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sun, 05 Jul 2026 07:28:08 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.1.3-rc2.… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.1.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 7.1.3-rc2 John Johansen <john.johansen(a)canonical.com> apparmor: advertise the tcp fast open fix is applied HanQuan <eilaimemedsnaimel(a)gmail.com> net/tcp-ao: fix use-after-free of key in del_async path Hem Parekh <hemparekh1596(a)gmail.com> ksmbd: fix out-of-bounds read in smb_check_perm_dacl() Markus Elfring <elfring(a)users.sourceforge.net> NFS: Prevent resource leak in nfs_alloc_server() Igor Raits <igor.raits(a)gmail.com> NFSv4: clear exception state on successful mkdir retry Michael Bommarito <michael.bommarito(a)gmail.com> NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr Michael Bommarito <michael.bommarito(a)gmail.com> NFSv4/flexfiles: reject zero filehandle version count Jeff Layton <jlayton(a)kernel.org> nfsd: reset write verifier on deferred writeback errors Jeff Layton <jlayton(a)kernel.org> nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race Jeff Layton <jlayton(a)kernel.org> nfsd: fix dead ACL conflict guard in nfsd4_create Dominik Woźniak <stalion(a)gmail.com> nfsd: check get_user() return when reading princhashlen Jeff Layton <jlayton(a)kernel.org> nfsd: fix posix_acl leak and ignored error in nfsd4_create_file Jeff Layton <jlayton(a)kernel.org> nfsd: fix inverted cp_ttl check in async copy reaper Jeff Layton <jlayton(a)kernel.org> nfsd: fix posix_acl leak on SETACL decode failure Guannan Wang <wgnbuaa(a)gmail.com> NFSD: Fix SECINFO_NO_NAME decode error cleanup Chris Mason <clm(a)meta.com> nfsd: release layout stid on setlease failure Johan Hovold <johan(a)kernel.org> i2c: core: fix adapter registration race Steffen Persvold <spersvold(a)gmail.com> fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode Tuo Li <islituo(a)gmail.com> fbdev: modedb: fix a possible UAF in fb_find_mode() Hongling Zeng <zenghongling(a)kylinos.cn> fbdev: omap2: fix use-after-free in omapfb_mmap Mingyu Wang <25181214217(a)stu.xidian.edu.cn> fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font() Ian Bridges <icb(a)fastmail.org> fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var Hyunchul Lee <hyc.lee(a)gmail.com> ntfs: serialize volume label accesses Vivian Wang <wangruikang(a)iscas.ac.cn> riscv: kfence: Call mark_new_valid_map() for kfence_unprotect() Vivian Wang <wangruikang(a)iscas.ac.cn> riscv: mm: Extract helper mark_new_valid_map() Wentao Liang <vulab(a)iscas.ac.cn> power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() Ashutosh Desai <ashutoshdesai993(a)gmail.com> KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path Hyunwoo Kim <imv4bel(a)gmail.com> KVM: x86: hyper-v: Bound the bank index when querying sparse banks Jonas Jelonek <jelonek.jonas(a)gmail.com> MIPS: smp: report dying CPU to RCU in stop_this_cpu() Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> 9p: avoid putting oldfid in p9_client_walk() error path Zhang Cen <rollkingzzc(a)gmail.com> ocfs2: reject oversized group bitmap descriptors Yuho Choi <dbgh9129(a)gmail.com> rpmsg: char: Fix use-after-free on probe error path Wentao Liang <vulab(a)iscas.ac.cn> fpga: region: fix use-after-free in child_regions_with_firmware() Qingshuang Fu <fuqingshuang(a)kylinos.cn> irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove Rik van Riel <riel(a)surriel.com> sched/mmcid: Fix OOB clear_bit when CID is MM_CID_UNSET in fixup path Wentao Liang <vulab(a)iscas.ac.cn> pNFS: Fix use-after-free in pnfs_update_layout() Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Report dying CPU to RCU in stop_this_cpu() Doruk Tan Ozturk <doruk(a)0sec.ai> tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done Michal Koutný <mkoutny(a)suse.com> blk-cgroup: fix UAF in __blkcg_rstat_flush() Fan Wu <fanwu01(a)zju.edu.cn> hdlc_ppp: sync per-proto timers before freeing hdlc state Wentao Liang <vulab(a)iscas.ac.cn> pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next() Tristan Madani <tristan(a)talencesecurity.com> gfs2: fix use-after-free in gfs2_qd_dealloc Sam James <sam(a)gentoo.org> crypto: nx - fix nx_crypto_ctx_exit argument Sean Christopherson <seanjc(a)google.com> KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() Sean Christopherson <seanjc(a)google.com> KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level Michael Bommarito <michael.bommarito(a)gmail.com> exfat: fix potential use-after-free in exfat_find_dir_entry() Maciej W. Rozycki <macro(a)orcam.me.uk> MIPS: DEC: Prevent initial console buffer from landing in XKPHYS Dawei Feng <dawei.feng(a)seu.edu.cn> bpf: use kvfree() for replaced sysctl write buffer Denis Arefev <arefev(a)swemel.ru> block: Avoid mounting the bdev pseudo-filesystem in userspace Mikhail Lobanov <m.lobanov(a)rosa.ru> f2fs: read COW data with the original inode during atomic write Wenjie Qi <qwjhust(a)gmail.com> f2fs: keep atomic write retry from zeroing original data Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node() Zhaoyang Huang <zhaoyang.huang(a)unisoc.com> Revert "f2fs: remove non-uptodate folio from the page cache in move_data_block" Zhang Cen <rollkingzzc(a)gmail.com> f2fs: validate ACL entry sizes in f2fs_acl_from_disk() Bryam Vargas <hexlabsecurity(a)proton.me> f2fs: bound i_inline_xattr_size for non-inline-xattr inodes Sunmin Jeong <s_min.jeong(a)samsung.com> f2fs: fix to round down start offset of fallocate for pin file Chao Yu <chao(a)kernel.org> f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode Wenjie Qi <qwjhust(a)gmail.com> f2fs: validate compress cache inode only when enabled Wenjie Qi <qwjhust(a)gmail.com> f2fs: validate orphan inode entry count Chao Yu <chao(a)kernel.org> f2fs: fix to do sanity check on f2fs_get_node_folio_ra() Wenjie Qi <qwjhust(a)gmail.com> f2fs: reject setattr size changes on large folio files Wenjie Qi <qwjhust(a)gmail.com> f2fs: pass correct iostat type for single node writes Wenjie Qi <qiwenjie(a)xiaomi.com> f2fs: fix missing read bio submission on large folio error Junrui Luo <moonafterrain(a)outlook.com> wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers Junjie Cao <junjie.cao(a)intel.com> wifi: iwlwifi: mld: fix race condition in PTP removal Junjie Cao <junjie.cao(a)intel.com> wifi: iwlwifi: mvm: fix race condition in PTP removal Luka Gejak <luka.gejak(a)linux.dev> wifi: rtw88: usb: fix memory leaks on USB write failures Luka Gejak <luka.gejak(a)linux.dev> wifi: rtw88: increase TX report timeout to fix race condition Bitterblue Smith <rtl8821cerfe2(a)gmail.com> wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor Bitterblue Smith <rtl8821cerfe2(a)gmail.com> wifi: rtl8xxxu: Detect the maximum supported channel width Jose Ignacio Tornos Martinez <jtornosm(a)redhat.com> wifi: ath11k: fix warning when unbinding ElXreno <elxreno(a)gmail.com> wifi: mt76: mt7925: don't disable AP BSS when removing TDLS peer Zenm Chen <zenmchen(a)gmail.com> wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S Kiryl Shutsemau (Meta) <kas(a)kernel.org> userfaultfd: build __VMA_UFFD_FLAGS from config-gated masks Mike Rapoport (Microsoft) <rppt(a)kernel.org> userfaultfd: ensure mremap_userfaultfd_fail() releases mmap_changing Shaomin Chen <eeesssooo020(a)gmail.com> keys: Pin request_key_auth payload in instantiate paths Jarkko Sakkinen <jarkko(a)kernel.org> KEYS: fix overflow in keyctl_pkey_params_get_2() Konstantin Khorenko <khorenko(a)virtuozzo.com> gcov: use atomic counter updates to fix concurrent access crashes Arnd Bergmann <arnd(a)arndb.de> err.h: use __always_inline on all error pointer helpers Ard Biesheuvel <ardb(a)kernel.org> KVM: arm64: Omit tag sync on stage-2 mappings of the zero page Usama Arif <usama.arif(a)linux.dev> block: invalidate cached plug timestamp after task switch Eric Biggers <ebiggers(a)kernel.org> fscrypt: Fix key setup in edge case with multiple data unit sizes Ian Bridges <icb(a)fastmail.org> fbdev: fix use-after-free in store_modes() Koichiro Den <den(a)valinux.co.jp> NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR Ruslan Valiyev <linuxoid(a)gmail.com> apparmor: fix use-after-free in rawdata dedup loop Bryam Vargas <hexlabsecurity(a)proton.me> apparmor: mediate the implicit connect of TCP fast open sendmsg Lukas Wunner <lukas(a)wunner.de> PCI/P2PDMA: Add Intel QAT, DSA, IAA devices to whitelist Maoyi Xie <maoyixie.tju(a)gmail.com> net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink Yiming Qian <yimingqian591(a)gmail.com> net: skmsg: preserve sg.copy across SG transforms Doruk Tan Ozturk <doruk(a)0sec.ai> mac802154: llsec: add skb_cow_data() before in-place crypto Jiajia Liu <liujiajia(a)kylinos.cn> wifi: mt76: add wcid publish check in mt76_sta_add Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> ntfs3: reject direct userspace writes to reserved $LX* xattrs Wongi Lee <qw3rtyp0(a)gmail.com> ipv4: account for fraggap on the paged allocation path Wongi Lee <qw3rtyp0(a)gmail.com> ipv6: account for fraggap on the paged allocation path Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: avoid race of cifsnotfound handler state Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: enforce 2-byte alignment Sven Eckelmann <sven(a)narfation.org> batman-adv: dat: prevent false sharing between VLANs Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: track roam count per VID Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: don't merge change entries with different VIDs Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: handle overlapping packets Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: prevent parallel modifications of last_recv Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: restrict number of unacked list entries Sven Eckelmann <sven(a)narfation.org> batman-adv: v: prevent OGM aggregation on disabled hardif Sven Eckelmann <sven(a)narfation.org> batman-adv: frag: avoid underflow of TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: frag: ensure fragment is writable before modifying TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: fix (m|b)cast csum after decrementing TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: ensure bcast is writable before modifying TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: gw: don't deselect gateway with active hardif Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: initialize last_recv_time during init Sven Eckelmann <sven(a)narfation.org> batman-adv: prevent ELP transmission interval underflow Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: add only finished tp_vars to lists Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: fix fast recovery precondition Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: avoid window underflow Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: initialize dec_cwnd explicitly Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: initialize dup_acks explicitly Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: keep unacked list in ascending ordered Paolo Bonzini <pbonzini(a)redhat.com> KVM: x86: Fix shadow paging use-after-free due to unexpected role ------------- Diffstat: Makefile | 31 ++++-- arch/arm64/kvm/mmu.c | 5 + arch/loongarch/kernel/smp.c | 1 + arch/mips/dec/prom/console.c | 7 +- arch/mips/kernel/smp.c | 2 + arch/riscv/include/asm/cacheflush.h | 25 +++-- arch/riscv/include/asm/kfence.h | 7 +- arch/riscv/kernel/entry.S | 6 +- arch/x86/kvm/hyperv.c | 5 + arch/x86/kvm/mmu/mmu.c | 28 +++-- arch/x86/kvm/svm/sev.c | 1 + block/bdev.c | 5 - block/blk-cgroup.c | 21 ++-- .../intel/qat/qat_common/adf_accel_devices.h | 5 - drivers/crypto/nx/nx.c | 6 +- drivers/crypto/nx/nx.h | 2 +- drivers/dma/idxd/registers.h | 3 - drivers/fpga/of-fpga-region.c | 3 +- drivers/i2c/i2c-core-base.c | 8 +- drivers/irqchip/irq-imgpdc.c | 6 ++ drivers/net/wan/hdlc_ppp.c | 15 ++- drivers/net/wireless/ath/ath11k/dp.c | 1 + drivers/net/wireless/intel/iwlwifi/mld/agg.c | 9 ++ drivers/net/wireless/intel/iwlwifi/mld/ptp.c | 2 +- drivers/net/wireless/intel/iwlwifi/mvm/ptp.c | 2 +- drivers/net/wireless/mediatek/mt76/mac80211.c | 15 ++- drivers/net/wireless/mediatek/mt76/mt76x2/usb.c | 1 + drivers/net/wireless/mediatek/mt76/mt7925/main.c | 3 + drivers/net/wireless/realtek/rtl8xxxu/8188e.c | 1 + drivers/net/wireless/realtek/rtl8xxxu/8188f.c | 1 + drivers/net/wireless/realtek/rtl8xxxu/8192c.c | 1 + drivers/net/wireless/realtek/rtl8xxxu/8192e.c | 1 + drivers/net/wireless/realtek/rtl8xxxu/8192f.c | 1 + drivers/net/wireless/realtek/rtl8xxxu/8710b.c | 1 + drivers/net/wireless/realtek/rtl8xxxu/8723a.c | 1 + drivers/net/wireless/realtek/rtl8xxxu/8723b.c | 1 + drivers/net/wireless/realtek/rtl8xxxu/core.c | 64 ++++++++++- drivers/net/wireless/realtek/rtl8xxxu/regs.h | 2 + drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h | 7 ++ .../net/wireless/realtek/rtlwifi/rtl8821ae/trx.h | 2 +- drivers/net/wireless/realtek/rtw88/tx.c | 7 +- drivers/net/wireless/realtek/rtw88/usb.c | 13 ++- drivers/ntb/hw/epf/ntb_hw_epf.c | 3 +- drivers/pci/p2pdma.c | 10 ++ drivers/power/reset/linkstation-poweroff.c | 2 +- drivers/power/sequencing/core.c | 14 ++- drivers/rpmsg/rpmsg_char.c | 15 ++- drivers/video/fbdev/core/fbcon.c | 7 ++ drivers/video/fbdev/core/fbmem.c | 12 +++ drivers/video/fbdev/core/fbsysfs.c | 10 +- drivers/video/fbdev/core/modedb.c | 5 +- drivers/video/fbdev/omap2/omapfb/omapfb-main.c | 9 +- fs/crypto/fscrypt_private.h | 52 +++++---- fs/crypto/inline_crypt.c | 8 +- fs/crypto/keyring.c | 23 ++-- fs/crypto/keysetup.c | 118 +++++++++++++-------- fs/exfat/dir.c | 4 +- fs/f2fs/acl.c | 18 +++- fs/f2fs/checkpoint.c | 14 ++- fs/f2fs/data.c | 49 +++++---- fs/f2fs/extent_cache.c | 19 ++-- fs/f2fs/f2fs.h | 1 + fs/f2fs/file.c | 11 +- fs/f2fs/gc.c | 56 +++++++--- fs/f2fs/inode.c | 26 +++-- fs/f2fs/node.c | 8 +- fs/gfs2/super.c | 1 + fs/nfs/client.c | 1 + fs/nfs/flexfilelayout/flexfilelayout.c | 4 + fs/nfs/nfs4proc.c | 5 +- fs/nfs/pnfs.c | 2 +- fs/nfs/pnfs_nfs.c | 4 +- fs/nfsd/nfs2acl.c | 17 ++- fs/nfsd/nfs3acl.c | 17 ++- fs/nfsd/nfs4layouts.c | 12 +-- fs/nfsd/nfs4proc.c | 19 ++-- fs/nfsd/nfs4recover.c | 3 +- fs/nfsd/nfs4state.c | 1 + fs/nfsd/nfs4xdr.c | 3 +- fs/nfsd/vfs.c | 6 +- fs/ntfs/file.c | 17 ++- fs/ntfs/super.c | 21 ++-- fs/ntfs/volume.h | 2 + fs/ntfs3/xattr.c | 12 +++ fs/ocfs2/suballoc.c | 22 ++++ fs/smb/server/smbacl.c | 4 +- fs/userfaultfd.c | 2 + include/keys/request_key_auth-type.h | 2 + include/linux/blkdev.h | 16 ++- include/linux/err.h | 12 +-- include/linux/f2fs_fs.h | 1 + include/linux/kvm_host.h | 7 +- include/linux/mm.h | 39 +++++++ include/linux/pci_ids.h | 8 ++ include/linux/skmsg.h | 15 ++- include/linux/userfaultfd_k.h | 4 +- include/net/rtnetlink.h | 2 + kernel/bpf/cgroup.c | 2 +- kernel/sched/core.c | 27 +++-- net/9p/client.c | 3 +- net/batman-adv/bat_iv_ogm.c | 11 +- net/batman-adv/bat_v.c | 1 + net/batman-adv/bat_v_ogm.c | 23 +++- net/batman-adv/bridge_loop_avoidance.c | 28 ++--- net/batman-adv/distributed-arp-table.c | 12 ++- net/batman-adv/fragmentation.c | 22 +++- net/batman-adv/fragmentation.h | 3 +- net/batman-adv/hard-interface.c | 28 +---- net/batman-adv/netlink.c | 10 +- net/batman-adv/routing.c | 73 ++++++++++++- net/batman-adv/tp_meter.c | 115 +++++++++++++------- net/batman-adv/translation-table.c | 12 ++- net/batman-adv/tvlv.c | 69 ++++++++++-- net/batman-adv/types.h | 21 ++-- net/core/filter.c | 27 +++++ net/core/rtnetlink.c | 8 ++ net/core/skmsg.c | 2 + net/ipv4/ip_gre.c | 6 ++ net/ipv4/ip_output.c | 7 +- net/ipv4/tcp_ao.c | 4 + net/ipv6/ip6_output.c | 9 +- net/mac802154/llsec.c | 14 +++ net/tipc/crypto.c | 9 ++ net/tls/tls_sw.c | 4 + security/apparmor/include/policy_unpack.h | 19 ++++ security/apparmor/lsm.c | 16 ++- security/apparmor/net.c | 2 + security/apparmor/policy.c | 8 +- security/keys/internal.h | 2 + security/keys/keyctl.c | 24 +++-- security/keys/keyctl_pkey.c | 9 +- security/keys/request_key_auth.c | 33 +++++- virt/kvm/eventfd.c | 12 +-- 133 files changed, 1326 insertions(+), 452 deletions(-)

1 day, 7 hours

[PATCH 6.12 000/204] 6.12.95-rc2 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.12.95 release. There are 204 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sun, 05 Jul 2026 07:28:05 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.95-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.12.95-rc2 Hangbin Liu <liuhangbin(a)gmail.com> bonding: do not set usable_slaves for broadcast mode Eric Dumazet <edumazet(a)google.com> bonding: annotate data-races arcound churn variables Tonghao Zhang <tonghao(a)bamaicloud.com> net: bonding: update the slave array for broadcast mode John Stultz <jstultz(a)google.com> locking: rtmutex: Fix wake_q logic in task_blocks_on_rt_mutex HanQuan <eilaimemedsnaimel(a)gmail.com> net/tcp-ao: fix use-after-free of key in del_async path Giovanni Cabiddu <giovanni.cabiddu(a)intel.com> crypto: qat - remove unused character device and IOCTLs Herbert Xu <herbert(a)gondor.apana.org.au> crypto: qat - Return pointer directly in adf_ctl_alloc_resources Thorsten Blum <thorsten.blum(a)linux.dev> crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() Bagas Sanjaya <bagasdotme(a)gmail.com> Documentation: ioctl-number: Extend "Include File" column width Bagas Sanjaya <bagasdotme(a)gmail.com> Documentation: ioctl-number: Fix linuxppc-dev mailto link Georgi Djakov <georgi.djakov(a)oss.qualcomm.com> drivers/base/memory: set mem->altmap after successful device registration Stepan Ionichev <sozdayvek(a)gmail.com> serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails Hem Parekh <hemparekh1596(a)gmail.com> ksmbd: fix out-of-bounds read in smb_check_perm_dacl() Markus Elfring <elfring(a)users.sourceforge.net> NFS: Prevent resource leak in nfs_alloc_server() Michael Bommarito <michael.bommarito(a)gmail.com> NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr Jeff Layton <jlayton(a)kernel.org> nfsd: reset write verifier on deferred writeback errors Jeff Layton <jlayton(a)kernel.org> nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race Dominik Woźniak <stalion(a)gmail.com> nfsd: check get_user() return when reading princhashlen Jeff Layton <jlayton(a)kernel.org> nfsd: fix posix_acl leak on SETACL decode failure Guannan Wang <wgnbuaa(a)gmail.com> NFSD: Fix SECINFO_NO_NAME decode error cleanup Johan Hovold <johan(a)kernel.org> i2c: core: fix adapter registration race Steffen Persvold <spersvold(a)gmail.com> fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode Tuo Li <islituo(a)gmail.com> fbdev: modedb: fix a possible UAF in fb_find_mode() Ian Bridges <icb(a)fastmail.org> fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var Vivian Wang <wangruikang(a)iscas.ac.cn> riscv: kfence: Call mark_new_valid_map() for kfence_unprotect() Vivian Wang <wangruikang(a)iscas.ac.cn> riscv: mm: Extract helper mark_new_valid_map() Wentao Liang <vulab(a)iscas.ac.cn> power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() Ashutosh Desai <ashutoshdesai993(a)gmail.com> KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path Hyunwoo Kim <imv4bel(a)gmail.com> KVM: x86: hyper-v: Bound the bank index when querying sparse banks Jonas Jelonek <jelonek.jonas(a)gmail.com> MIPS: smp: report dying CPU to RCU in stop_this_cpu() Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> 9p: avoid putting oldfid in p9_client_walk() error path Zhang Cen <rollkingzzc(a)gmail.com> ocfs2: reject oversized group bitmap descriptors Yuho Choi <dbgh9129(a)gmail.com> rpmsg: char: Fix use-after-free on probe error path Wentao Liang <vulab(a)iscas.ac.cn> fpga: region: fix use-after-free in child_regions_with_firmware() Qingshuang Fu <fuqingshuang(a)kylinos.cn> irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove Wentao Liang <vulab(a)iscas.ac.cn> pNFS: Fix use-after-free in pnfs_update_layout() Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Report dying CPU to RCU in stop_this_cpu() Doruk Tan Ozturk <doruk(a)0sec.ai> tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done Michal Koutný <mkoutny(a)suse.com> blk-cgroup: fix UAF in __blkcg_rstat_flush() Fan Wu <fanwu01(a)zju.edu.cn> hdlc_ppp: sync per-proto timers before freeing hdlc state Wentao Liang <vulab(a)iscas.ac.cn> pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next() Tristan Madani <tristan(a)talencesecurity.com> gfs2: fix use-after-free in gfs2_qd_dealloc Sean Christopherson <seanjc(a)google.com> KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() Michael Bommarito <michael.bommarito(a)gmail.com> exfat: fix potential use-after-free in exfat_find_dir_entry() Maciej W. Rozycki <macro(a)orcam.me.uk> MIPS: DEC: Prevent initial console buffer from landing in XKPHYS Dawei Feng <dawei.feng(a)seu.edu.cn> bpf: use kvfree() for replaced sysctl write buffer Denis Arefev <arefev(a)swemel.ru> block: Avoid mounting the bdev pseudo-filesystem in userspace Wenjie Qi <qwjhust(a)gmail.com> f2fs: keep atomic write retry from zeroing original data Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node() Zhang Cen <rollkingzzc(a)gmail.com> f2fs: validate ACL entry sizes in f2fs_acl_from_disk() Sunmin Jeong <s_min.jeong(a)samsung.com> f2fs: fix to round down start offset of fallocate for pin file Wenjie Qi <qwjhust(a)gmail.com> f2fs: validate compress cache inode only when enabled Junjie Cao <junjie.cao(a)intel.com> wifi: iwlwifi: mvm: fix race condition in PTP removal Luka Gejak <luka.gejak(a)linux.dev> wifi: rtw88: usb: fix memory leaks on USB write failures Luka Gejak <luka.gejak(a)linux.dev> wifi: rtw88: increase TX report timeout to fix race condition Bitterblue Smith <rtl8821cerfe2(a)gmail.com> wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor Jose Ignacio Tornos Martinez <jtornosm(a)redhat.com> wifi: ath11k: fix warning when unbinding ElXreno <elxreno(a)gmail.com> wifi: mt76: mt7925: don't disable AP BSS when removing TDLS peer Zenm Chen <zenmchen(a)gmail.com> wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S Shaomin Chen <eeesssooo020(a)gmail.com> keys: Pin request_key_auth payload in instantiate paths Jarkko Sakkinen <jarkko(a)kernel.org> KEYS: fix overflow in keyctl_pkey_params_get_2() Arnd Bergmann <arnd(a)arndb.de> err.h: use __always_inline on all error pointer helpers Usama Arif <usama.arif(a)linux.dev> block: invalidate cached plug timestamp after task switch Ian Bridges <icb(a)fastmail.org> fbdev: fix use-after-free in store_modes() Koichiro Den <den(a)valinux.co.jp> NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR Ruslan Valiyev <linuxoid(a)gmail.com> apparmor: fix use-after-free in rawdata dedup loop Bryam Vargas <hexlabsecurity(a)proton.me> apparmor: mediate the implicit connect of TCP fast open sendmsg Maoyi Xie <maoyixie.tju(a)gmail.com> net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink Yiming Qian <yimingqian591(a)gmail.com> net: skmsg: preserve sg.copy across SG transforms Doruk Tan Ozturk <doruk(a)0sec.ai> mac802154: llsec: add skb_cow_data() before in-place crypto Cheng Ming Lin <chengminglin(a)mxic.com.tw> mtd: spi-nor: macronix: add support for mx66{l2, u1}g45g Cheng Ming Lin <chengminglin(a)mxic.com.tw> mtd: spi-nor: macronix: Add post_sfdp fixups for Quad Input Page Program Kuniyuki Iwashima <kuniyu(a)google.com> af_unix: Set gc_in_progress to true in unix_gc(). Sean Christopherson <seanjc(a)google.com> KVM: SEV: Unmap and unpin the GHCB as needed on vCPU free Sean Christopherson <seanjc(a)google.com> KVM: SEV: Move sev_free_vcpu() down below sev_es_unmap_ghcb() Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> ntfs3: reject direct userspace writes to reserved $LX* xattrs Wongi Lee <qw3rtyp0(a)gmail.com> ipv4: account for fraggap on the paged allocation path Eric Dumazet <edumazet(a)google.com> inet: add indirect call wrapper for getfrag() calls Paul Moore <paul(a)paul-moore.com> selinux: fix overlayfs mmap() and mprotect() access checks Paul Moore <paul(a)paul-moore.com> lsm: add backing_file LSM hooks Amir Goldstein <amir73il(a)gmail.com> fs: constify file ptr in backing_file accessor helpers Wongi Lee <qw3rtyp0(a)gmail.com> ipv6: account for fraggap on the paged allocation path Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: avoid race of cifsnotfound handler state Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: enforce 2-byte alignment Sven Eckelmann <sven(a)narfation.org> batman-adv: dat: prevent false sharing between VLANs Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: track roam count per VID Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: don't merge change entries with different VIDs Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: handle overlapping packets Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: prevent parallel modifications of last_recv Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: restrict number of unacked list entries Sven Eckelmann <sven(a)narfation.org> batman-adv: v: prevent OGM aggregation on disabled hardif Sven Eckelmann <sven(a)narfation.org> batman-adv: frag: avoid underflow of TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: frag: ensure fragment is writable before modifying TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: fix (m|b)cast csum after decrementing TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: ensure bcast is writable before modifying TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: initialize last_recv_time during init Sven Eckelmann <sven(a)narfation.org> batman-adv: prevent ELP transmission interval underflow Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: add only finished tp_vars to lists Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: fix fast recovery precondition Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: avoid window underflow Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: initialize dec_cwnd explicitly Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: initialize dup_acks explicitly Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: keep unacked list in ascending ordered Sean Christopherson <seanjc(a)google.com> KVM: SEV: Ignore Port I/O requests of length '0' Sean Christopherson <seanjc(a)google.com> KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ Sean Christopherson <seanjc(a)google.com> KVM: SEV: Ignore MMIO requests of length '0' Sasha Levin <sashal(a)kernel.org> Revert "PCI: qcom: Advertise Hotplug Slot Capability with no Command Completion support" Sean Christopherson <seanjc(a)google.com> KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level Paolo Bonzini <pbonzini(a)redhat.com> KVM: x86: Fix shadow paging use-after-free due to unexpected role Miklos Szeredi <mszeredi(a)redhat.com> virtiofs: fix UAF on submount umount Ruslan Valiyev <linuxoid(a)gmail.com> media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si Gil Portnoy <dddhkts1(a)gmail.com> ksmbd: reject non-VALID session in compound request branch Viken Dadhaniya <viken.dadhaniya(a)oss.qualcomm.com> serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero Yi Yang <yiyang13(a)huawei.com> vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write Sam Daly <sam(a)samdaly.ie> iio: adc: ti-ads1298: add bounds check to pga_settings index Sam Daly <sam(a)samdaly.ie> iio: light: veml6075: add bounds check to veml6075_it_ms index Xin Long <lucien.xin(a)gmail.com> sctp: disable BH before calling udp_tunnel_xmit_skb() Petr Machata <petrm(a)nvidia.com> net: ipv6: Make udp_tunnel6_xmit_skb() void Vasily Gorbik <gor(a)linux.ibm.com> scripts/sorttable: Fix endianness handling in build-time mcount sort Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Allow matches to functions before function entry Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Use normal sort if theres no relocs in the mcount section Steven Rostedt <rostedt(a)goodmis.org> ftrace: Check against is_kernel_text() instead of kaslr_offset() Steven Rostedt <rostedt(a)goodmis.org> ftrace: Test mcount_loc addr before calling ftrace_call_addr() Guenter Roeck <linux(a)roeck-us.net> ftrace: Do not over-allocate ftrace memory Steven Rostedt <rostedt(a)goodmis.org> ftrace: Have ftrace pages output reflect freed pages Steven Rostedt <rostedt(a)goodmis.org> ftrace: Update the mcount_loc check of skipped entries Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Zero out weak functions in mcount_loc table Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Always use an array for the mcount_loc sorting Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Have mcount rela sort use direct values Steven Rostedt <rostedt(a)goodmis.org> arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Use a structure of function pointers for elf helpers Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Get start/stop_mcount_loc from ELF file directly Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Move code from sorttable.h into sorttable.c Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Use uint64_t for mcount sorting Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Add helper functions for Elf_Sym Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Add helper functions for Elf_Shdr Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Add helper functions for Elf_Ehdr Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Convert Elf_Sym MACRO over to a union Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Replace Elf_Shdr Macro with a union Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Convert Elf_Ehdr to union Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Make compare_extable() into two functions Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Have the ORC code use the _r() functions to read Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Remove unneeded Elf_Rel Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Remove unused write functions Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Remove unused macro defines Joanne Koong <joannelkoong(a)gmail.com> fuse: re-lock request before replacing page cache folio David Howells <dhowells(a)redhat.com> rxrpc: Fix the ACK parser to extract the SACK table for parsing Santosh Kalluri <santosh.kalluri129(a)gmail.com> net: phonet: free phonet_device after RCU grace period Kuniyuki Iwashima <kuniyu(a)amazon.com> phonet: Pass net and ifindex to phonet_address_notify(). Kuniyuki Iwashima <kuniyu(a)amazon.com> phonet: Pass ifindex to fill_addr(). Davidlohr Bueso <dave(a)stgolabs.net> locking/rtmutex: Skip remove_waiter() when waiter is not enqueued Peter Zijlstra <peterz(a)infradead.org> locking/mutex: Remove wakeups from under mutex::wait_lock Thorsten Blum <thorsten.blum(a)linux.dev> hv: utils: handle and propagate errors in kvp_register Dexuan Cui <decui(a)microsoft.com> Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs Jann Horn <jannh(a)google.com> fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() Salman Alghamdi <me(a)cipherat.com> staging: rtl8723bs: fix buffer over-read in rtw_update_protection Hangbin Liu <liuhangbin(a)gmail.com> bonding: fix NULL pointer dereference in actor_port_prio setting Xiang Mei <xmei5(a)asu.edu> net: bonding: fix use-after-free in bond_xmit_broadcast() Eric Dumazet <edumazet(a)google.com> bonding: 3ad: implement proper RCU rules for port->aggregator Hangbin Liu <liuhangbin(a)gmail.com> bonding: print churn state via netlink Hangbin Liu <liuhangbin(a)gmail.com> bonding: add support for per-port LACP actor priority Tonghao Zhang <tonghao(a)bamaicloud.com> net: bonding: add broadcast_neighbor option for 802.3ad Kevin Berry <kpberry(a)google.com> Revert "net: bonding: fix use-after-free in bond_xmit_broadcast()" Yingjie Gao <gaoyingjie(a)uniontech.com> xfs: fix error returns in CoW fork repair Christoph Hellwig <hch(a)lst.de> xfs: remove the expr argument to XFS_TEST_ERROR Thadeu Lima de Souza Cascardo <cascardo(a)igalia.com> dlm: prevent NPD when writing a positive value to event_done André Draszik <andre.draszik(a)linaro.org> regulator: core: fix locking in regulator_resolve_supply() error path Yicong Yang <yang.yicong(a)picoheart.com> ACPI: scan: Use async schedule function in acpi_scan_clear_dep_fn() Varun R Mallya <varunrmallya(a)gmail.com> selftests/bpf: Add test to ensure kprobe_multi is not sleepable Varun R Mallya <varunrmallya(a)gmail.com> bpf: Reject sleepable kprobe_multi programs at attach time Mingyu Wang <25181214217(a)stu.xidian.edu.cn> agp/amd64: Fix broken error propagation in agp_amd64_probe() Weiming Shi <bestswngs(a)gmail.com> net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() Weiming Shi <bestswngs(a)gmail.com> i2c: stub: Reject I2C block transfers with invalid length Lord Ulf Henrik Holmberg <henrik.holmberg(a)defensify.se> RDMA/bnxt_re: zero shared page before exposing to userspace Waiman Long <longman(a)redhat.com> debugobjects: Dont call fill_pool() in early boot hardirq context Helen Koike <koike(a)igalia.com> debugobjects: Do not fill_pool() if pi_blocked_on Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> debugobjects: Use LD_WAIT_CONFIG instead of LD_WAIT_SLEEP Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> debugobjects: Allow to refill the pool before SYSTEM_SCHEDULING Petr Machata <petrm(a)nvidia.com> Reapply "selftest/ptp: update ptp selftest to exercise the gettimex options" Eric Dumazet <edumazet(a)google.com> ip6_vti: set netns_immutable on the fallback device. Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> net: Drop the lock in skb_may_tx_timestamp() Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: light: bh1780: fix PM runtime leak on error path Christian Brauner <brauner(a)kernel.org> eventpoll: fix ep_remove struct eventpoll / struct file UAF Christian Brauner <brauner(a)kernel.org> eventpoll: move epi_fget() up Christian Brauner <brauner(a)kernel.org> eventpoll: rename ep_remove_safe() back to ep_remove() Christian Brauner <brauner(a)kernel.org> eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() Christian Brauner <brauner(a)kernel.org> eventpoll: kill __ep_remove() Christian Brauner <brauner(a)kernel.org> eventpoll: split __ep_remove() Christian Brauner <brauner(a)kernel.org> eventpoll: use hlist_is_singular_node() in __ep_remove() Maíra Canal <mcanal(a)igalia.com> drm/v3d: Skip CSD when it has zeroed workgroups Maíra Canal <mcanal(a)igalia.com> drm/v3d: Store the active job inside the queue's state Jani Nikula <jani.nikula(a)intel.com> drm/xe/display: fix oops in suspend/shutdown without display Gabriel Krisman Bertazi <krisman(a)suse.de> io_uring/net: Avoid msghdr on op_connect/op_bind async data Tzung-Bi Shih <tzungbi(a)kernel.org> gpio: Fix resource leaks on errors in gpiochip_add_data_with_key() Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> gpiolib: Remove redundant assignment of return variable Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> gpiolib: Extract gpiochip_choose_fwnode() for wider use Jann Horn <jannh(a)google.com> fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios Sean Wang <sean.wang(a)mediatek.com> wifi: mt76: mt7921: fix potential deadlock in mt7921_roc_abort_sync Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7921: fix a potential scan no APs Leon Yen <leon.yen(a)mediatek.com> wifi: mt76: mt7921: avoid undesired changes of the preset regulatory domain ------------- Diffstat: Documentation/networking/bonding.rst | 15 + Documentation/userspace-api/ioctl/ioctl-number.rst | 485 +++++---- Makefile | 4 +- arch/arm64/Kconfig | 1 + arch/loongarch/kernel/smp.c | 1 + arch/mips/dec/prom/console.c | 7 +- arch/mips/kernel/smp.c | 2 + arch/riscv/include/asm/cacheflush.h | 25 +- arch/riscv/include/asm/kfence.h | 7 +- arch/riscv/kernel/entry.S | 6 +- arch/x86/kvm/hyperv.c | 5 + arch/x86/kvm/mmu/mmu.c | 28 +- arch/x86/kvm/svm/sev.c | 113 +- block/bdev.c | 5 - block/blk-cgroup.c | 21 +- drivers/acpi/scan.c | 41 +- drivers/base/memory.c | 3 +- drivers/char/agp/amd64-agp.c | 2 +- drivers/crypto/intel/qat/qat_common/adf_cfg.c | 10 - drivers/crypto/intel/qat/qat_common/adf_cfg.h | 1 - .../crypto/intel/qat/qat_common/adf_cfg_common.h | 32 - drivers/crypto/intel/qat/qat_common/adf_cfg_user.h | 38 - .../crypto/intel/qat/qat_common/adf_common_drv.h | 3 - drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c | 416 +------- drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c | 70 -- drivers/fpga/of-fpga-region.c | 3 +- drivers/gpio/gpiolib.c | 156 +-- drivers/gpu/drm/v3d/v3d_drv.h | 7 +- drivers/gpu/drm/v3d/v3d_gem.c | 7 +- drivers/gpu/drm/v3d/v3d_irq.c | 62 +- drivers/gpu/drm/v3d/v3d_sched.c | 42 +- drivers/gpu/drm/xe/display/xe_display.c | 11 +- drivers/hv/hv_kvp.c | 25 +- drivers/hv/vmbus_drv.c | 29 +- drivers/i2c/i2c-core-base.c | 8 +- drivers/i2c/i2c-stub.c | 5 + drivers/iio/adc/ti-ads1298.c | 7 +- drivers/iio/light/bh1780.c | 4 +- drivers/iio/light/veml6075.c | 8 +- drivers/infiniband/hw/bnxt_re/ib_verbs.c | 2 +- drivers/irqchip/irq-imgpdc.c | 6 + drivers/media/test-drivers/vidtv/vidtv_mux.c | 8 +- drivers/mtd/spi-nor/macronix.c | 31 + drivers/net/bonding/bond_3ad.c | 131 ++- drivers/net/bonding/bond_main.c | 86 +- drivers/net/bonding/bond_netlink.c | 37 +- drivers/net/bonding/bond_options.c | 71 ++ drivers/net/bonding/bond_procfs.c | 11 +- drivers/net/bonding/bond_sysfs_slave.c | 17 +- drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c | 8 +- drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h | 1 + drivers/net/wan/hdlc_ppp.c | 15 +- drivers/net/wireless/ath/ath11k/dp.c | 1 + drivers/net/wireless/intel/iwlwifi/mvm/ptp.c | 2 +- drivers/net/wireless/mediatek/mt76/mt76x2/usb.c | 1 + drivers/net/wireless/mediatek/mt76/mt7921/init.c | 7 + drivers/net/wireless/mediatek/mt76/mt7921/main.c | 14 +- drivers/net/wireless/mediatek/mt76/mt7925/main.c | 3 + .../net/wireless/realtek/rtlwifi/rtl8821ae/trx.h | 2 +- drivers/net/wireless/realtek/rtw88/tx.c | 7 +- drivers/net/wireless/realtek/rtw88/usb.c | 13 +- drivers/ntb/hw/epf/ntb_hw_epf.c | 3 +- drivers/pci/controller/dwc/pcie-qcom.c | 17 +- drivers/power/reset/linkstation-poweroff.c | 2 +- drivers/power/sequencing/core.c | 14 +- drivers/regulator/core.c | 10 +- drivers/rpmsg/rpmsg_char.c | 15 +- drivers/staging/rtl8723bs/core/rtw_mlme.c | 10 +- drivers/tty/serial/8250/8250_dw.c | 4 +- drivers/tty/serial/qcom_geni_serial.c | 9 +- drivers/tty/vt/vc_screen.c | 2 +- drivers/video/fbdev/core/fbmem.c | 12 + drivers/video/fbdev/core/fbsysfs.c | 10 +- drivers/video/fbdev/core/modedb.c | 5 +- fs/backing-file.c | 22 +- fs/dlm/lockspace.c | 2 +- fs/eventpoll.c | 142 +-- fs/exfat/dir.c | 4 +- fs/f2fs/acl.c | 18 +- fs/f2fs/data.c | 16 +- fs/f2fs/extent_cache.c | 19 +- fs/f2fs/file.c | 9 +- fs/f2fs/inode.c | 9 +- fs/fhandle.c | 16 +- fs/file_table.c | 40 +- fs/fuse/dev.c | 23 +- fs/fuse/file.c | 8 +- fs/fuse/passthrough.c | 2 +- fs/gfs2/super.c | 1 + fs/internal.h | 4 +- fs/mount.h | 10 +- fs/namespace.c | 6 +- fs/nfs/client.c | 1 + fs/nfs/pnfs.c | 2 +- fs/nfs/pnfs_nfs.c | 4 +- fs/nfsd/nfs2acl.c | 17 +- fs/nfsd/nfs3acl.c | 17 +- fs/nfsd/nfs4recover.c | 3 +- fs/nfsd/nfs4state.c | 1 + fs/nfsd/nfs4xdr.c | 3 +- fs/nfsd/vfs.c | 6 +- fs/ntfs3/xattr.c | 12 + fs/ocfs2/suballoc.c | 22 + fs/overlayfs/dir.c | 2 +- fs/overlayfs/file.c | 3 +- fs/smb/server/smb2pdu.c | 5 + fs/smb/server/smbacl.c | 4 +- fs/xfs/libxfs/xfs_ag_resv.c | 8 +- fs/xfs/libxfs/xfs_alloc.c | 5 +- fs/xfs/libxfs/xfs_attr_leaf.c | 2 +- fs/xfs/libxfs/xfs_bmap.c | 17 +- fs/xfs/libxfs/xfs_btree.c | 2 +- fs/xfs/libxfs/xfs_da_btree.c | 2 +- fs/xfs/libxfs/xfs_dir2.c | 2 +- fs/xfs/libxfs/xfs_exchmaps.c | 4 +- fs/xfs/libxfs/xfs_ialloc.c | 2 +- fs/xfs/libxfs/xfs_inode_buf.c | 4 +- fs/xfs/libxfs/xfs_inode_fork.c | 3 +- fs/xfs/libxfs/xfs_refcount.c | 5 +- fs/xfs/libxfs/xfs_rmap.c | 2 +- fs/xfs/scrub/cow_repair.c | 7 +- fs/xfs/scrub/repair.c | 2 +- fs/xfs/xfs_attr_item.c | 2 +- fs/xfs/xfs_buf.c | 4 +- fs/xfs/xfs_error.c | 5 +- fs/xfs/xfs_error.h | 10 +- fs/xfs/xfs_inode.c | 28 +- fs/xfs/xfs_iomap.c | 2 +- fs/xfs/xfs_log.c | 8 +- fs/xfs/xfs_trans_ail.c | 2 +- include/keys/request_key_auth-type.h | 2 + include/linux/backing-file.h | 4 +- include/linux/blkdev.h | 16 +- include/linux/err.h | 12 +- include/linux/fs.h | 19 +- include/linux/kvm_host.h | 7 +- include/linux/lsm_audit.h | 2 +- include/linux/lsm_hook_defs.h | 5 + include/linux/lsm_hooks.h | 1 + include/linux/security.h | 22 + include/linux/skmsg.h | 15 +- include/net/bond_3ad.h | 3 +- include/net/bond_options.h | 2 + include/net/bonding.h | 3 + include/net/phonet/pn_dev.h | 2 +- include/net/rtnetlink.h | 2 + include/net/sock.h | 2 +- include/net/udp_tunnel.h | 14 +- include/uapi/linux/if_link.h | 3 + io_uring/net.c | 36 +- io_uring/opdef.c | 4 +- kernel/bpf/cgroup.c | 2 +- kernel/futex/pi.c | 6 +- kernel/locking/mutex.c | 16 +- kernel/locking/rtmutex.c | 51 +- kernel/locking/rtmutex_api.c | 14 +- kernel/locking/rtmutex_common.h | 3 +- kernel/locking/rwbase_rt.c | 8 +- kernel/locking/rwsem.c | 4 +- kernel/locking/spinlock_rt.c | 5 +- kernel/locking/ww_mutex.h | 30 +- kernel/sched/core.c | 12 +- kernel/trace/bpf_trace.c | 4 + kernel/trace/ftrace.c | 68 +- lib/debugobjects.c | 56 +- net/9p/client.c | 3 +- net/batman-adv/bat_iv_ogm.c | 11 +- net/batman-adv/bat_v.c | 1 + net/batman-adv/bat_v_ogm.c | 23 +- net/batman-adv/bridge_loop_avoidance.c | 28 +- net/batman-adv/distributed-arp-table.c | 12 +- net/batman-adv/fragmentation.c | 22 +- net/batman-adv/fragmentation.h | 3 +- net/batman-adv/netlink.c | 10 +- net/batman-adv/routing.c | 73 +- net/batman-adv/tp_meter.c | 115 +- net/batman-adv/translation-table.c | 12 +- net/batman-adv/tvlv.c | 69 +- net/batman-adv/types.h | 21 +- net/core/filter.c | 27 + net/core/rtnetlink.c | 8 + net/core/skbuff.c | 23 +- net/core/skmsg.c | 2 + net/ipv4/ip_gre.c | 6 + net/ipv4/ip_output.c | 20 +- net/ipv4/tcp_ao.c | 4 + net/ipv6/ip6_output.c | 22 +- net/ipv6/ip6_udp_tunnel.c | 15 +- net/ipv6/ip6_vti.c | 1 + net/mac802154/llsec.c | 14 + net/phonet/pn_dev.c | 12 +- net/phonet/pn_netlink.c | 23 +- net/rxrpc/input.c | 21 +- net/sctp/ipv6.c | 9 +- net/sctp/protocol.c | 2 + net/socket.c | 2 +- net/tipc/crypto.c | 9 + net/tipc/udp_media.c | 10 +- net/tls/tls_sw.c | 4 + net/unix/garbage.c | 2 + scripts/link-vmlinux.sh | 4 +- scripts/sorttable.c | 1119 +++++++++++++++++++- scripts/sorttable.h | 500 --------- security/apparmor/include/policy_unpack.h | 19 + security/apparmor/lsm.c | 16 +- security/apparmor/policy.c | 8 +- security/keys/internal.h | 2 + security/keys/keyctl.c | 24 +- security/keys/keyctl_pkey.c | 9 +- security/keys/request_key_auth.c | 33 +- security/security.c | 109 ++ security/selinux/hooks.c | 256 +++-- security/selinux/include/objsec.h | 11 + .../selftests/bpf/prog_tests/kprobe_multi_test.c | 35 +- .../selftests/bpf/progs/kprobe_multi_sleepable.c | 25 + tools/testing/selftests/ptp/testptp.c | 62 +- virt/kvm/eventfd.c | 12 +- 217 files changed, 3875 insertions(+), 2346 deletions(-)

1 day, 7 hours

[PATCH 6.18 000/109] 6.18.38-rc2 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.18.38 release. There are 109 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sun, 05 Jul 2026 07:28:03 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.38-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.18.38-rc2 John Johansen <john.johansen(a)canonical.com> apparmor: advertise the tcp fast open fix is applied HanQuan <eilaimemedsnaimel(a)gmail.com> net/tcp-ao: fix use-after-free of key in del_async path Stepan Ionichev <sozdayvek(a)gmail.com> serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails Hem Parekh <hemparekh1596(a)gmail.com> ksmbd: fix out-of-bounds read in smb_check_perm_dacl() Markus Elfring <elfring(a)users.sourceforge.net> NFS: Prevent resource leak in nfs_alloc_server() Igor Raits <igor.raits(a)gmail.com> NFSv4: clear exception state on successful mkdir retry Michael Bommarito <michael.bommarito(a)gmail.com> NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr Michael Bommarito <michael.bommarito(a)gmail.com> NFSv4/flexfiles: reject zero filehandle version count Jeff Layton <jlayton(a)kernel.org> nfsd: reset write verifier on deferred writeback errors Jeff Layton <jlayton(a)kernel.org> nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race Dominik Woźniak <stalion(a)gmail.com> nfsd: check get_user() return when reading princhashlen Jeff Layton <jlayton(a)kernel.org> nfsd: fix inverted cp_ttl check in async copy reaper Jeff Layton <jlayton(a)kernel.org> nfsd: fix posix_acl leak on SETACL decode failure Guannan Wang <wgnbuaa(a)gmail.com> NFSD: Fix SECINFO_NO_NAME decode error cleanup Johan Hovold <johan(a)kernel.org> i2c: core: fix adapter registration race Steffen Persvold <spersvold(a)gmail.com> fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode Tuo Li <islituo(a)gmail.com> fbdev: modedb: fix a possible UAF in fb_find_mode() Ian Bridges <icb(a)fastmail.org> fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var Vivian Wang <wangruikang(a)iscas.ac.cn> riscv: kfence: Call mark_new_valid_map() for kfence_unprotect() Vivian Wang <wangruikang(a)iscas.ac.cn> riscv: mm: Extract helper mark_new_valid_map() Wentao Liang <vulab(a)iscas.ac.cn> power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() Ashutosh Desai <ashutoshdesai993(a)gmail.com> KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path Hyunwoo Kim <imv4bel(a)gmail.com> KVM: x86: hyper-v: Bound the bank index when querying sparse banks Jonas Jelonek <jelonek.jonas(a)gmail.com> MIPS: smp: report dying CPU to RCU in stop_this_cpu() Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> 9p: avoid putting oldfid in p9_client_walk() error path Zhang Cen <rollkingzzc(a)gmail.com> ocfs2: reject oversized group bitmap descriptors Yuho Choi <dbgh9129(a)gmail.com> rpmsg: char: Fix use-after-free on probe error path Wentao Liang <vulab(a)iscas.ac.cn> fpga: region: fix use-after-free in child_regions_with_firmware() Qingshuang Fu <fuqingshuang(a)kylinos.cn> irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove Wentao Liang <vulab(a)iscas.ac.cn> pNFS: Fix use-after-free in pnfs_update_layout() Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Report dying CPU to RCU in stop_this_cpu() Doruk Tan Ozturk <doruk(a)0sec.ai> tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done Michal Koutný <mkoutny(a)suse.com> blk-cgroup: fix UAF in __blkcg_rstat_flush() Fan Wu <fanwu01(a)zju.edu.cn> hdlc_ppp: sync per-proto timers before freeing hdlc state Wentao Liang <vulab(a)iscas.ac.cn> pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next() Tristan Madani <tristan(a)talencesecurity.com> gfs2: fix use-after-free in gfs2_qd_dealloc Sam James <sam(a)gentoo.org> crypto: nx - fix nx_crypto_ctx_exit argument Sean Christopherson <seanjc(a)google.com> KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() Sean Christopherson <seanjc(a)google.com> KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level Michael Bommarito <michael.bommarito(a)gmail.com> exfat: fix potential use-after-free in exfat_find_dir_entry() Maciej W. Rozycki <macro(a)orcam.me.uk> MIPS: DEC: Prevent initial console buffer from landing in XKPHYS Dawei Feng <dawei.feng(a)seu.edu.cn> bpf: use kvfree() for replaced sysctl write buffer Denis Arefev <arefev(a)swemel.ru> block: Avoid mounting the bdev pseudo-filesystem in userspace Wenjie Qi <qwjhust(a)gmail.com> f2fs: keep atomic write retry from zeroing original data Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node() Zhang Cen <rollkingzzc(a)gmail.com> f2fs: validate ACL entry sizes in f2fs_acl_from_disk() Sunmin Jeong <s_min.jeong(a)samsung.com> f2fs: fix to round down start offset of fallocate for pin file Wenjie Qi <qwjhust(a)gmail.com> f2fs: validate compress cache inode only when enabled Wenjie Qi <qwjhust(a)gmail.com> f2fs: validate orphan inode entry count Wenjie Qi <qwjhust(a)gmail.com> f2fs: pass correct iostat type for single node writes Junrui Luo <moonafterrain(a)outlook.com> wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers Junjie Cao <junjie.cao(a)intel.com> wifi: iwlwifi: mld: fix race condition in PTP removal Junjie Cao <junjie.cao(a)intel.com> wifi: iwlwifi: mvm: fix race condition in PTP removal Luka Gejak <luka.gejak(a)linux.dev> wifi: rtw88: usb: fix memory leaks on USB write failures Luka Gejak <luka.gejak(a)linux.dev> wifi: rtw88: increase TX report timeout to fix race condition Bitterblue Smith <rtl8821cerfe2(a)gmail.com> wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor Jose Ignacio Tornos Martinez <jtornosm(a)redhat.com> wifi: ath11k: fix warning when unbinding ElXreno <elxreno(a)gmail.com> wifi: mt76: mt7925: don't disable AP BSS when removing TDLS peer Zenm Chen <zenmchen(a)gmail.com> wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S Mike Rapoport (Microsoft) <rppt(a)kernel.org> userfaultfd: ensure mremap_userfaultfd_fail() releases mmap_changing Shaomin Chen <eeesssooo020(a)gmail.com> keys: Pin request_key_auth payload in instantiate paths Jarkko Sakkinen <jarkko(a)kernel.org> KEYS: fix overflow in keyctl_pkey_params_get_2() Konstantin Khorenko <khorenko(a)virtuozzo.com> gcov: use atomic counter updates to fix concurrent access crashes Arnd Bergmann <arnd(a)arndb.de> err.h: use __always_inline on all error pointer helpers Ard Biesheuvel <ardb(a)kernel.org> KVM: arm64: Omit tag sync on stage-2 mappings of the zero page Usama Arif <usama.arif(a)linux.dev> block: invalidate cached plug timestamp after task switch Ian Bridges <icb(a)fastmail.org> fbdev: fix use-after-free in store_modes() Koichiro Den <den(a)valinux.co.jp> NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR Ruslan Valiyev <linuxoid(a)gmail.com> apparmor: fix use-after-free in rawdata dedup loop Bryam Vargas <hexlabsecurity(a)proton.me> apparmor: mediate the implicit connect of TCP fast open sendmsg Maoyi Xie <maoyixie.tju(a)gmail.com> net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink Yiming Qian <yimingqian591(a)gmail.com> net: skmsg: preserve sg.copy across SG transforms Doruk Tan Ozturk <doruk(a)0sec.ai> mac802154: llsec: add skb_cow_data() before in-place crypto Kuniyuki Iwashima <kuniyu(a)google.com> af_unix: Set gc_in_progress to true in unix_gc(). Jiajia Liu <liujiajia(a)kylinos.cn> wifi: mt76: add wcid publish check in mt76_sta_add Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> ntfs3: reject direct userspace writes to reserved $LX* xattrs Wongi Lee <qw3rtyp0(a)gmail.com> ipv4: account for fraggap on the paged allocation path Wongi Lee <qw3rtyp0(a)gmail.com> ipv6: account for fraggap on the paged allocation path Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: avoid race of cifsnotfound handler state Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: enforce 2-byte alignment Sven Eckelmann <sven(a)narfation.org> batman-adv: dat: prevent false sharing between VLANs Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: track roam count per VID Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: don't merge change entries with different VIDs Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: handle overlapping packets Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: prevent parallel modifications of last_recv Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: restrict number of unacked list entries Sven Eckelmann <sven(a)narfation.org> batman-adv: v: prevent OGM aggregation on disabled hardif Sven Eckelmann <sven(a)narfation.org> batman-adv: frag: avoid underflow of TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: frag: ensure fragment is writable before modifying TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: fix (m|b)cast csum after decrementing TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: ensure bcast is writable before modifying TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: gw: don't deselect gateway with active hardif Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: initialize last_recv_time during init Sven Eckelmann <sven(a)narfation.org> batman-adv: prevent ELP transmission interval underflow Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: add only finished tp_vars to lists Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: fix fast recovery precondition Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: avoid window underflow Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: initialize dec_cwnd explicitly Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: initialize dup_acks explicitly Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: keep unacked list in ascending ordered NeilBrown <neil(a)brown.name> lockd: fix TEST handling when not all permissions are available. Sasha Levin <sashal(a)kernel.org> Revert "PCI: qcom: Advertise Hotplug Slot Capability with no Command Completion support" Paul Moore <paul(a)paul-moore.com> selinux: fix overlayfs mmap() and mprotect() access checks Paul Moore <paul(a)paul-moore.com> lsm: add backing_file LSM hooks Paolo Bonzini <pbonzini(a)redhat.com> KVM: x86: Fix shadow paging use-after-free due to unexpected role ------------- Diffstat: Makefile | 31 ++- arch/arm64/kvm/mmu.c | 5 + arch/loongarch/kernel/smp.c | 1 + arch/mips/dec/prom/console.c | 7 +- arch/mips/kernel/smp.c | 2 + arch/riscv/include/asm/cacheflush.h | 25 +- arch/riscv/include/asm/kfence.h | 7 +- arch/riscv/kernel/entry.S | 6 +- arch/x86/kvm/hyperv.c | 5 + arch/x86/kvm/mmu/mmu.c | 28 ++- arch/x86/kvm/svm/sev.c | 1 + block/bdev.c | 5 - block/blk-cgroup.c | 21 +- drivers/crypto/nx/nx.c | 6 +- drivers/crypto/nx/nx.h | 2 +- drivers/fpga/of-fpga-region.c | 3 +- drivers/i2c/i2c-core-base.c | 8 +- drivers/irqchip/irq-imgpdc.c | 6 + drivers/net/wan/hdlc_ppp.c | 15 +- drivers/net/wireless/ath/ath11k/dp.c | 1 + drivers/net/wireless/intel/iwlwifi/mld/agg.c | 9 + drivers/net/wireless/intel/iwlwifi/mld/ptp.c | 2 +- drivers/net/wireless/intel/iwlwifi/mvm/ptp.c | 2 +- drivers/net/wireless/mediatek/mt76/mac80211.c | 15 +- drivers/net/wireless/mediatek/mt76/mt76x2/usb.c | 1 + drivers/net/wireless/mediatek/mt76/mt7925/main.c | 3 + .../net/wireless/realtek/rtlwifi/rtl8821ae/trx.h | 2 +- drivers/net/wireless/realtek/rtw88/tx.c | 7 +- drivers/net/wireless/realtek/rtw88/usb.c | 13 +- drivers/ntb/hw/epf/ntb_hw_epf.c | 3 +- drivers/pci/controller/dwc/pcie-qcom.c | 17 +- drivers/power/reset/linkstation-poweroff.c | 2 +- drivers/power/sequencing/core.c | 14 +- drivers/rpmsg/rpmsg_char.c | 15 +- drivers/tty/serial/8250/8250_dw.c | 4 +- drivers/video/fbdev/core/fbmem.c | 12 + drivers/video/fbdev/core/fbsysfs.c | 10 +- drivers/video/fbdev/core/modedb.c | 5 +- fs/backing-file.c | 17 +- fs/exfat/dir.c | 4 +- fs/f2fs/acl.c | 18 +- fs/f2fs/checkpoint.c | 14 +- fs/f2fs/data.c | 16 +- fs/f2fs/extent_cache.c | 19 +- fs/f2fs/file.c | 9 +- fs/f2fs/inode.c | 9 +- fs/f2fs/node.c | 2 +- fs/file_table.c | 27 ++- fs/fuse/passthrough.c | 2 +- fs/gfs2/super.c | 1 + fs/internal.h | 3 +- fs/lockd/svc4proc.c | 13 +- fs/lockd/svclock.c | 4 +- fs/lockd/svcproc.c | 15 +- fs/lockd/svcsubs.c | 35 ++- fs/nfs/client.c | 1 + fs/nfs/flexfilelayout/flexfilelayout.c | 4 + fs/nfs/nfs4proc.c | 5 +- fs/nfs/pnfs.c | 2 +- fs/nfs/pnfs_nfs.c | 4 +- fs/nfsd/nfs2acl.c | 17 +- fs/nfsd/nfs3acl.c | 17 +- fs/nfsd/nfs4proc.c | 2 +- fs/nfsd/nfs4recover.c | 3 +- fs/nfsd/nfs4state.c | 1 + fs/nfsd/nfs4xdr.c | 3 +- fs/nfsd/vfs.c | 6 +- fs/ntfs3/xattr.c | 12 + fs/ocfs2/suballoc.c | 22 ++ fs/overlayfs/dir.c | 2 +- fs/overlayfs/file.c | 2 +- fs/smb/server/smbacl.c | 4 +- fs/userfaultfd.c | 2 + include/keys/request_key_auth-type.h | 2 + include/linux/backing-file.h | 4 +- include/linux/blkdev.h | 16 +- include/linux/err.h | 12 +- include/linux/f2fs_fs.h | 1 + include/linux/fs.h | 13 ++ include/linux/kvm_host.h | 7 +- include/linux/lockd/lockd.h | 2 +- include/linux/lsm_audit.h | 2 +- include/linux/lsm_hook_defs.h | 5 + include/linux/lsm_hooks.h | 1 + include/linux/security.h | 22 ++ include/linux/skmsg.h | 15 +- include/net/rtnetlink.h | 2 + kernel/bpf/cgroup.c | 2 +- kernel/sched/core.c | 12 +- net/9p/client.c | 3 +- net/batman-adv/bat_iv_ogm.c | 11 +- net/batman-adv/bat_v.c | 1 + net/batman-adv/bat_v_ogm.c | 23 +- net/batman-adv/bridge_loop_avoidance.c | 28 +-- net/batman-adv/distributed-arp-table.c | 12 +- net/batman-adv/fragmentation.c | 22 +- net/batman-adv/fragmentation.h | 3 +- net/batman-adv/hard-interface.c | 28 +-- net/batman-adv/netlink.c | 10 +- net/batman-adv/routing.c | 73 +++++- net/batman-adv/tp_meter.c | 115 +++++---- net/batman-adv/translation-table.c | 12 +- net/batman-adv/tvlv.c | 69 +++++- net/batman-adv/types.h | 21 +- net/core/filter.c | 27 +++ net/core/rtnetlink.c | 8 + net/core/skmsg.c | 2 + net/ipv4/ip_gre.c | 6 + net/ipv4/ip_output.c | 7 +- net/ipv4/tcp_ao.c | 4 + net/ipv6/ip6_output.c | 9 +- net/mac802154/llsec.c | 14 ++ net/tipc/crypto.c | 9 + net/tls/tls_sw.c | 4 + net/unix/garbage.c | 2 + security/apparmor/include/policy_unpack.h | 19 ++ security/apparmor/lsm.c | 16 +- security/apparmor/net.c | 2 + security/apparmor/policy.c | 8 +- security/keys/internal.h | 2 + security/keys/keyctl.c | 24 +- security/keys/keyctl_pkey.c | 9 +- security/keys/request_key_auth.c | 33 ++- security/security.c | 109 +++++++++ security/selinux/hooks.c | 256 +++++++++++++++------ security/selinux/include/objsec.h | 11 + virt/kvm/eventfd.c | 12 +- 127 files changed, 1368 insertions(+), 412 deletions(-)

1 day, 7 hours

[PATCH 6.1 000/129] 6.1.177-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.1.177 release. There are 129 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat, 04 Jul 2026 15:50:58 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.177-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.1.177-rc1 Wongi Lee <qw3rtyp0(a)gmail.com> ipv6: account for fraggap on the paged allocation path Giovanni Cabiddu <giovanni.cabiddu(a)intel.com> crypto: qat - remove unused character device and IOCTLs Herbert Xu <herbert(a)gondor.apana.org.au> crypto: qat - Return pointer directly in adf_ctl_alloc_resources Thorsten Blum <thorsten.blum(a)linux.dev> crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() Bagas Sanjaya <bagasdotme(a)gmail.com> Documentation: ioctl-number: Extend "Include File" column width Stepan Ionichev <sozdayvek(a)gmail.com> serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails Joanne Koong <joannelkoong(a)gmail.com> fuse: re-lock request before replacing page cache folio Santosh Kalluri <santosh.kalluri129(a)gmail.com> net: phonet: free phonet_device after RCU grace period Kuniyuki Iwashima <kuniyu(a)amazon.com> phonet: Pass net and ifindex to phonet_address_notify(). Kuniyuki Iwashima <kuniyu(a)amazon.com> phonet: Pass ifindex to fill_addr(). Davidlohr Bueso <dave(a)stgolabs.net> locking/rtmutex: Skip remove_waiter() when waiter is not enqueued Dexuan Cui <decui(a)microsoft.com> Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs Ji'an Zhou <eilaimemedsnaimel(a)gmail.com> futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock Mukesh Ojha <mukesh.ojha(a)oss.qualcomm.com> misc: fastrpc: Fix NULL pointer dereference in rpmsg callback Abel Vesa <abel.vesa(a)linaro.org> misc: fastrpc: Add dma_mask to fastrpc_channel_ctx Thorsten Blum <thorsten.blum(a)linux.dev> hv: utils: handle and propagate errors in kvp_register Paolo Abeni <pabeni(a)redhat.com> mptcp: fix missing wakeups in edge scenarios Tao Cui <cuitao(a)kylinos.cn> mptcp: pm: fix extra_subflows underflow on userspace PM subflow creation Deepak Kumar Singh <quic_deesin(a)quicinc.com> rpmsg: char: Add lock to avoid race when rpmsg device is released Hem Parekh <hemparekh1596(a)gmail.com> ksmbd: fix out-of-bounds read in smb_check_perm_dacl() Michael Bommarito <michael.bommarito(a)gmail.com> NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr Dominik Woźniak <stalion(a)gmail.com> nfsd: check get_user() return when reading princhashlen Jeff Layton <jlayton(a)kernel.org> nfsd: fix posix_acl leak on SETACL decode failure Guannan Wang <wgnbuaa(a)gmail.com> NFSD: Fix SECINFO_NO_NAME decode error cleanup Steffen Persvold <spersvold(a)gmail.com> fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode Ian Bridges <icb(a)fastmail.org> fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var Wentao Liang <vulab(a)iscas.ac.cn> power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() Ashutosh Desai <ashutoshdesai993(a)gmail.com> KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path Jonas Jelonek <jelonek.jonas(a)gmail.com> MIPS: smp: report dying CPU to RCU in stop_this_cpu() Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> 9p: avoid putting oldfid in p9_client_walk() error path Zhang Cen <rollkingzzc(a)gmail.com> ocfs2: reject oversized group bitmap descriptors Wentao Liang <vulab(a)iscas.ac.cn> fpga: region: fix use-after-free in child_regions_with_firmware() Qingshuang Fu <fuqingshuang(a)kylinos.cn> irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove Wentao Liang <vulab(a)iscas.ac.cn> pNFS: Fix use-after-free in pnfs_update_layout() Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Report dying CPU to RCU in stop_this_cpu() Doruk Tan Ozturk <doruk(a)0sec.ai> tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done Fan Wu <fanwu01(a)zju.edu.cn> hdlc_ppp: sync per-proto timers before freeing hdlc state Michael Bommarito <michael.bommarito(a)gmail.com> exfat: fix potential use-after-free in exfat_find_dir_entry() Maciej W. Rozycki <macro(a)orcam.me.uk> MIPS: DEC: Prevent initial console buffer from landing in XKPHYS Dawei Feng <dawei.feng(a)seu.edu.cn> bpf: use kvfree() for replaced sysctl write buffer Zhang Cen <rollkingzzc(a)gmail.com> f2fs: validate ACL entry sizes in f2fs_acl_from_disk() Sunmin Jeong <s_min.jeong(a)samsung.com> f2fs: fix to round down start offset of fallocate for pin file Wenjie Qi <qwjhust(a)gmail.com> f2fs: validate compress cache inode only when enabled Bitterblue Smith <rtl8821cerfe2(a)gmail.com> wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor Jose Ignacio Tornos Martinez <jtornosm(a)redhat.com> wifi: ath11k: fix warning when unbinding Zenm Chen <zenmchen(a)gmail.com> wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S Shaomin Chen <eeesssooo020(a)gmail.com> keys: Pin request_key_auth payload in instantiate paths Jarkko Sakkinen <jarkko(a)kernel.org> KEYS: fix overflow in keyctl_pkey_params_get_2() Koichiro Den <den(a)valinux.co.jp> NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR Ruslan Valiyev <linuxoid(a)gmail.com> apparmor: fix use-after-free in rawdata dedup loop Bryam Vargas <hexlabsecurity(a)proton.me> apparmor: mediate the implicit connect of TCP fast open sendmsg Yiming Qian <yimingqian591(a)gmail.com> net: skmsg: preserve sg.copy across SG transforms Doruk Tan Ozturk <doruk(a)0sec.ai> mac802154: llsec: add skb_cow_data() before in-place crypto Yuto Ohnuki <ytohnuki(a)amazon.com> ext4: add bounds check for inline data length in ext4_read_inline_page Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> ntfs3: reject direct userspace writes to reserved $LX* xattrs Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: avoid race of cifsnotfound handler state Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: enforce 2-byte alignment Sven Eckelmann <sven(a)narfation.org> batman-adv: dat: prevent false sharing between VLANs Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: track roam count per VID Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: don't merge change entries with different VIDs Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: handle overlapping packets Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: prevent parallel modifications of last_recv Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: restrict number of unacked list entries Sven Eckelmann <sven(a)narfation.org> batman-adv: v: prevent OGM aggregation on disabled hardif Sven Eckelmann <sven(a)narfation.org> batman-adv: frag: avoid underflow of TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: frag: ensure fragment is writable before modifying TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: fix (m|b)cast csum after decrementing TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: ensure bcast is writable before modifying TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: initialize last_recv_time during init Sven Eckelmann <sven(a)narfation.org> batman-adv: prevent ELP transmission interval underflow Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: add only finished tp_vars to lists Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: fix fast recovery precondition Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: avoid window underflow Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: initialize dec_cwnd explicitly Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: initialize dup_acks explicitly Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: keep unacked list in ascending ordered Yu Zhao <yuzhao(a)google.com> mm/mglru: skip special VMAs in lru_gen_look_around() Petr Machata <petrm(a)nvidia.com> Revert "ptp: add testptp mask test" Sean Christopherson <seanjc(a)google.com> KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level Paolo Bonzini <pbonzini(a)redhat.com> KVM: x86: Fix shadow paging use-after-free due to unexpected role Ian Rogers <irogers(a)google.com> perf block-range: Move debug code behind ifndef NDEBUG Ian Rogers <irogers(a)google.com> perf bench: Avoid NDEBUG warning Miklos Szeredi <mszeredi(a)redhat.com> virtiofs: fix UAF on submount umount Ruslan Valiyev <linuxoid(a)gmail.com> media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si Gil Portnoy <dddhkts1(a)gmail.com> ksmbd: reject non-VALID session in compound request branch Yi Yang <yiyang13(a)huawei.com> vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write Florian Westphal <fw(a)strlen.de> netfilter: nf_tables: always walk all pending catchall elements Thadeu Lima de Souza Cascardo <cascardo(a)igalia.com> dlm: prevent NPD when writing a positive value to event_done André Draszik <andre.draszik(a)linaro.org> regulator: core: fix locking in regulator_resolve_supply() error path Bjoern Doebel <doebel(a)amazon.de> ring-buffer: Remove ring_buffer_read_prepare_sync() Jiexun Wang <wangjiexun2025(a)gmail.com> af_unix: Reject SIOCATMARK on non-stream sockets Mingyu Wang <25181214217(a)stu.xidian.edu.cn> agp/amd64: Fix broken error propagation in agp_amd64_probe() Weiming Shi <bestswngs(a)gmail.com> net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() Weiming Shi <bestswngs(a)gmail.com> i2c: stub: Reject I2C block transfers with invalid length Lord Ulf Henrik Holmberg <henrik.holmberg(a)defensify.se> RDMA/bnxt_re: zero shared page before exposing to userspace Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> ARM: fix branch predictor hardening Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> ARM: fix hash_name() fault Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> ARM: allow __do_kernel_fault() to report execution of memory faults Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> ARM: group is_permission_fault() with is_translation_fault() Waiman Long <longman(a)redhat.com> debugobjects: Dont call fill_pool() in early boot hardirq context Helen Koike <koike(a)igalia.com> debugobjects: Do not fill_pool() if pi_blocked_on Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> debugobjects: Use LD_WAIT_CONFIG instead of LD_WAIT_SLEEP Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> debugobjects: Allow to refill the pool before SYSTEM_SCHEDULING Peter Zijlstra <peterz(a)infradead.org> debugobjects,locking: Annotate debug_object_fill_pool() wait type violation Eric Dumazet <edumazet(a)google.com> net: annotate data-races around sk->sk_{data_ready,write_space} Sean Christopherson <seanjc(a)google.com> KVM: nVMX: Fold requested virtual interrupt check into has_nested_events() Sean Christopherson <seanjc(a)google.com> KVM: nVMX: Check for pending posted interrupts when looking for nested events Sean Christopherson <seanjc(a)google.com> KVM: nVMX: Add a helper to get highest pending from Posted Interrupt vector Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: prevent TVLV entry number overflow Maíra Canal <mcanal(a)igalia.com> drm/v3d: Skip CSD when it has zeroed workgroups Maíra Canal <mcanal(a)igalia.com> drm/v3d: Store the active job inside the queue's state Ihor Solodrai <ihor.solodrai(a)pm.me> selftests/bpf: Check for timeout in perf_link test Jiri Olsa <jolsa(a)kernel.org> selftests/bpf: Move get_time_ns to testing_helpers.h Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_tables: unconditionally bump set->nelems before insertion Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_tables: fix set size with rbtree backend Florian Westphal <fw(a)strlen.de> netfilter: nf_tables: always increment set element count Eric Dumazet <edumazet(a)google.com> ip6_vti: set netns_immutable on the fallback device. Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Bound VBIOS record-chain walk loops Sean Christopherson <seanjc(a)google.com> KVM: VMX: Make vmread_error_trampoline() uncallable from C code Hangbin Liu <liuhangbin(a)gmail.com> selftests/bpf: move SYS() macro into the test_progs.h Pedro Tammela <pctammela(a)mojatatu.com> net/sched: act_pedit: free pedit keys on bail from offset check Rajat Gupta <rajat.gupta(a)oss.qualcomm.com> net/sched: fix pedit partial COW leading to page cache corruption Pedro Tammela <pctammela(a)mojatatu.com> net/sched: act_pedit: rate limit datapath messages Pedro Tammela <pctammela(a)mojatatu.com> net/sched: act_pedit: check static offsets a priori Jann Horn <jannh(a)google.com> fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios ------------- Diffstat: Documentation/userspace-api/ioctl/ioctl-number.rst | 463 ++++++++++----------- Makefile | 4 +- arch/arm/mm/alignment.c | 4 + arch/arm/mm/fault.c | 94 ++++- arch/loongarch/kernel/smp.c | 1 + arch/mips/dec/prom/console.c | 7 +- arch/mips/kernel/smp.c | 2 + arch/x86/include/asm/kvm-x86-ops.h | 1 - arch/x86/include/asm/kvm_host.h | 1 - arch/x86/kvm/mmu/mmu.c | 28 +- arch/x86/kvm/svm/sev.c | 1 + arch/x86/kvm/vmx/nested.c | 45 +- arch/x86/kvm/vmx/posted_intr.h | 10 + arch/x86/kvm/vmx/vmenter.S | 2 + arch/x86/kvm/vmx/vmx.c | 21 - arch/x86/kvm/vmx/vmx_ops.h | 18 +- arch/x86/kvm/x86.c | 10 +- drivers/char/agp/amd64-agp.c | 2 +- drivers/crypto/qat/qat_common/adf_cfg_common.h | 32 -- drivers/crypto/qat/qat_common/adf_cfg_user.h | 38 -- drivers/crypto/qat/qat_common/adf_common_drv.h | 3 - drivers/crypto/qat/qat_common/adf_ctl_drv.c | 425 +------------------ drivers/crypto/qat/qat_common/adf_dev_mgr.c | 70 ---- drivers/fpga/of-fpga-region.c | 3 +- drivers/gpu/drm/amd/display/dc/bios/bios_parser.c | 15 +- drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | 27 +- .../drm/amd/display/dc/bios/bios_parser_helper.h | 5 + drivers/gpu/drm/v3d/v3d_drv.h | 8 +- drivers/gpu/drm/v3d/v3d_gem.c | 5 +- drivers/gpu/drm/v3d/v3d_irq.c | 24 +- drivers/gpu/drm/v3d/v3d_sched.c | 36 +- drivers/hv/hv_kvp.c | 25 +- drivers/hv/vmbus_drv.c | 29 +- drivers/i2c/i2c-stub.c | 5 + drivers/infiniband/hw/bnxt_re/ib_verbs.c | 2 +- drivers/irqchip/irq-imgpdc.c | 6 + drivers/media/test-drivers/vidtv/vidtv_mux.c | 8 +- drivers/misc/fastrpc.c | 7 +- drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c | 8 +- drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h | 1 + drivers/net/wan/hdlc_ppp.c | 15 +- drivers/net/wireless/ath/ath11k/dp.c | 1 + drivers/net/wireless/mediatek/mt76/mt76x2/usb.c | 1 + .../net/wireless/realtek/rtlwifi/rtl8821ae/trx.h | 2 +- drivers/ntb/hw/epf/ntb_hw_epf.c | 3 +- drivers/power/reset/linkstation-poweroff.c | 2 +- drivers/regulator/core.c | 10 +- drivers/rpmsg/rpmsg_char.c | 8 + drivers/tty/serial/8250/8250_dw.c | 4 +- drivers/tty/vt/vc_screen.c | 2 +- drivers/video/fbdev/core/fbmem.c | 12 + drivers/video/fbdev/core/modedb.c | 2 +- fs/dlm/lockspace.c | 2 +- fs/exfat/dir.c | 4 +- fs/ext4/inline.c | 8 + fs/f2fs/acl.c | 18 +- fs/f2fs/file.c | 9 +- fs/f2fs/inode.c | 9 +- fs/fuse/dev.c | 23 +- fs/fuse/file.c | 8 +- fs/nfs/pnfs.c | 2 +- fs/nfs/pnfs_nfs.c | 4 +- fs/nfsd/nfs2acl.c | 17 +- fs/nfsd/nfs3acl.c | 17 +- fs/nfsd/nfs4recover.c | 3 +- fs/nfsd/nfs4xdr.c | 3 +- fs/ntfs3/xattr.c | 12 + fs/ocfs2/suballoc.c | 22 + fs/smb/server/smb2pdu.c | 5 + fs/smb/server/smbacl.c | 4 +- include/keys/request_key_auth-type.h | 2 + include/linux/kvm_host.h | 7 +- include/linux/lockdep.h | 14 + include/linux/lockdep_types.h | 1 + include/linux/ring_buffer.h | 4 +- include/linux/skmsg.h | 15 +- include/net/netfilter/nf_tables.h | 6 + include/net/phonet/pn_dev.h | 2 +- include/net/tc_act/tc_pedit.h | 1 - kernel/bpf/cgroup.c | 2 +- kernel/futex/requeue.c | 6 + kernel/locking/lockdep.c | 28 +- kernel/locking/rtmutex.c | 3 + kernel/locking/rtmutex_api.c | 2 +- kernel/trace/ring_buffer.c | 67 +-- kernel/trace/trace.c | 14 +- kernel/trace/trace_kdb.c | 8 +- lib/debugobjects.c | 57 ++- mm/vmscan.c | 13 +- net/9p/client.c | 3 +- net/batman-adv/bat_iv_ogm.c | 11 +- net/batman-adv/bat_v.c | 1 + net/batman-adv/bat_v_ogm.c | 23 +- net/batman-adv/bridge_loop_avoidance.c | 28 +- net/batman-adv/distributed-arp-table.c | 12 +- net/batman-adv/fragmentation.c | 22 +- net/batman-adv/fragmentation.h | 3 +- net/batman-adv/netlink.c | 10 +- net/batman-adv/routing.c | 64 ++- net/batman-adv/tp_meter.c | 115 +++-- net/batman-adv/translation-table.c | 32 +- net/batman-adv/tvlv.c | 69 ++- net/batman-adv/types.h | 21 +- net/core/filter.c | 27 ++ net/core/skmsg.c | 16 +- net/ipv4/tcp.c | 4 +- net/ipv4/tcp_bpf.c | 2 +- net/ipv4/tcp_input.c | 14 +- net/ipv4/tcp_minisocks.c | 2 +- net/ipv4/udp.c | 2 +- net/ipv4/udp_bpf.c | 2 +- net/ipv6/ip6_output.c | 4 +- net/ipv6/ip6_vti.c | 1 + net/mac802154/llsec.c | 14 + net/mptcp/pm_userspace.c | 13 +- net/mptcp/protocol.c | 4 +- net/netfilter/nf_tables_api.c | 74 +++- net/netfilter/nft_set_rbtree.c | 43 ++ net/phonet/pn_dev.c | 12 +- net/phonet/pn_netlink.c | 23 +- net/sched/act_pedit.c | 101 +++-- net/tipc/crypto.c | 9 + net/tls/tls_sw.c | 4 + net/unix/af_unix.c | 11 +- security/apparmor/include/policy_unpack.h | 19 + security/apparmor/lsm.c | 16 +- security/apparmor/policy.c | 8 +- security/keys/internal.h | 2 + security/keys/keyctl.c | 24 +- security/keys/keyctl_pkey.c | 9 +- security/keys/request_key_auth.c | 33 +- tools/perf/bench/find-bit-bench.c | 8 +- tools/perf/util/block-range.c | 6 +- tools/testing/selftests/bpf/bench.h | 9 - tools/testing/selftests/bpf/prog_tests/empty_skb.c | 25 +- .../selftests/bpf/prog_tests/kprobe_multi_test.c | 8 - tools/testing/selftests/bpf/prog_tests/perf_link.c | 15 +- .../testing/selftests/bpf/prog_tests/tc_redirect.c | 154 ++++--- .../testing/selftests/bpf/prog_tests/test_tunnel.c | 71 ++-- .../testing/selftests/bpf/prog_tests/xdp_bonding.c | 38 +- .../selftests/bpf/prog_tests/xdp_do_redirect.c | 30 +- .../selftests/bpf/prog_tests/xdp_synproxy.c | 41 +- tools/testing/selftests/bpf/test_progs.h | 15 + tools/testing/selftests/bpf/testing_helpers.h | 10 + tools/testing/selftests/ptp/testptp.c | 19 +- 145 files changed, 1807 insertions(+), 1529 deletions(-)

1 day, 11 hours

[PATCH 5.15 00/95] 5.15.211-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 5.15.211 release. There are 95 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat, 04 Jul 2026 15:50:58 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.211-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 5.15.211-rc1 Thadeu Lima de Souza Cascardo <cascardo(a)igalia.com> dlm: prevent NPD when writing a positive value to event_done Giovanni Cabiddu <giovanni.cabiddu(a)intel.com> crypto: qat - remove unused character device and IOCTLs Herbert Xu <herbert(a)gondor.apana.org.au> crypto: qat - Return pointer directly in adf_ctl_alloc_resources Thorsten Blum <thorsten.blum(a)linux.dev> crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() Bagas Sanjaya <bagasdotme(a)gmail.com> Documentation: ioctl-number: Extend "Include File" column width Gil Portnoy <dddhkts1(a)gmail.com> ksmbd: reject non-VALID session in compound request branch Joanne Koong <joannelkoong(a)gmail.com> fuse: re-lock request before replacing page cache folio Santosh Kalluri <santosh.kalluri129(a)gmail.com> net: phonet: free phonet_device after RCU grace period Kuniyuki Iwashima <kuniyu(a)amazon.com> phonet: Pass net and ifindex to phonet_address_notify(). Kuniyuki Iwashima <kuniyu(a)amazon.com> phonet: Pass ifindex to fill_addr(). Dexuan Cui <decui(a)microsoft.com> Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs Mukesh Ojha <mukesh.ojha(a)oss.qualcomm.com> misc: fastrpc: Fix NULL pointer dereference in rpmsg callback Abel Vesa <abel.vesa(a)linaro.org> misc: fastrpc: Add dma_mask to fastrpc_channel_ctx Thorsten Blum <thorsten.blum(a)linux.dev> hv: utils: handle and propagate errors in kvp_register Paolo Abeni <pabeni(a)redhat.com> mptcp: fix missing wakeups in edge scenarios Michael Bommarito <michael.bommarito(a)gmail.com> NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr Dominik Woźniak <stalion(a)gmail.com> nfsd: check get_user() return when reading princhashlen Jeff Layton <jlayton(a)kernel.org> nfsd: fix posix_acl leak on SETACL decode failure Guannan Wang <wgnbuaa(a)gmail.com> NFSD: Fix SECINFO_NO_NAME decode error cleanup Steffen Persvold <spersvold(a)gmail.com> fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode Ian Bridges <icb(a)fastmail.org> fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var Wentao Liang <vulab(a)iscas.ac.cn> power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() Ashutosh Desai <ashutoshdesai993(a)gmail.com> KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path Zhang Cen <rollkingzzc(a)gmail.com> ocfs2: reject oversized group bitmap descriptors Wentao Liang <vulab(a)iscas.ac.cn> fpga: region: fix use-after-free in child_regions_with_firmware() Qingshuang Fu <fuqingshuang(a)kylinos.cn> irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove Wentao Liang <vulab(a)iscas.ac.cn> pNFS: Fix use-after-free in pnfs_update_layout() Doruk Tan Ozturk <doruk(a)0sec.ai> tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done Fan Wu <fanwu01(a)zju.edu.cn> hdlc_ppp: sync per-proto timers before freeing hdlc state Michael Bommarito <michael.bommarito(a)gmail.com> exfat: fix potential use-after-free in exfat_find_dir_entry() Maciej W. Rozycki <macro(a)orcam.me.uk> MIPS: DEC: Prevent initial console buffer from landing in XKPHYS Dawei Feng <dawei.feng(a)seu.edu.cn> bpf: use kvfree() for replaced sysctl write buffer Zhang Cen <rollkingzzc(a)gmail.com> f2fs: validate ACL entry sizes in f2fs_acl_from_disk() Bitterblue Smith <rtl8821cerfe2(a)gmail.com> wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor Jose Ignacio Tornos Martinez <jtornosm(a)redhat.com> wifi: ath11k: fix warning when unbinding Zenm Chen <zenmchen(a)gmail.com> wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S Shaomin Chen <eeesssooo020(a)gmail.com> keys: Pin request_key_auth payload in instantiate paths Jarkko Sakkinen <jarkko(a)kernel.org> KEYS: fix overflow in keyctl_pkey_params_get_2() Doruk Tan Ozturk <doruk(a)0sec.ai> mac802154: llsec: add skb_cow_data() before in-place crypto Herbert Xu <herbert(a)gondor.apana.org.au> crypto: af_alg - Set merge to zero early in af_alg_sendmsg Yuto Ohnuki <ytohnuki(a)amazon.com> ext4: add bounds check for inline data length in ext4_read_inline_page Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> ntfs3: reject direct userspace writes to reserved $LX* xattrs Bjoern Doebel <doebel(a)amazon.de> ring-buffer: Remove ring_buffer_read_prepare_sync() Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: avoid race of cifsnotfound handler state Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: enforce 2-byte alignment Sven Eckelmann <sven(a)narfation.org> batman-adv: dat: prevent false sharing between VLANs Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: track roam count per VID Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: don't merge change entries with different VIDs Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: handle overlapping packets Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: prevent parallel modifications of last_recv Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: restrict number of unacked list entries Sven Eckelmann <sven(a)narfation.org> batman-adv: v: prevent OGM aggregation on disabled hardif Sven Eckelmann <sven(a)narfation.org> batman-adv: frag: avoid underflow of TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: frag: ensure fragment is writable before modifying TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: fix (m|b)cast csum after decrementing TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: ensure bcast is writable before modifying TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: initialize last_recv_time during init Sven Eckelmann <sven(a)narfation.org> batman-adv: prevent ELP transmission interval underflow Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: add only finished tp_vars to lists Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: fix fast recovery precondition Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: avoid window underflow Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: initialize dec_cwnd explicitly Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: initialize dup_acks explicitly Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: keep unacked list in ascending ordered Yijia Wang <wangyijia.yeah(a)bytedance.com> kselftest/arm64: signal: Skip SVE signal test if not enough VLs supported Sean Christopherson <seanjc(a)google.com> KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level Petr Machata <petrm(a)nvidia.com> Revert "ptp: add testptp mask test" Petr Machata <petrm(a)nvidia.com> Revert "selftest/ptp: update ptp selftest to exercise the gettimex options" Miklos Szeredi <mszeredi(a)redhat.com> virtiofs: fix UAF on submount umount Ruslan Valiyev <linuxoid(a)gmail.com> media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si Yi Yang <yiyang13(a)huawei.com> vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write André Draszik <andre.draszik(a)linaro.org> regulator: core: fix locking in regulator_resolve_supply() error path Jiexun Wang <wangjiexun2025(a)gmail.com> af_unix: Reject SIOCATMARK on non-stream sockets Mathias Nyman <mathias.nyman(a)linux.intel.com> xhci: fix memory leak regression when freeing xhci vdev devices depth first Mingyu Wang <25181214217(a)stu.xidian.edu.cn> agp/amd64: Fix broken error propagation in agp_amd64_probe() Weiming Shi <bestswngs(a)gmail.com> net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() Weiming Shi <bestswngs(a)gmail.com> i2c: stub: Reject I2C block transfers with invalid length Lord Ulf Henrik Holmberg <henrik.holmberg(a)defensify.se> RDMA/bnxt_re: zero shared page before exposing to userspace Jiacheng Shi <billsjc(a)sjtu.edu.cn> vfio/iommu_type1: replace kfree with kvfree Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: light: bh1780: fix PM runtime leak on error path Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: prevent TVLV entry number overflow Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: reject oversized local TVLV buffers Maíra Canal <mcanal(a)igalia.com> drm/v3d: Skip CSD when it has zeroed workgroups Maíra Canal <mcanal(a)igalia.com> drm/v3d: Store the active job inside the queue's state Eric Dumazet <edumazet(a)google.com> ip6_vti: set netns_immutable on the fallback device. Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Bound VBIOS record-chain walk loops Pedro Tammela <pctammela(a)mojatatu.com> net/sched: act_pedit: free pedit keys on bail from offset check Rajat Gupta <rajat.gupta(a)oss.qualcomm.com> net/sched: fix pedit partial COW leading to page cache corruption Pedro Tammela <pctammela(a)mojatatu.com> net/sched: act_pedit: rate limit datapath messages Pedro Tammela <pctammela(a)mojatatu.com> net/sched: act_pedit: check static offsets a priori Jann Horn <jannh(a)google.com> fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios ------------- Diffstat: Documentation/userspace-api/ioctl/ioctl-number.rst | 447 ++++++++++----------- Makefile | 4 +- arch/mips/dec/prom/console.c | 7 +- arch/x86/kvm/mmu/mmu.c | 19 +- arch/x86/kvm/svm/sev.c | 1 + crypto/af_alg.c | 2 + drivers/char/agp/amd64-agp.c | 2 +- drivers/crypto/qat/qat_common/adf_cfg_common.h | 32 -- drivers/crypto/qat/qat_common/adf_cfg_user.h | 38 -- drivers/crypto/qat/qat_common/adf_common_drv.h | 3 - drivers/crypto/qat/qat_common/adf_ctl_drv.c | 421 +------------------ drivers/crypto/qat/qat_common/adf_dev_mgr.c | 70 ---- drivers/fpga/of-fpga-region.c | 3 +- drivers/gpu/drm/amd/display/dc/bios/bios_parser.c | 15 +- drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | 15 +- .../drm/amd/display/dc/bios/bios_parser_helper.h | 5 + drivers/gpu/drm/v3d/v3d_drv.h | 8 +- drivers/gpu/drm/v3d/v3d_gem.c | 5 +- drivers/gpu/drm/v3d/v3d_irq.c | 24 +- drivers/gpu/drm/v3d/v3d_sched.c | 36 +- drivers/hv/hv_kvp.c | 25 +- drivers/hv/vmbus_drv.c | 56 ++- drivers/i2c/i2c-stub.c | 5 + drivers/iio/light/bh1780.c | 4 +- drivers/infiniband/hw/bnxt_re/ib_verbs.c | 2 +- drivers/irqchip/irq-imgpdc.c | 6 + drivers/media/test-drivers/vidtv/vidtv_mux.c | 8 +- drivers/misc/fastrpc.c | 7 +- drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c | 8 +- drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h | 1 + drivers/net/wan/hdlc_ppp.c | 15 +- drivers/net/wireless/ath/ath11k/dp.c | 1 + drivers/net/wireless/mediatek/mt76/mt76x2/usb.c | 1 + .../net/wireless/realtek/rtlwifi/rtl8821ae/trx.h | 2 +- drivers/power/reset/linkstation-poweroff.c | 2 +- drivers/regulator/core.c | 10 +- drivers/tty/vt/vc_screen.c | 2 +- drivers/usb/host/xhci-mem.c | 2 +- drivers/vfio/vfio_iommu_type1.c | 2 +- drivers/video/fbdev/core/fbmem.c | 12 + drivers/video/fbdev/core/modedb.c | 2 +- fs/dlm/lockspace.c | 2 +- fs/exfat/dir.c | 4 +- fs/ext4/inline.c | 8 + fs/f2fs/acl.c | 18 +- fs/fuse/dev.c | 23 +- fs/fuse/file.c | 8 +- fs/ksmbd/smb2pdu.c | 5 + fs/nfs/pnfs.c | 2 +- fs/nfs/pnfs_nfs.c | 4 +- fs/nfsd/nfs2acl.c | 17 +- fs/nfsd/nfs3acl.c | 17 +- fs/nfsd/nfs4recover.c | 3 +- fs/nfsd/nfs4xdr.c | 3 +- fs/ntfs3/xattr.c | 12 + fs/ocfs2/suballoc.c | 22 + include/keys/request_key_auth-type.h | 2 + include/linux/kvm_host.h | 7 +- include/linux/ring_buffer.h | 4 +- include/net/phonet/pn_dev.h | 2 +- include/net/tc_act/tc_pedit.h | 1 - kernel/bpf/cgroup.c | 2 +- kernel/trace/ring_buffer.c | 74 +--- kernel/trace/trace.c | 14 +- kernel/trace/trace_kdb.c | 8 +- net/batman-adv/bat_iv_ogm.c | 11 +- net/batman-adv/bat_v.c | 1 + net/batman-adv/bat_v_ogm.c | 23 +- net/batman-adv/bridge_loop_avoidance.c | 28 +- net/batman-adv/distributed-arp-table.c | 12 +- net/batman-adv/fragmentation.c | 22 +- net/batman-adv/fragmentation.h | 3 +- net/batman-adv/netlink.c | 10 +- net/batman-adv/routing.c | 64 ++- net/batman-adv/tp_meter.c | 115 ++++-- net/batman-adv/translation-table.c | 40 +- net/batman-adv/tvlv.c | 69 +++- net/batman-adv/types.h | 21 +- net/ipv6/ip6_vti.c | 1 + net/mac802154/llsec.c | 14 + net/mptcp/protocol.c | 4 +- net/phonet/pn_dev.c | 12 +- net/phonet/pn_netlink.c | 23 +- net/sched/act_pedit.c | 101 +++-- net/tipc/crypto.c | 9 + net/unix/af_unix.c | 3 + security/keys/internal.h | 2 + security/keys/keyctl.c | 24 +- security/keys/keyctl_pkey.c | 9 +- security/keys/request_key_auth.c | 33 +- .../testcases/fake_sigreturn_sve_change_vl.c | 2 + tools/testing/selftests/ptp/testptp.c | 79 +--- 92 files changed, 1104 insertions(+), 1223 deletions(-)

1 day, 12 hours

韓国ブームに乗った、新規事業

by フランチャイズセミナー事務局｜ K Village 韓国語

　　お世話になります。　　新たな事業展開をお考えの経営者様へ、　「市場は急成長×少競合×上場企業が運営」3拍子揃った、韓国語教室のフランチャイズ説明会をご案内申し上げます。 ━━━━━━━━━━━━━━━━━━━━━━━━ 　　　　7月10日（金）13:00〜14:00 　　　7月19日（日）11:00〜12:00 　　　※内容は同じです。　◆　韓国語ブームを味方に、先行者利益と安定収益を　　　日本最大級の韓国語スクール　　　”K Village 韓国語” 　※　オーナー様に韓国語や業界知識などは不要で、　　　未経験から開業することができます。　◆　セミナーの視聴予約はこちら　　　https://k-village-school.jp/seminar/ ━━━━━━━━━━━━━━━━━━━━━━━━ 　　韓国語の学習業界は、K-POP・韓国ドラマ人気の影響で　急成長しています。　その中でもK Village韓国語は、　東証プライム上場企業グループのブランド力と集客力を背景に、　生徒数15,000人・月間の問合せ数1,500件を超える　日本最大の韓国語教室です。　　24年5月までに開校した、直営する19校舎では黒字化を達成し、　再現性の高い安定したビジネスモデルの構築に成功しました。　　そして、このタイミングでマーケットシェアを一気に拡大して　競合他社を圧倒する経済性をもつ事業へと成長させるべく、　フランチャイズ加盟店を募集する運びとなりました。　韓国語コミュニティをけん引する私たちと、　事業の拡大を共創していきませんか？　　今このタイミングでの加盟は、　他にはない特別な成長機会を得られるチャンスです。　新規事業をお考えでしたらぜひ、ご視聴ください。 ━━━━━━━━━━━━━━━━━━━ 　■　開催日程　　　7月10日（金）13:00〜14:00 　　　7月19日（日）11:00〜12:00 　　　※内容は同じです。　■　開催方式　　　・オンライン開催　■　コンテンツ　　　・韓国語ビジネスの市場と魅力について　　　・K Villageのビジネスモデル　　　・競合優位性と収益の事例　　　・フランチャイズについて　■　主催　　　・株式会社 K Village 　■　定員　　　・10社／各回　■　参加費　　　・不要です　■　視聴のご予約はこちら　　　https://k-village-school.jp/seminar/ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 本メールが不要の方には大変失礼しました。今後ご案内が不要な際は、下記URLにてより手続きを承っています。 https://k-village-school.jp/mail/ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 株式会社 K Village 東京都新宿区西新宿2-4-1 新宿NSビル7F ━━━━━━━━━━━━━━━━━━━━━━━━━━━━

1 day, 19 hours

[PATCH 7.1 000/120] 7.1.3-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 7.1.3 release. There are 120 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat, 04 Jul 2026 15:50:58 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.1.3-rc1.… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.1.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 7.1.3-rc1 John Johansen <john.johansen(a)canonical.com> apparmor: advertise the tcp fast open fix is applied HanQuan <eilaimemedsnaimel(a)gmail.com> net/tcp-ao: fix use-after-free of key in del_async path Hem Parekh <hemparekh1596(a)gmail.com> ksmbd: fix out-of-bounds read in smb_check_perm_dacl() Markus Elfring <elfring(a)users.sourceforge.net> NFS: Prevent resource leak in nfs_alloc_server() Igor Raits <igor.raits(a)gmail.com> NFSv4: clear exception state on successful mkdir retry Michael Bommarito <michael.bommarito(a)gmail.com> NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr Michael Bommarito <michael.bommarito(a)gmail.com> NFSv4/flexfiles: reject zero filehandle version count Jeff Layton <jlayton(a)kernel.org> nfsd: reset write verifier on deferred writeback errors Jeff Layton <jlayton(a)kernel.org> nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race Jeff Layton <jlayton(a)kernel.org> nfsd: fix dead ACL conflict guard in nfsd4_create Dominik Woźniak <stalion(a)gmail.com> nfsd: check get_user() return when reading princhashlen Jeff Layton <jlayton(a)kernel.org> nfsd: fix posix_acl leak and ignored error in nfsd4_create_file Jeff Layton <jlayton(a)kernel.org> nfsd: fix inverted cp_ttl check in async copy reaper Jeff Layton <jlayton(a)kernel.org> nfsd: fix posix_acl leak on SETACL decode failure Guannan Wang <wgnbuaa(a)gmail.com> NFSD: Fix SECINFO_NO_NAME decode error cleanup Chris Mason <clm(a)meta.com> nfsd: release layout stid on setlease failure Johan Hovold <johan(a)kernel.org> i2c: core: fix adapter registration race Steffen Persvold <spersvold(a)gmail.com> fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode Tuo Li <islituo(a)gmail.com> fbdev: modedb: fix a possible UAF in fb_find_mode() Hongling Zeng <zenghongling(a)kylinos.cn> fbdev: omap2: fix use-after-free in omapfb_mmap Mingyu Wang <25181214217(a)stu.xidian.edu.cn> fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font() Ian Bridges <icb(a)fastmail.org> fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var Hyunchul Lee <hyc.lee(a)gmail.com> ntfs: serialize volume label accesses Vivian Wang <wangruikang(a)iscas.ac.cn> riscv: kfence: Call mark_new_valid_map() for kfence_unprotect() Wentao Liang <vulab(a)iscas.ac.cn> power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() Ashutosh Desai <ashutoshdesai993(a)gmail.com> KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path Hyunwoo Kim <imv4bel(a)gmail.com> KVM: x86: hyper-v: Bound the bank index when querying sparse banks Jonas Jelonek <jelonek.jonas(a)gmail.com> MIPS: smp: report dying CPU to RCU in stop_this_cpu() Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> 9p: avoid putting oldfid in p9_client_walk() error path Zhang Cen <rollkingzzc(a)gmail.com> ocfs2: reject oversized group bitmap descriptors Yuho Choi <dbgh9129(a)gmail.com> rpmsg: char: Fix use-after-free on probe error path Wentao Liang <vulab(a)iscas.ac.cn> fpga: region: fix use-after-free in child_regions_with_firmware() Qingshuang Fu <fuqingshuang(a)kylinos.cn> irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove Rik van Riel <riel(a)surriel.com> sched/mmcid: Fix OOB clear_bit when CID is MM_CID_UNSET in fixup path Wentao Liang <vulab(a)iscas.ac.cn> pNFS: Fix use-after-free in pnfs_update_layout() Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Report dying CPU to RCU in stop_this_cpu() Doruk Tan Ozturk <doruk(a)0sec.ai> tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done Michal Koutný <mkoutny(a)suse.com> blk-cgroup: fix UAF in __blkcg_rstat_flush() Fan Wu <fanwu01(a)zju.edu.cn> hdlc_ppp: sync per-proto timers before freeing hdlc state Wentao Liang <vulab(a)iscas.ac.cn> pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next() Tristan Madani <tristan(a)talencesecurity.com> gfs2: fix use-after-free in gfs2_qd_dealloc Sam James <sam(a)gentoo.org> crypto: nx - fix nx_crypto_ctx_exit argument Sean Christopherson <seanjc(a)google.com> KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() Sean Christopherson <seanjc(a)google.com> KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level Michael Bommarito <michael.bommarito(a)gmail.com> exfat: fix potential use-after-free in exfat_find_dir_entry() Maciej W. Rozycki <macro(a)orcam.me.uk> MIPS: DEC: Prevent initial console buffer from landing in XKPHYS Dawei Feng <dawei.feng(a)seu.edu.cn> bpf: use kvfree() for replaced sysctl write buffer Denis Arefev <arefev(a)swemel.ru> block: Avoid mounting the bdev pseudo-filesystem in userspace Mikhail Lobanov <m.lobanov(a)rosa.ru> f2fs: read COW data with the original inode during atomic write Wenjie Qi <qwjhust(a)gmail.com> f2fs: keep atomic write retry from zeroing original data Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node() Zhaoyang Huang <zhaoyang.huang(a)unisoc.com> Revert "f2fs: remove non-uptodate folio from the page cache in move_data_block" Zhang Cen <rollkingzzc(a)gmail.com> f2fs: validate ACL entry sizes in f2fs_acl_from_disk() Bryam Vargas <hexlabsecurity(a)proton.me> f2fs: bound i_inline_xattr_size for non-inline-xattr inodes Sunmin Jeong <s_min.jeong(a)samsung.com> f2fs: fix to round down start offset of fallocate for pin file Chao Yu <chao(a)kernel.org> f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode Wenjie Qi <qwjhust(a)gmail.com> f2fs: validate compress cache inode only when enabled Wenjie Qi <qwjhust(a)gmail.com> f2fs: validate orphan inode entry count Chao Yu <chao(a)kernel.org> f2fs: fix to do sanity check on f2fs_get_node_folio_ra() Wenjie Qi <qwjhust(a)gmail.com> f2fs: reject setattr size changes on large folio files Wenjie Qi <qwjhust(a)gmail.com> f2fs: pass correct iostat type for single node writes Wenjie Qi <qiwenjie(a)xiaomi.com> f2fs: fix missing read bio submission on large folio error Junrui Luo <moonafterrain(a)outlook.com> wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers Junjie Cao <junjie.cao(a)intel.com> wifi: iwlwifi: mld: fix race condition in PTP removal Junjie Cao <junjie.cao(a)intel.com> wifi: iwlwifi: mvm: fix race condition in PTP removal Luka Gejak <luka.gejak(a)linux.dev> wifi: rtw88: usb: fix memory leaks on USB write failures Luka Gejak <luka.gejak(a)linux.dev> wifi: rtw88: increase TX report timeout to fix race condition Bitterblue Smith <rtl8821cerfe2(a)gmail.com> wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor Bitterblue Smith <rtl8821cerfe2(a)gmail.com> wifi: rtl8xxxu: Detect the maximum supported channel width Jose Ignacio Tornos Martinez <jtornosm(a)redhat.com> wifi: ath11k: fix warning when unbinding ElXreno <elxreno(a)gmail.com> wifi: mt76: mt7925: don't disable AP BSS when removing TDLS peer Zenm Chen <zenmchen(a)gmail.com> wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S Kiryl Shutsemau (Meta) <kas(a)kernel.org> userfaultfd: build __VMA_UFFD_FLAGS from config-gated masks Mike Rapoport (Microsoft) <rppt(a)kernel.org> userfaultfd: ensure mremap_userfaultfd_fail() releases mmap_changing Shaomin Chen <eeesssooo020(a)gmail.com> keys: Pin request_key_auth payload in instantiate paths Jarkko Sakkinen <jarkko(a)kernel.org> KEYS: fix overflow in keyctl_pkey_params_get_2() Konstantin Khorenko <khorenko(a)virtuozzo.com> gcov: use atomic counter updates to fix concurrent access crashes Arnd Bergmann <arnd(a)arndb.de> err.h: use __always_inline on all error pointer helpers Ard Biesheuvel <ardb(a)kernel.org> KVM: arm64: Omit tag sync on stage-2 mappings of the zero page Usama Arif <usama.arif(a)linux.dev> block: invalidate cached plug timestamp after task switch Eric Biggers <ebiggers(a)kernel.org> fscrypt: Fix key setup in edge case with multiple data unit sizes Ian Bridges <icb(a)fastmail.org> fbdev: fix use-after-free in store_modes() Koichiro Den <den(a)valinux.co.jp> NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR Ruslan Valiyev <linuxoid(a)gmail.com> apparmor: fix use-after-free in rawdata dedup loop Bryam Vargas <hexlabsecurity(a)proton.me> apparmor: mediate the implicit connect of TCP fast open sendmsg Lukas Wunner <lukas(a)wunner.de> PCI/P2PDMA: Add Intel QAT, DSA, IAA devices to whitelist Maoyi Xie <maoyixie.tju(a)gmail.com> net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink Yiming Qian <yimingqian591(a)gmail.com> net: skmsg: preserve sg.copy across SG transforms Doruk Tan Ozturk <doruk(a)0sec.ai> mac802154: llsec: add skb_cow_data() before in-place crypto Jiajia Liu <liujiajia(a)kylinos.cn> wifi: mt76: add wcid publish check in mt76_sta_add Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> ntfs3: reject direct userspace writes to reserved $LX* xattrs Wongi Lee <qw3rtyp0(a)gmail.com> ipv4: account for fraggap on the paged allocation path Wongi Lee <qw3rtyp0(a)gmail.com> ipv6: account for fraggap on the paged allocation path Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: avoid race of cifsnotfound handler state Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: enforce 2-byte alignment Sven Eckelmann <sven(a)narfation.org> batman-adv: dat: prevent false sharing between VLANs Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: track roam count per VID Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: don't merge change entries with different VIDs Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: handle overlapping packets Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: prevent parallel modifications of last_recv Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: restrict number of unacked list entries Sven Eckelmann <sven(a)narfation.org> batman-adv: v: prevent OGM aggregation on disabled hardif Sven Eckelmann <sven(a)narfation.org> batman-adv: frag: avoid underflow of TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: frag: ensure fragment is writable before modifying TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: fix (m|b)cast csum after decrementing TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: ensure bcast is writable before modifying TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: gw: don't deselect gateway with active hardif Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: initialize last_recv_time during init Sven Eckelmann <sven(a)narfation.org> batman-adv: prevent ELP transmission interval underflow Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: add only finished tp_vars to lists Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: fix fast recovery precondition Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: avoid window underflow Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: initialize dec_cwnd explicitly Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: initialize dup_acks explicitly Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: keep unacked list in ascending ordered Paolo Bonzini <pbonzini(a)redhat.com> KVM: x86: Fix shadow paging use-after-free due to unexpected role ------------- Diffstat: Makefile | 31 ++++-- arch/arm64/kvm/mmu.c | 5 + arch/loongarch/kernel/smp.c | 1 + arch/mips/dec/prom/console.c | 7 +- arch/mips/kernel/smp.c | 2 + arch/riscv/include/asm/kfence.h | 7 +- arch/riscv/kernel/entry.S | 6 +- arch/x86/kvm/hyperv.c | 5 + arch/x86/kvm/mmu/mmu.c | 28 +++-- arch/x86/kvm/svm/sev.c | 1 + block/bdev.c | 5 - block/blk-cgroup.c | 21 ++-- .../intel/qat/qat_common/adf_accel_devices.h | 5 - drivers/crypto/nx/nx.c | 6 +- drivers/crypto/nx/nx.h | 2 +- drivers/dma/idxd/registers.h | 3 - drivers/fpga/of-fpga-region.c | 3 +- drivers/i2c/i2c-core-base.c | 8 +- drivers/irqchip/irq-imgpdc.c | 6 ++ drivers/net/wan/hdlc_ppp.c | 15 ++- drivers/net/wireless/ath/ath11k/dp.c | 1 + drivers/net/wireless/intel/iwlwifi/mld/agg.c | 9 ++ drivers/net/wireless/intel/iwlwifi/mld/ptp.c | 2 +- drivers/net/wireless/intel/iwlwifi/mvm/ptp.c | 2 +- drivers/net/wireless/mediatek/mt76/mac80211.c | 15 ++- drivers/net/wireless/mediatek/mt76/mt76x2/usb.c | 1 + drivers/net/wireless/mediatek/mt76/mt7925/main.c | 3 + drivers/net/wireless/realtek/rtl8xxxu/8188e.c | 1 + drivers/net/wireless/realtek/rtl8xxxu/8188f.c | 1 + drivers/net/wireless/realtek/rtl8xxxu/8192c.c | 1 + drivers/net/wireless/realtek/rtl8xxxu/8192e.c | 1 + drivers/net/wireless/realtek/rtl8xxxu/8192f.c | 1 + drivers/net/wireless/realtek/rtl8xxxu/8710b.c | 1 + drivers/net/wireless/realtek/rtl8xxxu/8723a.c | 1 + drivers/net/wireless/realtek/rtl8xxxu/8723b.c | 1 + drivers/net/wireless/realtek/rtl8xxxu/core.c | 64 ++++++++++- drivers/net/wireless/realtek/rtl8xxxu/regs.h | 2 + drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h | 7 ++ .../net/wireless/realtek/rtlwifi/rtl8821ae/trx.h | 2 +- drivers/net/wireless/realtek/rtw88/tx.c | 7 +- drivers/net/wireless/realtek/rtw88/usb.c | 13 ++- drivers/ntb/hw/epf/ntb_hw_epf.c | 3 +- drivers/pci/p2pdma.c | 10 ++ drivers/power/reset/linkstation-poweroff.c | 2 +- drivers/power/sequencing/core.c | 14 ++- drivers/rpmsg/rpmsg_char.c | 15 ++- drivers/video/fbdev/core/fbcon.c | 7 ++ drivers/video/fbdev/core/fbmem.c | 12 +++ drivers/video/fbdev/core/fbsysfs.c | 10 +- drivers/video/fbdev/core/modedb.c | 5 +- drivers/video/fbdev/omap2/omapfb/omapfb-main.c | 9 +- fs/crypto/fscrypt_private.h | 52 +++++---- fs/crypto/inline_crypt.c | 8 +- fs/crypto/keyring.c | 23 ++-- fs/crypto/keysetup.c | 118 +++++++++++++-------- fs/exfat/dir.c | 4 +- fs/f2fs/acl.c | 18 +++- fs/f2fs/checkpoint.c | 14 ++- fs/f2fs/data.c | 49 +++++---- fs/f2fs/extent_cache.c | 19 ++-- fs/f2fs/f2fs.h | 1 + fs/f2fs/file.c | 11 +- fs/f2fs/gc.c | 56 +++++++--- fs/f2fs/inode.c | 26 +++-- fs/f2fs/node.c | 8 +- fs/gfs2/super.c | 1 + fs/nfs/client.c | 1 + fs/nfs/flexfilelayout/flexfilelayout.c | 4 + fs/nfs/nfs4proc.c | 5 +- fs/nfs/pnfs.c | 2 +- fs/nfs/pnfs_nfs.c | 4 +- fs/nfsd/nfs2acl.c | 17 ++- fs/nfsd/nfs3acl.c | 17 ++- fs/nfsd/nfs4layouts.c | 12 +-- fs/nfsd/nfs4proc.c | 19 ++-- fs/nfsd/nfs4recover.c | 3 +- fs/nfsd/nfs4state.c | 1 + fs/nfsd/nfs4xdr.c | 3 +- fs/nfsd/vfs.c | 6 +- fs/ntfs/file.c | 17 ++- fs/ntfs/super.c | 21 ++-- fs/ntfs/volume.h | 2 + fs/ntfs3/xattr.c | 12 +++ fs/ocfs2/suballoc.c | 22 ++++ fs/smb/server/smbacl.c | 4 +- fs/userfaultfd.c | 2 + include/keys/request_key_auth-type.h | 2 + include/linux/blkdev.h | 16 ++- include/linux/err.h | 12 +-- include/linux/f2fs_fs.h | 1 + include/linux/kvm_host.h | 7 +- include/linux/mm.h | 39 +++++++ include/linux/pci_ids.h | 8 ++ include/linux/skmsg.h | 15 ++- include/linux/userfaultfd_k.h | 4 +- include/net/rtnetlink.h | 2 + kernel/bpf/cgroup.c | 2 +- kernel/sched/core.c | 27 +++-- net/9p/client.c | 3 +- net/batman-adv/bat_iv_ogm.c | 11 +- net/batman-adv/bat_v.c | 1 + net/batman-adv/bat_v_ogm.c | 23 +++- net/batman-adv/bridge_loop_avoidance.c | 28 ++--- net/batman-adv/distributed-arp-table.c | 12 ++- net/batman-adv/fragmentation.c | 22 +++- net/batman-adv/fragmentation.h | 3 +- net/batman-adv/hard-interface.c | 28 +---- net/batman-adv/netlink.c | 10 +- net/batman-adv/routing.c | 73 ++++++++++++- net/batman-adv/tp_meter.c | 115 +++++++++++++------- net/batman-adv/translation-table.c | 12 ++- net/batman-adv/tvlv.c | 69 ++++++++++-- net/batman-adv/types.h | 21 ++-- net/core/filter.c | 27 +++++ net/core/rtnetlink.c | 8 ++ net/core/skmsg.c | 2 + net/ipv4/ip_gre.c | 6 ++ net/ipv4/ip_output.c | 7 +- net/ipv4/tcp_ao.c | 4 + net/ipv6/ip6_output.c | 9 +- net/mac802154/llsec.c | 14 +++ net/tipc/crypto.c | 9 ++ net/tls/tls_sw.c | 4 + security/apparmor/include/policy_unpack.h | 19 ++++ security/apparmor/lsm.c | 16 ++- security/apparmor/net.c | 2 + security/apparmor/policy.c | 8 +- security/keys/internal.h | 2 + security/keys/keyctl.c | 24 +++-- security/keys/keyctl_pkey.c | 9 +- security/keys/request_key_auth.c | 33 +++++- virt/kvm/eventfd.c | 12 +-- 132 files changed, 1312 insertions(+), 441 deletions(-)

4 days, 6 hours

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

Lkft-triage