Lkft-triage

lkft-triage@lists.linaro.org

23 participants
34125 discussions

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.12.90 release. There are 144 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sun, 17 May 2026 15:46:37 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.90-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.12.90-rc1 Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vcn4: Avoid overflow on msg bound check Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vcn3: Avoid overflow on msg bound check Dudu Lu <phx0fer(a)gmail.com> vsock/virtio: fix accept queue count leak on transport mismatch Eric Dumazet <edumazet(a)google.com> vsock/virtio: fix potential unbounded skb queue Stefano Garzarella <sgarzare(a)redhat.com> vsock/virtio: fix empty payload in tap skb for non-linear buffers Stefano Garzarella <sgarzare(a)redhat.com> vsock/virtio: fix length and offset in tap skb for split packets Norbert Szetei <norbert(a)doyensec.com> vsock: fix buffer size clamping order Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: fix tp_num leak on kmalloc failure Jiexun Wang <wangjiexun2025(a)gmail.com> batman-adv: stop tp_meter sessions during mesh teardown Steven Rostedt <rostedt(a)goodmis.org> tracing/probes: Limit size of event probe to 3K Yochai Eisenrich <yochaie(a)sweet.security> btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak Guangshuo Li <lgs201920130244(a)gmail.com> btrfs: fix double free in create_space_info_sub_group() error path Filipe Manana <fdmanana(a)suse.com> btrfs: remove fs_info argument from btrfs_sysfs_add_space_info_type() Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() Martin Michaelis <code(a)mgjm.de> io_uring/kbuf: support min length left for incremental buffers Nikolay Aleksandrov <razor(a)blackwall.org> bonding: fix use-after-free due to enslave fail after slave array update Miguel Ojeda <ojeda(a)kernel.org> rust: allow `clippy::collapsible_if` globally Miguel Ojeda <ojeda(a)kernel.org> rust: allow `clippy::collapsible_match` globally SeongJae Park <sj(a)kernel.org> mm/damon/reclaim: detect and use fresh enabled and kdamond_pid values SeongJae Park <sj(a)kernel.org> mm/damon/lru_sort: detect and use fresh enabled and kdamond_pid values SeongJae Park <sj(a)kernel.org> mm/damon/core: implement damon_kdamond_pid() SeongJae Park <sj(a)kernel.org> mm/damon/core: disallow time-quota setting zero esz Gary Guo <gary(a)garyguo.net> rust: pin-init: fix incorrect accessor reference lifetime Thomas Zimmermann <tzimmermann(a)suse.de> fbcon: Avoid OOB font access if console rotation fails David Carlier <devnexen(a)gmail.com> tracefs: Fix default permissions not being applied on initial mount Damien Le Moal <dlemoal(a)kernel.org> block: fix zone write plug removal Damien Le Moal <dlemoal(a)kernel.org> block: reorganize struct blk_zone_wplug Damien Le Moal <dlemoal(a)kernel.org> block: cleanup blkdev_report_zones() Sang-Heon Jeon <ekffu200098(a)gmail.com> mm/hugetlb_cma: round up per_node before logging it Johan Hovold <johan(a)kernel.org> spi: uniphier: fix controller deregistration Pei Xiao <xiaopei01(a)kylinos.cn> spi: uniphier: Simplify clock handling with devm_clk_get_enabled() Johan Hovold <johan(a)kernel.org> spi: tegra114: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: tegra20-sflash: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: zynq-qspi: fix controller deregistration Pei Xiao <xiaopei01(a)kylinos.cn> spi: zynq-qspi: Simplify clock handling with devm_clk_get_enabled() David Carlier <devnexen(a)gmail.com> Bluetooth: hci_conn: fix potential UAF in create_big_sync Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: seq: Fix UMP group 16 filtering Takashi Iwai <tiwai(a)suse.de> ALSA: seq: Notify client and port info changes Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: core: Serialize deferred fasync state checks Takashi Iwai <tiwai(a)suse.de> ALSA: misc: Use guard() for spin locks Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: hda: cs35l56: Propagate ASP TX source control errors Selvarasu Ganesan <selvarasu.g(a)samsung.com> usb: dwc3: Move GUID programming after PHY initialization Amit Sunil Dhamne <amitsd(a)google.com> usb: typec: tcpm: reset internal port states on soft reset AMS Andrea Righi <arighi(a)nvidia.com> sched_ext: Use HK_TYPE_DOMAIN_BOOT to detect isolcpus= domain isolation Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: put backbone reference on failed claim hash insert Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: only purge non-released claims Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: prevent use-after-free when deleting claims Jiexun Wang <wangjiexun2025(a)gmail.com> batman-adv: stop caching unowned originator pointers in BAT IV Jiexun Wang <wangjiexun2025(a)gmail.com> batman-adv: reject new tp_meter sessions during teardown Lyes Bourennani <lbourennani(a)fuzzinglabs.com> batman-adv: fix integer overflow on buff_pos Ben Morris <bmorris(a)anthropic.com> sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL Siddharth Vadapalli <s-vadapalli(a)ti.com> arm64: dts: ti: k3-am62a7-sk: Fix pin name in comment from M19 to N22 Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/pm: align Hawaii mclk workaround with radeon Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/pm: add missing revision check for CI John B. Moore <jbmoore61(a)gmail.com> drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission Felix Kuehling <felix.kuehling(a)amd.com> drm/amdkfd: Make all TLB-flushes heavy-weight Icenowy Zheng <zhengxingda(a)iscas.ac.cn> drm/panel: boe-tv101wum-nl6: restore MODE_LPM after sending disable cmds John B. Moore <jbmoore61(a)gmail.com> drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ Icenowy Zheng <zhengxingda(a)iscas.ac.cn> drm/panel: himax-hx83102: restore MODE_LPM after sending disable cmds Osama Abdelkader <osama.abdelkader(a)gmail.com> drm/exynos: remove bridge when component_add fails Philip Yang <Philip.Yang(a)amd.com> drm/amdgpu: zero-initialize GART table on allocation Alex Deucher <alexander.deucher(a)amd.com> drm/radeon: add missing revision check for CI Shuicheng Lin <shuicheng.lin(a)intel.com> drm/xe/bo: Fix bo leak on unaligned size validation in xe_bo_init_locked() Shuicheng Lin <shuicheng.lin(a)intel.com> drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() Shuicheng Lin <shuicheng.lin(a)intel.com> drm/xe/bo: Fix bo leak on GGTT flag validation in xe_bo_init_locked() Alysa Liu <Alysa.Liu(a)amd.com> drm/amdkfd: validate SVM ioctl nattr against buffer size Ashutosh Desai <ashutoshdesai993(a)gmail.com> drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() Mario Kleiner <mario.kleiner.de(a)gmail.com> drm/amd/display: Change dither policy for 10 bpc output back to dithering Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vce: Prevent partial address patches Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vcn4: Prevent OOB reads when parsing IB Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu: Add bounds checking to ib_{get,set}_value Alysa Liu <Alysa.Liu(a)amd.com> drm/amdkfd: Add upper bound check for num_of_nodes Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: fix incorrect FeatureCtrlMask setting on smu v14.0.x Chenglei Xie <Chenglei.Xie(a)amd.com> drm/amdgpu: gate VM CPU HDP flush on reset lock Ramalingeswara Reddy, Kanala <Kanala.RamalingeswaraReddy(a)amd.com> drm/amdgpu: Use SMUIO 15.0.0 offsets for TSC upper and lower count. Amir Shetaia <Amir.Shetaia(a)amd.com> drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Init variable to avoid early exit from et alignment loop Yasuaki Torimaru <yasuakitorimaru(a)gmail.com> drm/msm/gem: fix error handling in msm_ioctl_gem_info_get_metadata() Johan Hovold <johan(a)kernel.org> spi: cadence: fix unclocked access on unbind Johan Hovold <johan(a)kernel.org> spi: cadence: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: mpc52xx: fix use-after-free on unbind Johan Hovold <johan(a)kernel.org> spi: mpc52xx: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: mpc52xx: fix use-after-free on registration failure Johan Hovold <johan(a)kernel.org> spi: orion: fix clock imbalance on registration failure Johan Hovold <johan(a)kernel.org> spi: orion: fix runtime pm leak on unbind Johan Hovold <johan(a)kernel.org> spi: orion: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: mxic: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: imx: fix runtime pm leak on probe deferral Johan Hovold <johan(a)kernel.org> spi: img-spfi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: rspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sprd: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: pic32-sqi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: npcm-pspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: coldfire-qspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: bcmbca-hsspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: fsl: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sh-hspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: pl022: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: mtk-nor: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: pic32: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: omap2-mcspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: fsl-espi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: s3c64xx: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: dln2: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: mxs: fix controller deregistration Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> media: omap3isp: drop the use count of v4l2 pipeline Matthias Fend <matthias.fend(a)emfend.at> media: i2c: ov08d10: fix image vertical start setting Michael Tretter <m.tretter(a)pengutronix.de> media: staging: imx: request mbus_config in csi_start Wenmeng Liu <wenmeng.liu(a)oss.qualcomm.com> media: i2c: imx412: Assert reset GPIO during probe Sergey Shtylyov <s.shtylyov(a)auroraos.dev> media: dib8000: avoid division by 0 in dib8000_set_dds() Abdun Nihaal <nihaal(a)cse.iitm.ac.in> media: pci: zoran: fix potential memory leak in zoran_probe() Luigi Leonardi <leonardi(a)redhat.com> vsock/virtio: fix MSG_PEEK ignoring skb offset when calculating bytes to copy Krishna Chomal <krishna.chomal108(a)gmail.com> platform/x86: hp-wmi: Ignore backlight and FnLock events Johan Hovold <johan(a)kernel.org> spi: aspeed-smc: fix controller deregistration Wang Jun <1742789905(a)qq.com> media: saa7164: add ioremap return checks and cleanups Johan Hovold <johan(a)kernel.org> spi: at91-usart: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: qup: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: meson-spicc: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: lantiq-ssc: fix controller deregistration Johan Hovold <johan(a)kernel.org> regulator: bd9571mwv: fix OF node reference imbalance Johan Hovold <johan(a)kernel.org> regulator: act8945a: fix OF node reference imbalance Jai Luthra <jai.luthra(a)ideasonboard.com> media: i2c: imx283: Fix hang when going from large to small resolution Ethan Tidmore <ethantidmore06(a)gmail.com> media: intel/ipu6: fix error pointer dereference Janne Grunau <j(a)jannau.net> media: videobuf2: Set vma_flags in vb2_dma_sg_mmap Johan Hovold <johan(a)kernel.org> regulator: rk808: fix OF node reference imbalance Jai Luthra <jai.luthra(a)ideasonboard.com> media: i2c: imx283: Enter full standby when stopping streaming Oliver Neukum <oneukum(a)suse.com> media: rc: streamzap: Error handling in probe Oliver Neukum <oneukum(a)suse.com> media: rc: xbox_remote: heed DMA restrictions Johan Hovold <johan(a)kernel.org> regulator: max77650: fix OF node reference imbalance Johan Hovold <johan(a)kernel.org> spi: st-ssc4: fix controller deregistration Johan Hovold <johan(a)kernel.org> regulator: mt6357: fix OF node reference imbalance Sakari Ailus <sakari.ailus(a)linux.intel.com> staging: media: atomisp: Disallow all private IOCTLs Josua Mayer <josua(a)solid-run.com> arm64: dts: lx2160a-cex7/lx2162a-sr-som: fix usd-cd & gpio pinmux Johan Hovold <johan(a)kernel.org> spi: atmel: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: bcm63xx: fix controller deregistration Ziyi Guo <n7l8m4(a)u.northwestern.edu> media: chips-media: wave5: add missing spinlock protection for handle_dynamic_resolution_change() Ziyi Guo <n7l8m4(a)u.northwestern.edu> media: chips-media: wave5: add missing spinlock protection for send_eos_event() Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> media: chips-media: wave5: fix a potential memory leak in wave5_vdi_init() Alexander Koskovich <akoskovich(a)pm.me> media: i2c: ov8856: free control handler on error in ov8856_init_controls() Guoniu Zhou <guoniu.zhou(a)nxp.com> media: nxp: imx8-isi: Reduce minimum queued buffers from 2 to 0 Ricardo Ribalda <ribalda(a)chromium.org> media: uvcvideo: Enable VB2_DMABUF for metadata stream T.J. Mercier <tjmercier(a)google.com> HID: playstation: Clamp num_touch_reports ------------- Diffstat: Makefile | 6 +- .../arm64/boot/dts/freescale/fsl-lx2160a-cex7.dtsi | 7 + .../dts/freescale/fsl-lx2160a-clearfog-itx.dtsi | 2 + arch/arm64/boot/dts/freescale/fsl-lx2160a.dtsi | 24 +++ .../boot/dts/freescale/fsl-lx2162a-clearfog.dts | 2 + .../boot/dts/freescale/fsl-lx2162a-sr-som.dtsi | 7 + arch/arm64/boot/dts/ti/k3-am62a7-sk.dts | 2 +- block/blk-zoned.c | 170 +++++++++------------ drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 3 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c | 13 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h | 11 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c | 3 + drivers/gpu/drm/amd/amdgpu/amdgpu_vm_cpu.c | 12 +- drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 31 +++- drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 3 - drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c | 4 +- drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c | 25 ++- drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c | 46 ++++-- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 33 +++- .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 6 +- drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 10 +- drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 4 +- drivers/gpu/drm/amd/amdkfd/kfd_topology.c | 11 ++ drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 2 +- .../gpu/drm/amd/pm/powerplay/smumgr/ci_smumgr.c | 13 +- .../gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c | 10 +- drivers/gpu/drm/drm_gem_framebuffer_helper.c | 4 +- drivers/gpu/drm/exynos/exynos_drm_mic.c | 8 +- drivers/gpu/drm/i915/display/intel_psr.c | 2 +- drivers/gpu/drm/msm/msm_drv.c | 7 +- drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c | 2 + drivers/gpu/drm/panel/panel-himax-hx83102.c | 2 + drivers/gpu/drm/radeon/ci_dpm.c | 9 +- drivers/gpu/drm/xe/xe_bo.c | 8 +- drivers/gpu/drm/xe/xe_dma_buf.c | 11 +- drivers/hid/hid-playstation.c | 6 +- drivers/media/common/videobuf2/videobuf2-dma-sg.c | 1 + drivers/media/dvb-frontends/dib8000.c | 4 +- drivers/media/i2c/imx283.c | 15 +- drivers/media/i2c/imx412.c | 2 +- drivers/media/i2c/ov08d10.c | 10 +- drivers/media/i2c/ov8856.c | 10 +- drivers/media/pci/intel/ipu6/ipu6.c | 2 +- drivers/media/pci/saa7164/saa7164-core.c | 47 ++++-- drivers/media/pci/zoran/zoran_card.c | 2 +- .../media/platform/chips-media/wave5/wave5-vdi.c | 1 + .../platform/chips-media/wave5/wave5-vpu-dec.c | 14 +- .../media/platform/nxp/imx8-isi/imx8-isi-video.c | 2 +- drivers/media/platform/ti/omap3isp/ispvideo.c | 1 + drivers/media/rc/streamzap.c | 12 +- drivers/media/rc/xbox_remote.c | 9 +- drivers/media/usb/uvc/uvc_queue.c | 3 +- drivers/net/bonding/bond_main.c | 6 +- drivers/platform/x86/hp/hp-wmi.c | 5 + drivers/regulator/act8945a-regulator.c | 3 +- drivers/regulator/bd9571mwv-regulator.c | 3 +- drivers/regulator/max77650-regulator.c | 2 +- drivers/regulator/mt6357-regulator.c | 2 +- drivers/regulator/rk808-regulator.c | 3 +- drivers/spi/spi-aspeed-smc.c | 9 +- drivers/spi/spi-at91-usart.c | 8 +- drivers/spi/spi-atmel.c | 8 +- drivers/spi/spi-bcm63xx.c | 8 +- drivers/spi/spi-bcmbca-hsspi.c | 4 +- drivers/spi/spi-cadence.c | 15 +- drivers/spi/spi-coldfire-qspi.c | 10 +- drivers/spi/spi-dln2.c | 8 +- drivers/spi/spi-fsl-espi.c | 10 +- drivers/spi/spi-fsl-spi.c | 14 +- drivers/spi/spi-img-spfi.c | 8 +- drivers/spi/spi-imx.c | 1 + drivers/spi/spi-lantiq-ssc.c | 8 +- drivers/spi/spi-meson-spicc.c | 8 +- drivers/spi/spi-mpc52xx.c | 9 +- drivers/spi/spi-mtk-nor.c | 4 +- drivers/spi/spi-mxic.c | 3 +- drivers/spi/spi-mxs.c | 8 +- drivers/spi/spi-npcm-pspi.c | 8 +- drivers/spi/spi-omap2-mcspi.c | 8 +- drivers/spi/spi-orion.c | 16 +- drivers/spi/spi-pic32-sqi.c | 8 +- drivers/spi/spi-pic32.c | 11 +- drivers/spi/spi-pl022.c | 8 +- drivers/spi/spi-qup.c | 8 +- drivers/spi/spi-rspi.c | 10 +- drivers/spi/spi-s3c64xx.c | 4 +- drivers/spi/spi-sh-hspi.c | 10 +- drivers/spi/spi-sprd.c | 8 +- drivers/spi/spi-st-ssc4.c | 8 +- drivers/spi/spi-tegra114.c | 8 +- drivers/spi/spi-tegra20-sflash.c | 8 +- drivers/spi/spi-uniphier.c | 24 ++- drivers/spi/spi-zynq-qspi.c | 55 ++----- drivers/staging/media/atomisp/pci/atomisp_ioctl.c | 4 + drivers/staging/media/imx/imx-media-csi.c | 40 +++-- drivers/usb/dwc3/core.c | 12 +- drivers/usb/typec/tcpm/tcpm.c | 2 + drivers/video/fbdev/core/fbcon_rotate.c | 5 +- fs/btrfs/ioctl.c | 5 +- fs/btrfs/space-info.c | 8 +- fs/btrfs/sysfs.c | 5 +- fs/btrfs/sysfs.h | 3 +- fs/tracefs/inode.c | 1 + include/linux/damon.h | 2 + include/uapi/linux/io_uring.h | 3 +- io_uring/kbuf.c | 8 +- io_uring/kbuf.h | 7 + kernel/sched/ext.c | 3 +- kernel/trace/trace_probe.c | 6 + kernel/trace/trace_probe.h | 4 +- mm/damon/core.c | 34 +++++ mm/damon/lru_sort.c | 88 +++++++---- mm/damon/reclaim.c | 88 +++++++---- mm/hugetlb.c | 1 + net/batman-adv/bat_iv_ogm.c | 85 ++++++++--- net/batman-adv/bridge_loop_avoidance.c | 11 +- net/batman-adv/main.c | 1 + net/batman-adv/tp_meter.c | 116 +++++++++++--- net/batman-adv/tp_meter.h | 1 + net/batman-adv/types.h | 4 + net/bluetooth/hci_conn.c | 19 ++- net/bluetooth/l2cap_sock.c | 3 + net/sctp/socket.c | 9 ++ net/vmw_vsock/af_vsock.c | 6 +- net/vmw_vsock/virtio_transport_common.c | 57 +++---- rust/kernel/init/__internal.rs | 28 ++-- rust/kernel/init/macros.rs | 91 ++++++----- sound/core/misc.c | 33 ++-- sound/core/seq/seq_clientmgr.c | 9 +- sound/core/seq/seq_clientmgr.h | 5 +- sound/core/seq/seq_ump_client.c | 4 +- sound/pci/hda/cs35l56_hda.c | 19 ++- 132 files changed, 1265 insertions(+), 588 deletions(-)

3 weeks, 5 days

Mise à jour de sécurité de vos cartes clés personnelles

by unknown＠example.com

● Vous avez reçu une information Merci d'en prendre connaissance dans les meilleurs délais. Une prise d’initiative de votre part pourrait être nécessaire. Cliquez ci-dessous pour y accéder : Accéder à mon compte Mentions Légales Vous recevez ce message parce que vous nous avez communiqué votre adresse e-mail. Nous recueillons des statistiques d'ouverture des emails grâce à l'affichage des images incluses dans le message. Lorsque votre application email le permet, vous pouvez à tout moment les accepter ou les refuser en paramétrant leur affichage. Le CIC garantit l'utilisation de vos données personnelles dans le respect de la législation. Si vous ne souhaitez plus recevoir de communication commerciale de notre part, cliquez ici. Ce message et toutes les pièces jointes sont confidentiels et établis à l'intention exclusive de son ou ses destinataires. Si vous avez reçu ce message par erreur, merci d'en avertir immédiatement l'émetteur et de détruire le message. Une banque qui appartient à ses clients, ça change tout.  

3 weeks, 6 days

2026年上海MWC——参会者名录

by Pamela Kelly

您好，我们目前正提供 MWC 上海 2026 参会者名单的访问权限，该名单包含了 44,753 位经过验证且已明确同意接收信息的参会联系人。该数据库涵盖了姓名、职位、公司名称、电话号码及官方电子邮箱等信息，助您高效触达关键决策者，并有力支持您的销售线索挖掘工作。如果您对此感兴趣，请告知我，我很乐意为您提供详细的报价信息。诚挚地， Pamela Kelly 高级需求生成专员附注：如不希望继续接收此类信息，请回复“No Thanks”。

4 weeks

[PATCH 6.18 000/268] 6.18.30-rc2 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.18.30 release. There are 268 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Fri, 15 May 2026 15:37:20 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.30-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.18.30-rc2 Prathyushi Nangia <prathyushi.nangia(a)amd.com> x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache Gary Guo <gary(a)garyguo.net> rust: pin-init: fix incorrect accessor reference lifetime Sam Edwards <cfsworks(a)gmail.com> net: stmmac: Prevent NULL deref when RX memory exhausted Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY() Thorsten Blum <thorsten.blum(a)linux.dev> crypto: caam - guard HMAC key hex dumps in hash_digest_key Thorsten Blum <thorsten.blum(a)linux.dev> printk: add print_hex_dump_devel() Junrui Luo <moonafterrain(a)outlook.com> erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap() Gao Xiang <xiang(a)kernel.org> erofs: tidy up z_erofs_lz4_handle_overlap() Zilin Guan <zilin(a)seu.edu.cn> hfsplus: fix held lock freed on hfsplus_fill_super() Deepanshu Kartikey <kartikey406(a)gmail.com> hfsplus: fix uninit-value by validating catalog record size Krzysztof Kozlowski <krzysztof.kozlowski(a)oss.qualcomm.com> firmware: exynos-acpm: Drop fake 'const' on handle pointer Kairui Song <kasong(a)tencent.com> mm, swap: speed up hibernation allocation and writeout Suman Kumar Chakraborty <suman.kumar.chakraborty(a)intel.com> crypto: qat - fix firmware loading failure for GEN6 devices Suman Kumar Chakraborty <suman.kumar.chakraborty(a)intel.com> crypto: qat - fix indentation of macros in qat_hal.c Luke Wang <ziniu.wang_1(a)nxp.com> mmc: core: Optimize time for secure erase/trim for some Kingston eMMCs Avri Altman <avri.altman(a)sandisk.com> mmc: core: Add quirk for incorrect manufacturing date Avri Altman <avri.altman(a)sandisk.com> mmc: core: Adjust MDT beyond 2025 David Carlier <devnexen(a)gmail.com> octeon_ep_vf: add NULL check for napi_build_skb() Thomas Weißschuh <linux(a)weissschuh.net> hwmon: (powerz) Avoid cacheline sharing for DMA buffer Michael S. Tsirkin <mst(a)redhat.com> dma-mapping: add __dma_from_device_group_begin()/end() Thomas Zimmermann <tzimmermann(a)suse.de> fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info SeongJae Park <sj(a)kernel.org> mm/damon/core: disallow non-power of two min_region_sz on damon_start() Alexei Starovoitov <ast(a)kernel.org> bpf: Fix use-after-free in arena_vm_close on fork Jens Axboe <axboe(a)kernel.dk> io_uring/tw: serialize ctx->retry_llist with ->uring_lock Martin Michaelis <code(a)mgjm.de> io_uring/kbuf: support min length left for incremental buffers Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Use per-root-bridge PCIH flag to skip mem resource fixup Tao Cui <cuitao(a)kylinos.cn> LoongArch: KVM: Use kvm_set_pte() in kvm_flush_pte() Bibo Mao <maobibo(a)loongson.cn> LoongArch: KVM: Move unconditional delay into timer clear scenery Bibo Mao <maobibo(a)loongson.cn> LoongArch: KVM: Fix HW timer interrupt lost when inject interrupt by software Xianglai Li <lixianglai(a)loongson.cn> LoongArch: KVM: Fix "unreliable stack" for kvm_exc_entry Qiang Ma <maqianga(a)uniontech.com> LoongArch: KVM: Cap KVM_CAP_NR_VCPUS by KVM_CAP_MAX_VCPUS Wentao Guan <guanwentao(a)uniontech.com> LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang() Fuad Tabba <tabba(a)google.com> KVM: arm64: Fix pin leak and publication ordering in __pkvm_init_vcpu() Fuad Tabba <tabba(a)google.com> KVM: arm64: Fix FEAT_Debugv8p9 to check DebugVer, not PMUVer Fuad Tabba <tabba(a)google.com> KVM: arm64: Fix FEAT_SPE_FnE to use PMSIDR_EL1.FnE, not PMSVer Quentin Perret <qperret(a)google.com> KVM: arm64: Fix initialisation order in __pkvm_init_finalise() David Woodhouse <dwmw(a)amazon.co.uk> KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value Marc Zyngier <maz(a)kernel.org> KVM: arm64: Wake-up from WFI when iqrchip is in userspace Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix fsck inconsistency caused by FGGC of node block Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix inline data not being written to disk in writeback path Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: refactor f2fs_move_node_folio function Guangshuo Li <lgs201920130244(a)gmail.com> f2fs: fix uninitialized kobject put in f2fs_init_sysfs() Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix node_cnt race between extent node destroy and writeback Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix incorrect multidevice info in trace_f2fs_map_blocks() Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix incorrect file address mapping when inline inode is unwritten Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix fsck inconsistency caused by incorrect nat_entry flag usage Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix fiemap boundary handling when read extent cache is incomplete Cen Zhang <zzzccc427(a)gmail.com> f2fs: add READ_ONCE() for i_blocks in f2fs_update_inode() Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: return early if no retrans Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: free sk if last Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: always decrease sk refcount Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: fix potential data-race Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: allow ID 0 Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: kernel: correctly retransmit ADD_ADDR ID 0 Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: prio: skip closed subflows Gang Yan <yangang(a)kylinos.cn> mptcp: fix scheduling with atomic in timestamp sockopt Paolo Abeni <pabeni(a)redhat.com> mptcp: fix rx timestamp corruption on fastopen Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: sockopt: increase seq in mptcp_setsockopt_all_sf Gang Yan <yangang(a)kylinos.cn> mptcp: sockopt: set timestamp flags on subflow socket, not msk Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: fastclose msk when linger time is 0 Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: mptcp: pm: restrict 'unknown' check to pm_nl_ctl Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: mptcp: check output: catch cmd errors David Carlier <devnexen(a)gmail.com> sched_ext: idle: Recheck prev_cpu after narrowing allowed mask Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/rxe: Reject unknown opcodes before ICRC processing Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() Junrui Luo <moonafterrain(a)outlook.com> RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Validate rx_hash_key_len Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/ionic: Fix typo in format string Kai Zen <kai.aizen.dev(a)gmail.com> RDMA/ionic: bound node_desc sysfs read with %.64s Dapeng Mi <dapeng1.mi(a)linux.intel.com> perf/x86/intel: Always reprogram ACR events to prevent stale masks Nilay Shroff <nilay(a)linux.ibm.com> powerpc/xive: fix kmemleak caused by incorrect chip_data lookup André Draszik <andre.draszik(a)linaro.org> power: supply: max17042: avoid overflow when determining health Lukas Wunner <lukas(a)wunner.de> PCI/ASPM: Fix pci_clear_and_set_config_dword() usage Lukas Wunner <lukas(a)wunner.de> PCI/AER: Stop ruling out unbound devices as error source Shuai Xue <xueshuai(a)linux.alibaba.com> PCI/AER: Clear only error bits in PCIe Device Status Lukas Wunner <lukas(a)wunner.de> PCI: Update saved_config_space upon resource assignment SeongJae Park <sj(a)kernel.org> mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock SeongJae Park <sj(a)kernel.org> mm/damon/stat: detect and use fresh enabled value Paolo Bonzini <pbonzini(a)redhat.com> KVM: x86: Do IRR scan in __kvm_apic_update_irr even if PIR is empty Paolo Bonzini <pbonzini(a)redhat.com> KVM: x86: check for nEPT/nNPT in slow flush hypercalls Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: validate dacloffset before building DACL pointers Bjoern Doebel <doebel(a)amazon.de> smb: client: use kzalloc to zero-initialize security descriptor buffer Zisen Ye <zisenye(a)stu.xidian.edu.cn> smb/client: fix out-of-bounds read in symlink_data() Zisen Ye <zisenye(a)stu.xidian.edu.cn> smb/client: fix out-of-bounds read in smb2_compound_op() Ranjan Kumar <ranjan.kumar(a)broadcom.com> scsi: mpt3sas: Limit NVMe request size to 2 MiB Pengpeng Hou <pengpeng(a)iscas.ac.cn> s390/debug: Reject zero-length input before trimming a newline Vasily Gorbik <gor(a)linux.ibm.com> s390/debug: Reject zero-length input in debug_input_flush_fn() Osama Abdelkader <osama.abdelkader(a)gmail.com> riscv: kvm: fix vector context allocation leak Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/hns: Fix unlocked call to hns_roce_qp_remove() David Carlier <devnexen(a)gmail.com> psp: strip variable-length PSP header in psp_dev_rcv() Ulf Hansson <ulf.hansson(a)linaro.org> pmdomain: core: Fix detach procedure for virtual devices in genpd Ilya Maximets <i.maximets(a)ovn.org> openvswitch: vport: fix self-deadlock on release of tunnel ports Chaitanya Kulkarni <kch(a)nvidia.com> nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free Chaitanya Kulkarni <kch(a)nvidia.com> nvmet-tcp: fix race between ICReq handling and queue teardown Fedor Pchelkin <pchelkin(a)ispras.ru> nvme-apple: drop invalid put of admin queue reference count Junrui Luo <moonafterrain(a)outlook.com> md/raid10: fix divide-by-zero in setup_geo() with zero far_copies Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Fix slab-out-of-bounds access in auth message processing Christian A. Ehrhardt <lk(a)c--e.de> lib/scatterlist: fix temp buffer in extract_user_to_sg() Christian A. Ehrhardt <lk(a)c--e.de> lib/scatterlist: fix length calculations in extract_kvec_to_sg Lukas Wunner <lukas(a)wunner.de> lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() Nicolin Chen <nicolinc(a)nvidia.com> iommu/arm-smmu-v3: Add a missing dma_wmb() for hitless STE update Zhenzhong Duan <zhenzhong.duan(a)intel.com> iommu/vt-d: Block PASID attachment to nested domain with dirty tracking Zhenzhong Duan <zhenzhong.duan(a)intel.com> iommufd: Fix return value of iommufd_fault_fops_write() Michael Bommarito <michael.bommarito(a)gmail.com> isofs: validate block number from NFS file handle in isofs_export_iget Michael Bommarito <michael.bommarito(a)gmail.com> isofs: validate Rock Ridge CE continuation extent against volume size Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: correctly reject too-small hash devices Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: correctly reject too-small FEC devices David Carlier <devnexen(a)gmail.com> eventfs: Hold eventfs_mutex and SRCU when remount walks events Mikulas Patocka <mpatocka(a)redhat.com> dm: fix a buffer overflow in ioctl processing Mikulas Patocka <mpatocka(a)redhat.com> dm: don't report warning when doing deferred remove Mikulas Patocka <mpatocka(a)redhat.com> dm-thin: fix metadata refcount underflow Filipe Manana <fdmanana(a)suse.com> btrfs: fix missing last_unlink_trans update when removing a directory Guangshuo Li <lgs201920130244(a)gmail.com> btrfs: fix double free in create_space_info() error path Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm: remove child devices when apm is removed Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error Joseph Salisbury <joseph.salisbury(a)oracle.com> ASoC: fsl_easrc: fix comment typo Li Jian <lazycat-xiao(a)foxmail.com> ASoC: ES8389: convert to devm_clk_get_optional() to get clock Tommaso Soncin <soncintommaso(a)gmail.com> ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table Shrikanth Hegde <sshegde(a)linux.ibm.com> cpuidle: powerpc: avoid double clear when breaking snooze Conor Dooley <conor.dooley(a)microchip.com> clk: microchip: mpfs-ccc: fix out of bounds access during output registration Stefan Eichenberger <stefan.eichenberger(a)toradex.com> clk: imx: imx8-acm: fix flags for acm clocks Steven Rostedt <rostedt(a)goodmis.org> tracing/probes: Limit size of event probe to 3K Johan Hovold <johan(a)kernel.org> spi: topcliff-pch: fix use-after-free on unbind Johan Hovold <johan(a)kernel.org> spi: topcliff-pch: fix controller deregistration Thorsten Blum <thorsten.blum(a)linux.dev> thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp Thorsten Blum <thorsten.blum(a)linux.dev> thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> thermal: core: Free thermal zone ID later during removal Michael Bommarito <michael.bommarito(a)gmail.com> udf: reject descriptors with oversized CRC length David Carlier <devnexen(a)gmail.com> tracefs: Fix default permissions not being applied on initial mount Conor Dooley <conor.dooley(a)microchip.com> spi: microchip-core-qspi: control built-in cs manually Conor Dooley <conor.dooley(a)microchip.com> spi: microchip-core-qspi: don't attempt to transmit during emulated read-only dual/quad operations Johan Hovold <johan(a)kernel.org> spi: microchip-core-qspi: fix controller deregistration Guangshuo Li <lgs201920130244(a)gmail.com> ice: fix double free in ice_sf_eth_activate() error path Mingming Cao <mmc(a)linux.ibm.com> ibmveth: Disable GSO for packets with small MSS Dexuan Cui <decui(a)microsoft.com> hv_sock: Return -EIO for malformed/short packets Dexuan Cui <decui(a)microsoft.com> hv_sock: Report EOF instead of -EIO for FIN Hamza Mahfooz <hamzamahfooz(a)linux.microsoft.com> hv_sock: fix ARM64 support Thomas Zimmermann <tzimmermann(a)suse.de> hv: Select CONFIG_SYSFB only for CONFIG_HYPERV_VMBUS Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> gpio: of: clear OF_POPULATED on hog nodes in remove path Xu Yang <xu.yang_2(a)nxp.com> extcon: ptn5150: handle pending IRQ events during system resume Shyam Prasad N <sprasad(a)microsoft.com> cifs: change_conf needs to be called for session setup Shyam Prasad N <sprasad(a)microsoft.com> cifs: abort open_cached_dir if we don't request leases Jens Axboe <axboe(a)kernel.dk> block: only read from sqe on initial invocation of blkdev_uring_cmd() Naman Jain <namjain(a)linux.microsoft.com> block: add pgmap check to biovec_phys_mergeable Wentao Liang <vulab(a)iscas.ac.cn> pmdomain: mediatek: fix use-after-free in scpsys_get_bus_protection_legacy() Breno Leitao <leitao(a)debian.org> arm64/fpsimd: ptrace: zero target's fpsimd_state, not the tracer's Jiexun Wang <wangjiexun2025(a)gmail.com> af_unix: Reject SIOCATMARK on non-stream sockets Myeonghun Pak <mhun512(a)gmail.com> hwmon: (corsair-psu) Close HID device on probe errors Johan Hovold <johan(a)kernel.org> clk: rk808: fix OF node reference imbalance Sanman Pradhan <psanman(a)juniper.net> hwmon: (ltc2992) Fix u32 overflow in power read path Sanman Pradhan <psanman(a)juniper.net> hwmon: (ltc2992) Clamp threshold writes to hardware range Ivan Hu <ivan.hu(a)canonical.com> x86/efi: Fix graceful fault handling after FPU softirq changes Hongling Zeng <zenghongling(a)kylinos.cn> parisc: Fix IRQ leak in LASI driver Tzung-Bi Shih <tzungbi(a)kernel.org> platform/chrome: cros_ec_typec: Init mutex in Thunderbolt registration Pavitra Jha <jhapavitra98(a)gmail.com> net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler Nan Li <tonanli66(a)gmail.com> net/rds: handle zerocopy send cleanup before the message is queued Breno Leitao <leitao(a)debian.org> netpoll: pass buffer size to egress_dev() to avoid MAC truncation Jiawen Wu <jiawenwu(a)trustnetic.com> net: libwx: use request_irq for VF misc interrupt Maoyi Xie <maoyixie.tju(a)gmail.com> ip6_gre: Use cached t->net in ip6erspan_changelink(). Jiawen Wu <jiawenwu(a)trustnetic.com> net: libwx: fix VF illegal register access Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> pseries/papr-hvpipe: Fix the usage of copy_to_user() Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> pseries/papr-hvpipe: Fix & simplify error handling in papr_hvpipe_init() Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> pseries/papr-hvpipe: Prevent kernel stack memory leak to userspace SeungJu Cheon <suunj1331(a)gmail.com> sound: ua101: fix division by zero at probe Dapeng Mi <dapeng1.mi(a)linux.intel.com> perf/x86/intel: Improve validation and configuration of ACR masks Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: skip inactive subflows Kai Zen <kai.aizen.dev(a)gmail.com> net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Fix SYM_SIGFUNC_START definition for 32BIT Sang-Heon Jeon <ekffu200098(a)gmail.com> mm/hugetlb_cma: round up per_node before logging it Kevin Brodsky <kevin.brodsky(a)arm.com> arm64: signal: Preserve POR_EL0 if poe_context is missing Tudor Ambarus <tudor.ambarus(a)linaro.org> mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show() Fuad Tabba <tabba(a)google.com> KVM: arm64: Fix kvm_vcpu_initialized() macro parameter Miklos Szeredi <mszeredi(a)redhat.com> fanotify: fix false positive on permission events Johan Hovold <johan(a)kernel.org> staging: vme_user: fix root device leak on init failure Johan Hovold <johan(a)kernel.org> spi: s3c64xx: fix NULL-deref on driver unbind Johan Hovold <johan(a)kernel.org> spi: zynqmp-gqspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sun6i: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: ti-qspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sun4i: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: syncuacer: fix controller deregistration Miguel Ojeda <ojeda(a)kernel.org> rust: allow `clippy::collapsible_if` globally Miguel Ojeda <ojeda(a)kernel.org> rust: allow `clippy::collapsible_match` globally Eliot Courtney <ecourtney(a)nvidia.com> rust: drm: gem: clean up GEM state in init failure case Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt Tristan Madani <tristan(a)talencesecurity.com> Bluetooth: btmtk: validate WMT event SKB length before struct access Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: virtio_bt: validate rx pkt_type header length Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: virtio_bt: clamp rx length before skb_put Tao Cui <cuitao(a)kylinos.cn> LoongArch: KVM: Fix missing EMULATE_FAIL in kvm_emu_mmio_read() Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: prune /sys/fs/selinux/user Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: prune /sys/fs/selinux/disable Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: prune /sys/fs/selinux/checkreqprot Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: shrink critical section in sel_write_load() David Windsor <dwindsor(a)gmail.com> selinux: don't reserve xattr slot when we won't fill it Zongyao Chen <ZongYao.Chen(a)linux.alibaba.com> selinux: use sk blob accessor in socket permission helpers Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: fix avdcache auditing Michael Bommarito <michael.bommarito(a)gmail.com> xfrm: ah: account for ESN high bits in async callbacks Yilin Zhu <zylzyl2333(a)gmail.com> ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() Michal Kosiorek <mkosiorek121(a)gmail.com> xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete Ruijie Li <ruijieli51(a)gmail.com> xfrm: provide message size for XFRM_MSG_MAPPING Ard Biesheuvel <ardb(a)kernel.org> x86/efi: Restore IRQ state in EFI page fault handler Sourabh Jain <sourabhjain(a)linux.ibm.com> powerpc/kdump: fix KASAN sanitization flag for core_$(BITS).o Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: seq: Fix UMP group 16 filtering Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: core: Serialize deferred fasync state checks Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: firewire-tascam: Do not drop unread control events Yuriy Padlyak <yuriypadlyak(a)gmail.com> ALSA: hda/realtek: Fix speaker silence after S3 resume on Xiaomi Mi Laptop Pro 15 Takashi Iwai <tiwai(a)suse.de> ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: hda: cs35l56: Propagate ASP TX source control errors Xu Yang <xu.yang_2(a)nxp.com> usb: typec: tcpm: fix debug accessory mode detection for sink ports Felix Gu <ustc.gu(a)gmail.com> usb: ulpi: fix memory leak on ulpi_register() error paths Fabio Porcedda <fabio.porcedda(a)gmail.com> USB: serial: option: add Telit Cinterion LE910Cx compositions Aaro Koskinen <aaro.koskinen(a)iki.fi> USB: omap_udc: DMA: Don't enable burst 4 mode Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Fix UAC3 cluster descriptor size check Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: midi2: Restart output URBs on resume Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: usblp: fix heap leak in IEEE 1284 device ID via short response Marek Szyprowski <m.szyprowski(a)samsung.com> wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task Tristan Madani <tristan(a)talencesecurity.com> wifi: b43: enforce bounds check on firmware key index in b43_rx() Johannes Berg <johannes.berg(a)intel.com> wifi: mac80211: remove station if connection prep fails Jiri Slaby (SUSE) <jirislaby(a)kernel.org> wifi: ath5k: do not access array OOB Benjamin Berg <benjamin.berg(a)intel.com> wifi: mac80211: use safe list iteration in radar detect work Jeongjun Park <aha310510(a)gmail.com> wifi: rsi: fix kthread lifetime race between self-exit and external-stop Catherine <enderaoelyther(a)gmail.com> wifi: mac80211: drop stray 'static' from fast-RX rx_result Tristan Madani <tristan(a)talencesecurity.com> wifi: b43legacy: enforce bounds check on firmware key index in RX path Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work Leon Yen <leon.yen(a)mediatek.com> wifi: mt76: mt7921: fix a potential clc buffer length underflow Ming Yen Hsieh <mingyen.hsieh(a)mediatek.com> wifi: mt76: mt7925: fix incorrect length field in txpower command Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7925: fix AMPDU state handling in mt7925_tx_check_aggr Jann Horn <jannh(a)google.com> exit: prevent preemption of oopsing TASK_DEAD task Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked Ovidiu Panait <ovidiu.panait.rb(a)renesas.com> net: stmmac: Disable EEE RX clock stop when VLAN is enabled Paolo Bonzini <pbonzini(a)redhat.com> KVM: SVM: check validity of VMCB controls when returning from SMM Zhengchuan Liang <zcliangcn(a)gmail.com> net: af_key: zero aligned sockaddr tail in PF_KEY exports Yi Kuo <yi(a)yikuo.dev> smb: client/smbdirect: fix MR registration for coalesced SG lists Gang Yan <yangang(a)kylinos.cn> mptcp: sync the msk->sndbuf at accept() time Qingfang Deng <qingfang.deng(a)linux.dev> flow_dissector: do not dissect PPPoE PFC frames Sam Edwards <cfsworks(a)gmail.com> ceph: fix num_ops off-by-one when crypto allocation fails Sean Christopherson <seanjc(a)google.com> KVM: x86: Fix shadow paging use-after-free due to unexpected GFN DaeMyung Kang <charsyam(a)gmail.com> ksmbd: rewrite stop_sessions() with restartable iteration Johan Hovold <johan(a)kernel.org> spi: rockchip: fix controller deregistration Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7925: fix incorrect TLV length in CLC command Mark Brown <broonie(a)kernel.org> ASoC: SOF: Don't allow pointer operations on unconfigured streams Sina Hassani <sina(a)openai.com> iommufd: Fix a race with concurrent allocation and unmap David Carlier <devnexen(a)gmail.com> tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() Shivam Kalra <shivamkalra98(a)zohomail.in> ACPI: video: force native backlight on HP OMEN 16 (8A44) Jinjie Ruan <ruanjinjie(a)huawei.com> ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug Jan Schär <jan(a)jschaer.ch> ACPI: video: Add backlight=native quirk for Dell OptiPlex 7770 AIO Guangshuo Li <lgs201920130244(a)gmail.com> ACPI: scan: Use acpi_dev_put() in object add error paths Rajat Gupta <rajgupt(a)qti.qualcomm.com> fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free Corey Minyard <corey(a)minyard.net> ipmi:si: Return state to normal if message allocation fails Corey Minyard <corey(a)minyard.net> ipmi: Check event message buffer response for bad data Corey Minyard <corey(a)minyard.net> ipmi: Add limits to event and receive message requests Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() ------------- Diffstat: .../ABI/{obsolete => removed}/sysfs-selinux-user | 0 Makefile | 6 +- arch/arm64/include/asm/kvm_host.h | 2 +- arch/arm64/kernel/ptrace.c | 4 +- arch/arm64/kernel/signal.c | 54 +++++-- arch/arm64/kvm/arm.c | 4 + arch/arm64/kvm/config.c | 17 +- arch/arm64/kvm/hyp/nvhe/pkvm.c | 38 +++-- arch/arm64/kvm/hyp/nvhe/setup.c | 8 +- arch/arm64/kvm/vgic/vgic-mmio-v2.c | 2 +- arch/arm64/kvm/vgic/vgic-mmio-v3.c | 2 +- arch/loongarch/include/asm/linkage.h | 2 +- arch/loongarch/kvm/exit.c | 1 + arch/loongarch/kvm/interrupt.c | 14 ++ arch/loongarch/kvm/mmu.c | 2 +- arch/loongarch/kvm/switch.S | 2 +- arch/loongarch/kvm/timer.c | 10 +- arch/loongarch/kvm/vm.c | 2 +- arch/loongarch/pci/acpi.c | 5 + arch/loongarch/pci/pci.c | 3 + arch/powerpc/kexec/Makefile | 2 +- arch/powerpc/platforms/pseries/papr-hvpipe.c | 53 +++--- arch/powerpc/sysdev/xive/common.c | 16 +- arch/riscv/kvm/vcpu_vector.c | 5 +- arch/s390/kernel/debug.c | 8 + arch/x86/events/core.c | 13 +- arch/x86/events/intel/core.c | 32 +++- arch/x86/include/asm/efi.h | 3 +- arch/x86/include/asm/msr-index.h | 3 +- arch/x86/kernel/cpu/amd.c | 3 + arch/x86/kvm/hyperv.c | 2 +- arch/x86/kvm/lapic.c | 8 +- arch/x86/kvm/mmu/mmu.c | 35 ++-- arch/x86/kvm/svm/nested.c | 12 +- arch/x86/kvm/svm/svm.c | 4 + arch/x86/kvm/svm/svm.h | 1 + arch/x86/mm/fault.c | 2 +- arch/x86/platform/efi/quirks.c | 13 +- block/blk.h | 2 + block/ioctl.c | 24 +-- drivers/acpi/cppc_acpi.c | 6 +- drivers/acpi/power.c | 2 +- drivers/acpi/scan.c | 2 +- drivers/acpi/video_detect.c | 16 ++ drivers/android/binder/range_alloc/array.rs | 1 - drivers/bluetooth/btmtk.c | 15 +- drivers/bluetooth/virtio_bt.c | 39 ++++- drivers/char/ipmi/ipmi_si_intf.c | 70 ++++++-- drivers/char/ipmi/ipmi_ssif.c | 23 ++- drivers/clk/clk-rk808.c | 2 +- drivers/clk/imx/clk-imx8-acm.c | 3 +- drivers/clk/microchip/clk-mpfs-ccc.c | 6 +- drivers/cpuidle/cpuidle-powernv.c | 5 +- drivers/cpuidle/cpuidle-pseries.c | 5 +- drivers/crypto/caam/caamalg_qi2.c | 4 +- drivers/crypto/caam/caamhash.c | 4 +- .../crypto/intel/qat/qat_common/adf_accel_engine.c | 7 + .../qat/qat_common/icp_qat_fw_loader_handle.h | 1 + drivers/crypto/intel/qat/qat_common/qat_hal.c | 27 ++-- drivers/extcon/extcon-ptn5150.c | 14 ++ drivers/firmware/samsung/exynos-acpm-pmic.c | 10 +- drivers/firmware/samsung/exynos-acpm-pmic.h | 10 +- drivers/firmware/samsung/exynos-acpm.c | 16 +- drivers/firmware/samsung/exynos-acpm.h | 2 +- drivers/gpio/gpiolib-of.c | 9 +- drivers/hv/Kconfig | 2 +- drivers/hwmon/corsair-psu.c | 4 +- drivers/hwmon/ltc2992.c | 41 +++-- drivers/hwmon/powerz.c | 5 +- drivers/infiniband/hw/hns/hns_roce_qp.c | 7 + drivers/infiniband/hw/ionic/ionic_ibdev.c | 2 +- drivers/infiniband/hw/mana/cq.c | 5 +- drivers/infiniband/hw/mana/qp.c | 16 +- drivers/infiniband/hw/mlx4/srq.c | 4 +- drivers/infiniband/hw/mlx5/main.c | 1 + drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 4 +- drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c | 2 +- drivers/infiniband/sw/rxe/rxe_recv.c | 11 ++ drivers/infiniband/sw/rxe/rxe_resp.c | 14 +- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 7 + drivers/iommu/intel/nested.c | 6 +- drivers/iommu/iommufd/eventq.c | 5 +- drivers/iommu/iommufd/io_pagetable.c | 10 ++ drivers/md/dm-ioctl.c | 6 +- drivers/md/dm-verity-fec.c | 8 +- drivers/md/persistent-data/dm-btree-remove.c | 8 + drivers/md/raid10.c | 2 + drivers/mfd/sec-acpm.c | 10 +- drivers/mmc/core/card.h | 11 ++ drivers/mmc/core/mmc.c | 12 ++ drivers/mmc/core/queue.c | 9 +- drivers/mmc/core/quirks.h | 12 ++ drivers/mtd/spi-nor/debugfs.c | 4 +- drivers/net/ethernet/ibm/ibmveth.c | 22 +++ drivers/net/ethernet/ibm/ibmveth.h | 1 + drivers/net/ethernet/intel/ice/ice_sf_eth.c | 2 + .../ethernet/marvell/octeon_ep_vf/octep_vf_rx.c | 36 ++++- drivers/net/ethernet/mellanox/mlx4/srq.c | 13 +- drivers/net/ethernet/stmicro/stmmac/chain_mode.c | 2 +- drivers/net/ethernet/stmicro/stmmac/common.h | 2 +- drivers/net/ethernet/stmicro/stmmac/ring_mode.c | 2 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 47 +++--- drivers/net/ethernet/wangxun/libwx/wx_hw.c | 7 +- drivers/net/ethernet/wangxun/libwx/wx_vf_common.c | 4 +- drivers/net/wireless/ath/ath5k/base.c | 3 +- drivers/net/wireless/broadcom/b43/xmit.c | 3 +- drivers/net/wireless/broadcom/b43legacy/xmit.c | 3 +- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 6 +- drivers/net/wireless/mediatek/mt76/mt7921/main.c | 7 +- drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | 3 + drivers/net/wireless/mediatek/mt76/mt7925/mac.c | 6 +- drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 4 +- drivers/net/wireless/rsi/rsi_common.h | 5 +- drivers/net/wwan/t7xx/t7xx_modem_ops.c | 20 ++- drivers/net/wwan/t7xx/t7xx_port_ctrl_msg.c | 18 ++- drivers/net/wwan/t7xx/t7xx_port_proxy.h | 2 +- drivers/nvme/host/apple.c | 6 +- drivers/nvme/target/core.c | 2 +- drivers/nvme/target/tcp.c | 26 +++ drivers/parisc/lasi.c | 12 +- drivers/pci/pci.c | 7 +- drivers/pci/pcie/aer.c | 2 - drivers/pci/pcie/aspm.c | 17 +- drivers/pci/setup-res.c | 2 + drivers/platform/chrome/cros_typec_altmode.c | 1 + drivers/pmdomain/core.c | 10 +- drivers/pmdomain/mediatek/mtk-pm-domains.c | 10 +- drivers/power/supply/max17042_battery.c | 2 +- drivers/scsi/mpt3sas/mpt3sas_scsih.c | 14 +- drivers/spi/spi-microchip-core-qspi.c | 103 +++++++++--- drivers/spi/spi-rockchip.c | 4 +- drivers/spi/spi-s3c64xx.c | 5 - drivers/spi/spi-sun4i.c | 10 +- drivers/spi/spi-sun6i.c | 8 +- drivers/spi/spi-synquacer.c | 8 +- drivers/spi/spi-ti-qspi.c | 14 +- drivers/spi/spi-topcliff-pch.c | 11 +- drivers/spi/spi-zynqmp-gqspi.c | 4 +- drivers/staging/vme_user/vme_fake.c | 2 + drivers/target/target_core_configfs.c | 2 +- drivers/thermal/sprd_thermal.c | 4 +- drivers/thermal/thermal_core.c | 6 +- drivers/usb/class/usblp.c | 3 +- drivers/usb/common/ulpi.c | 5 +- drivers/usb/gadget/udc/omap_udc.c | 4 - drivers/usb/serial/option.c | 4 + drivers/usb/typec/tcpm/tcpm.c | 25 +-- drivers/video/fbdev/core/fb_defio.c | 178 ++++++++++++++++----- drivers/video/fbdev/udlfb.c | 31 +++- fs/btrfs/inode.c | 2 + fs/btrfs/space-info.c | 2 +- fs/ceph/addr.c | 4 + fs/erofs/decompressor.c | 86 +++++----- fs/f2fs/data.c | 28 +++- fs/f2fs/extent_cache.c | 17 +- fs/f2fs/f2fs.h | 2 + fs/f2fs/inline.c | 22 ++- fs/f2fs/inode.c | 2 +- fs/f2fs/node.c | 95 +++++------ fs/f2fs/sysfs.c | 10 +- fs/hfsplus/bfind.c | 51 ++++++ fs/hfsplus/catalog.c | 4 +- fs/hfsplus/dir.c | 2 +- fs/hfsplus/hfsplus_fs.h | 9 ++ fs/hfsplus/super.c | 6 +- fs/isofs/export.c | 2 +- fs/isofs/rock.c | 9 ++ fs/notify/fsnotify.c | 2 +- fs/notify/mark.c | 18 ++- fs/smb/client/cached_dir.c | 8 + fs/smb/client/cifsacl.c | 37 ++++- fs/smb/client/smb2inode.c | 12 +- fs/smb/client/smb2misc.c | 3 +- fs/smb/client/smb2ops.c | 11 ++ fs/smb/client/smbdirect.c | 21 +-- fs/smb/server/connection.c | 48 ++++-- fs/smb/server/connection.h | 1 + fs/tracefs/event_inode.c | 14 ++ fs/tracefs/inode.c | 6 +- fs/tracefs/internal.h | 3 + fs/udf/misc.c | 8 +- include/linux/dma-mapping.h | 13 ++ include/linux/fb.h | 4 +- .../linux/firmware/samsung/exynos-acpm-protocol.h | 29 ++-- include/linux/fsnotify_backend.h | 1 + include/linux/mmc/card.h | 2 + include/linux/printk.h | 13 ++ include/uapi/linux/io_uring.h | 3 +- include/video/udlfb.h | 1 + io_uring/io_uring.c | 12 +- io_uring/kbuf.c | 12 +- io_uring/kbuf.h | 7 + kernel/bpf/arena.c | 19 ++- kernel/exit.c | 1 + kernel/sched/ext_idle.c | 12 +- kernel/trace/trace_probe.c | 6 + kernel/trace/trace_probe.h | 4 +- kernel/tracepoint.c | 2 + lib/crypto/mpi/mpicoder.c | 2 +- lib/scatterlist.c | 8 +- mm/damon/core.c | 5 + mm/damon/stat.c | 30 ++-- mm/damon/sysfs-schemes.c | 12 +- mm/hugetlb_cma.c | 1 + mm/swapfile.c | 21 ++- net/bluetooth/hci_event.c | 29 +++- net/bluetooth/l2cap_sock.c | 9 ++ net/ceph/auth.c | 2 +- net/ceph/mon_client.c | 2 + net/core/flow_dissector.c | 13 +- net/core/netpoll.c | 23 +-- net/core/rtnetlink.c | 1 + net/ipv4/ah4.c | 14 +- net/ipv6/ah6.c | 14 +- net/ipv6/ip6_gre.c | 5 +- net/ipv6/xfrm6_protocol.c | 4 +- net/key/af_key.c | 52 +++--- net/mac80211/mlme.c | 9 +- net/mac80211/rx.c | 2 +- net/mac80211/util.c | 4 +- net/mptcp/fastopen.c | 4 +- net/mptcp/pm.c | 62 ++++--- net/mptcp/pm_kernel.c | 13 +- net/mptcp/protocol.c | 6 +- net/mptcp/sockopt.c | 16 +- net/mptcp/subflow.c | 4 +- net/openvswitch/vport-netdev.c | 6 +- net/psp/psp_main.c | 42 +++-- net/rds/message.c | 20 ++- net/sched/sch_red.c | 2 +- net/unix/af_unix.c | 3 + net/vmw_vsock/hyperv_transport.c | 33 +++- net/xfrm/xfrm_state.c | 12 +- net/xfrm/xfrm_user.c | 1 + rust/kernel/drm/gem/mod.rs | 13 +- rust/pin-init/src/__internal.rs | 28 ++-- rust/pin-init/src/macros.rs | 91 ++++++----- security/selinux/hooks.c | 38 ++--- security/selinux/include/objsec.h | 4 +- security/selinux/include/security.h | 2 - security/selinux/selinuxfs.c | 169 ++++--------------- security/selinux/ss/services.c | 125 --------------- sound/core/misc.c | 8 +- sound/core/oss/pcm_oss.c | 29 +++- sound/core/seq/seq_clientmgr.c | 2 +- sound/core/seq/seq_clientmgr.h | 5 +- sound/core/seq/seq_ump_client.c | 2 +- sound/firewire/tascam/tascam-hwdep.c | 1 + sound/hda/codecs/realtek/alc269.c | 19 +++ sound/hda/codecs/side-codecs/cs35l56_hda.c | 19 ++- sound/soc/amd/yc/acp6x-mach.c | 14 ++ sound/soc/codecs/es8389.c | 2 +- sound/soc/fsl/fsl_easrc.c | 2 +- sound/soc/intel/boards/bytcr_wm5102.c | 1 + sound/soc/qcom/qdsp6/q6apm-dai.c | 1 + sound/soc/qcom/qdsp6/q6apm-lpass-dais.c | 2 +- sound/soc/qcom/qdsp6/q6apm.c | 3 + sound/soc/sof/compress.c | 3 + sound/usb/midi2.c | 9 +- sound/usb/misc/ua101.c | 7 + sound/usb/stream.c | 4 +- tools/arch/x86/include/asm/msr-index.h | 3 +- tools/testing/selftests/net/mptcp/mptcp_lib.sh | 16 +- tools/testing/selftests/net/mptcp/pm_netlink.sh | 20 ++- 264 files changed, 2397 insertions(+), 1123 deletions(-)

4 weeks

[PATCH 6.12 000/206] 6.12.88-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.12.88 release. There are 206 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 14 May 2026 17:38:03 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.88-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.12.88-rc1 Prathyushi Nangia <prathyushi.nangia(a)amd.com> x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache Marc Zyngier <maz(a)kernel.org> KVM: arm64: Wake-up from WFI when iqrchip is in userspace Gary Guo <gary(a)garyguo.net> rust: pin-init: fix incorrect accessor reference lifetime David Carlier <devnexen(a)gmail.com> tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7925: fix incorrect TLV length in CLC command Sam Edwards <cfsworks(a)gmail.com> net: stmmac: Prevent NULL deref when RX memory exhausted Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY() Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> net: stmmac: avoid shadowing global buf_sz Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: aloop: Fix peer runtime UAF during format-change stop Thorsten Blum <thorsten.blum(a)linux.dev> crypto: caam - guard HMAC key hex dumps in hash_digest_key Thorsten Blum <thorsten.blum(a)linux.dev> printk: add print_hex_dump_devel() David Carlier <devnexen(a)gmail.com> gtp: disable BH before calling udp_tunnel_xmit_skb() Junrui Luo <moonafterrain(a)outlook.com> erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap() Gao Xiang <xiang(a)kernel.org> erofs: tidy up z_erofs_lz4_handle_overlap() Gao Xiang <xiang(a)kernel.org> erofs: move {in,out}pages into struct z_erofs_decompress_req Thorsten Blum <thorsten.blum(a)linux.dev> crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx Ard Biesheuvel <ardb(a)kernel.org> crypto: nx - Migrate to scomp API Zilin Guan <zilin(a)seu.edu.cn> hfsplus: fix held lock freed on hfsplus_fill_super() Deepanshu Kartikey <kartikey406(a)gmail.com> hfsplus: fix uninit-value by validating catalog record size Miquel Raynal <miquel.raynal(a)bootlin.com> mtd: spinand: winbond: Declare the QE bit on W25NxxJW Seohyeon Maeng <bioloidgp(a)gmail.com> udf: fix partition descriptor append bookkeeping Luke Wang <ziniu.wang_1(a)nxp.com> mmc: core: Optimize time for secure erase/trim for some Kingston eMMCs David Carlier <devnexen(a)gmail.com> octeon_ep_vf: add NULL check for napi_build_skb() Thomas Weißschuh <linux(a)weissschuh.net> hwmon: (powerz) Avoid cacheline sharing for DMA buffer Michael S. Tsirkin <mst(a)redhat.com> dma-mapping: add __dma_from_device_group_begin()/end() Christoph Hellwig <hch(a)lst.de> dma-mapping: drop unneeded includes from dma-mapping.h Amir Goldstein <amir73il(a)gmail.com> fs: prepare for adding LSM blob to backing_file Thomas Zimmermann <tzimmermann(a)suse.de> fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info Alexei Starovoitov <ast(a)kernel.org> bpf: Fix use-after-free in arena_vm_close on fork Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Use per-root-bridge PCIH flag to skip mem resource fixup Tao Cui <cuitao(a)kylinos.cn> LoongArch: KVM: Use kvm_set_pte() in kvm_flush_pte() Bibo Mao <maobibo(a)loongson.cn> LoongArch: KVM: Move unconditional delay into timer clear scenery Bibo Mao <maobibo(a)loongson.cn> LoongArch: KVM: Fix HW timer interrupt lost when inject interrupt by software Xianglai Li <lixianglai(a)loongson.cn> LoongArch: KVM: Fix "unreliable stack" for kvm_exc_entry Qiang Ma <maqianga(a)uniontech.com> LoongArch: KVM: Cap KVM_CAP_NR_VCPUS by KVM_CAP_MAX_VCPUS Wentao Guan <guanwentao(a)uniontech.com> LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang() Quentin Perret <qperret(a)google.com> KVM: arm64: Fix initialisation order in __pkvm_init_finalise() David Woodhouse <dwmw(a)amazon.co.uk> KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value Guangshuo Li <lgs201920130244(a)gmail.com> f2fs: fix uninitialized kobject put in f2fs_init_sysfs() Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix node_cnt race between extent node destroy and writeback Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix incorrect multidevice info in trace_f2fs_map_blocks() Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix fiemap boundary handling when read extent cache is incomplete Cen Zhang <zzzccc427(a)gmail.com> f2fs: add READ_ONCE() for i_blocks in f2fs_update_inode() Gang Yan <yangang(a)kylinos.cn> mptcp: fix scheduling with atomic in timestamp sockopt Gang Yan <yangang(a)kylinos.cn> mptcp: sockopt: set timestamp flags on subflow socket, not msk Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: fastclose msk when linger time is 0 Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: mptcp: pm: restrict 'unknown' check to pm_nl_ctl Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: mptcp: check output: catch cmd errors Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/rxe: Reject unknown opcodes before ICRC processing Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() Junrui Luo <moonafterrain(a)outlook.com> RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Validate rx_hash_key_len Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() André Draszik <andre.draszik(a)linaro.org> power: supply: max17042: avoid overflow when determining health Lukas Wunner <lukas(a)wunner.de> PCI/ASPM: Fix pci_clear_and_set_config_dword() usage Lukas Wunner <lukas(a)wunner.de> PCI/AER: Stop ruling out unbound devices as error source Shuai Xue <xueshuai(a)linux.alibaba.com> PCI/AER: Clear only error bits in PCIe Device Status Lukas Wunner <lukas(a)wunner.de> PCI: Update saved_config_space upon resource assignment SeongJae Park <sj(a)kernel.org> mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock Paolo Bonzini <pbonzini(a)redhat.com> KVM: x86: check for nEPT/nNPT in slow flush hypercalls Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: validate dacloffset before building DACL pointers Bjoern Doebel <doebel(a)amazon.de> smb: client: use kzalloc to zero-initialize security descriptor buffer Zisen Ye <zisenye(a)stu.xidian.edu.cn> smb/client: fix out-of-bounds read in symlink_data() Zisen Ye <zisenye(a)stu.xidian.edu.cn> smb/client: fix out-of-bounds read in smb2_compound_op() Vasily Gorbik <gor(a)linux.ibm.com> s390/debug: Reject zero-length input in debug_input_flush_fn() Osama Abdelkader <osama.abdelkader(a)gmail.com> riscv: kvm: fix vector context allocation leak Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/hns: Fix unlocked call to hns_roce_qp_remove() Ulf Hansson <ulf.hansson(a)linaro.org> pmdomain: core: Fix detach procedure for virtual devices in genpd Ilya Maximets <i.maximets(a)ovn.org> openvswitch: vport: fix self-deadlock on release of tunnel ports Chaitanya Kulkarni <kch(a)nvidia.com> nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free Chaitanya Kulkarni <kch(a)nvidia.com> nvmet-tcp: fix race between ICReq handling and queue teardown Fedor Pchelkin <pchelkin(a)ispras.ru> nvme-apple: drop invalid put of admin queue reference count Junrui Luo <moonafterrain(a)outlook.com> md/raid10: fix divide-by-zero in setup_geo() with zero far_copies Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Fix slab-out-of-bounds access in auth message processing Christian A. Ehrhardt <lk(a)c--e.de> lib/scatterlist: fix temp buffer in extract_user_to_sg() Christian A. Ehrhardt <lk(a)c--e.de> lib/scatterlist: fix length calculations in extract_kvec_to_sg Lukas Wunner <lukas(a)wunner.de> lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() Nicolin Chen <nicolinc(a)nvidia.com> iommu/arm-smmu-v3: Add a missing dma_wmb() for hitless STE update Michael Bommarito <michael.bommarito(a)gmail.com> isofs: validate block number from NFS file handle in isofs_export_iget Michael Bommarito <michael.bommarito(a)gmail.com> isofs: validate Rock Ridge CE continuation extent against volume size Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: correctly reject too-small hash devices Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: correctly reject too-small FEC devices David Carlier <devnexen(a)gmail.com> eventfs: Hold eventfs_mutex and SRCU when remount walks events Mikulas Patocka <mpatocka(a)redhat.com> dm: fix a buffer overflow in ioctl processing Mikulas Patocka <mpatocka(a)redhat.com> dm: don't report warning when doing deferred remove Mikulas Patocka <mpatocka(a)redhat.com> dm-thin: fix metadata refcount underflow Guangshuo Li <lgs201920130244(a)gmail.com> btrfs: fix double free in create_space_info() error path Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm: remove child devices when apm is removed Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error Joseph Salisbury <joseph.salisbury(a)oracle.com> ASoC: fsl_easrc: fix comment typo Tommaso Soncin <soncintommaso(a)gmail.com> ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table Shrikanth Hegde <sshegde(a)linux.ibm.com> cpuidle: powerpc: avoid double clear when breaking snooze Conor Dooley <conor.dooley(a)microchip.com> clk: microchip: mpfs-ccc: fix out of bounds access during output registration Stefan Eichenberger <stefan.eichenberger(a)toradex.com> clk: imx: imx8-acm: fix flags for acm clocks Johan Hovold <johan(a)kernel.org> spi: topcliff-pch: fix use-after-free on unbind Johan Hovold <johan(a)kernel.org> spi: topcliff-pch: fix controller deregistration Thorsten Blum <thorsten.blum(a)linux.dev> thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp Thorsten Blum <thorsten.blum(a)linux.dev> thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> thermal: core: Free thermal zone ID later during removal Michael Bommarito <michael.bommarito(a)gmail.com> udf: reject descriptors with oversized CRC length Johan Hovold <johan(a)kernel.org> spi: microchip-core-qspi: fix controller deregistration Guangshuo Li <lgs201920130244(a)gmail.com> ice: fix double free in ice_sf_eth_activate() error path Mingming Cao <mmc(a)linux.ibm.com> ibmveth: Disable GSO for packets with small MSS Hamza Mahfooz <hamzamahfooz(a)linux.microsoft.com> hv_sock: fix ARM64 support Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> gpio: of: clear OF_POPULATED on hog nodes in remove path Xu Yang <xu.yang_2(a)nxp.com> extcon: ptn5150: handle pending IRQ events during system resume Shyam Prasad N <sprasad(a)microsoft.com> cifs: change_conf needs to be called for session setup Shyam Prasad N <sprasad(a)microsoft.com> cifs: abort open_cached_dir if we don't request leases Naman Jain <namjain(a)linux.microsoft.com> block: add pgmap check to biovec_phys_mergeable Jiexun Wang <wangjiexun2025(a)gmail.com> af_unix: Reject SIOCATMARK on non-stream sockets Myeonghun Pak <mhun512(a)gmail.com> hwmon: (corsair-psu) Close HID device on probe errors Johan Hovold <johan(a)kernel.org> clk: rk808: fix OF node reference imbalance Sanman Pradhan <psanman(a)juniper.net> hwmon: (ltc2992) Fix u32 overflow in power read path Sanman Pradhan <psanman(a)juniper.net> hwmon: (ltc2992) Clamp threshold writes to hardware range Hongling Zeng <zenghongling(a)kylinos.cn> parisc: Fix IRQ leak in LASI driver Pavitra Jha <jhapavitra98(a)gmail.com> net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler Nan Li <tonanli66(a)gmail.com> net/rds: handle zerocopy send cleanup before the message is queued Maoyi Xie <maoyixie.tju(a)gmail.com> ip6_gre: Use cached t->net in ip6erspan_changelink(). Jiawen Wu <jiawenwu(a)trustnetic.com> net: libwx: fix VF illegal register access SeungJu Cheon <suunj1331(a)gmail.com> sound: ua101: fix division by zero at probe Kai Zen <kai.aizen.dev(a)gmail.com> net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Fix SYM_SIGFUNC_START definition for 32BIT Tudor Ambarus <tudor.ambarus(a)linaro.org> mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show() Fuad Tabba <tabba(a)google.com> KVM: arm64: Fix kvm_vcpu_initialized() macro parameter Miklos Szeredi <mszeredi(a)redhat.com> fanotify: fix false positive on permission events Johan Hovold <johan(a)kernel.org> staging: vme_user: fix root device leak on init failure Johan Hovold <johan(a)kernel.org> spi: s3c64xx: fix NULL-deref on driver unbind Johan Hovold <johan(a)kernel.org> spi: zynqmp-gqspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sun6i: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: ti-qspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sun4i: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: syncuacer: fix controller deregistration Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt Tristan Madani <tristan(a)talencesecurity.com> Bluetooth: btmtk: validate WMT event SKB length before struct access Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: virtio_bt: validate rx pkt_type header length Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: virtio_bt: clamp rx length before skb_put Tao Cui <cuitao(a)kylinos.cn> LoongArch: KVM: Fix missing EMULATE_FAIL in kvm_emu_mmio_read() Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: prune /sys/fs/selinux/disable Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: shrink critical section in sel_write_load() David Windsor <dwindsor(a)gmail.com> selinux: don't reserve xattr slot when we won't fill it Michael Bommarito <michael.bommarito(a)gmail.com> xfrm: ah: account for ESN high bits in async callbacks Yilin Zhu <zylzyl2333(a)gmail.com> ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() Michal Kosiorek <mkosiorek121(a)gmail.com> xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete Ruijie Li <ruijieli51(a)gmail.com> xfrm: provide message size for XFRM_MSG_MAPPING Sourabh Jain <sourabhjain(a)linux.ibm.com> powerpc/kdump: fix KASAN sanitization flag for core_$(BITS).o Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: firewire-tascam: Do not drop unread control events Takashi Iwai <tiwai(a)suse.de> ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger Felix Gu <ustc.gu(a)gmail.com> usb: ulpi: fix memory leak on ulpi_register() error paths Fabio Porcedda <fabio.porcedda(a)gmail.com> USB: serial: option: add Telit Cinterion LE910Cx compositions Aaro Koskinen <aaro.koskinen(a)iki.fi> USB: omap_udc: DMA: Don't enable burst 4 mode Amit Sunil Dhamne <amitsd(a)google.com> usb: typec: tcpm: reset internal port states on soft reset AMS Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Fix UAC3 cluster descriptor size check Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: midi2: Restart output URBs on resume Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: usblp: fix heap leak in IEEE 1284 device ID via short response Marek Szyprowski <m.szyprowski(a)samsung.com> wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task Tristan Madani <tristan(a)talencesecurity.com> wifi: b43: enforce bounds check on firmware key index in b43_rx() Johannes Berg <johannes.berg(a)intel.com> wifi: mac80211: remove station if connection prep fails Jiri Slaby (SUSE) <jirislaby(a)kernel.org> wifi: ath5k: do not access array OOB Benjamin Berg <benjamin.berg(a)intel.com> wifi: mac80211: use safe list iteration in radar detect work Jeongjun Park <aha310510(a)gmail.com> wifi: rsi: fix kthread lifetime race between self-exit and external-stop Catherine <enderaoelyther(a)gmail.com> wifi: mac80211: drop stray 'static' from fast-RX rx_result Tristan Madani <tristan(a)talencesecurity.com> wifi: b43legacy: enforce bounds check on firmware key index in RX path Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work Leon Yen <leon.yen(a)mediatek.com> wifi: mt76: mt7921: fix a potential clc buffer length underflow Ming Yen Hsieh <mingyen.hsieh(a)mediatek.com> wifi: mt76: mt7925: fix incorrect length field in txpower command Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7925: fix AMPDU state handling in mt7925_tx_check_aggr Jann Horn <jannh(a)google.com> exit: prevent preemption of oopsing TASK_DEAD task Hyunwoo Kim <imv4bel(a)gmail.com> rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present David Howells <dhowells(a)redhat.com> rxrpc: Fix conn-level packet handling to unshare RESPONSE packets Hyunwoo Kim <imv4bel(a)gmail.com> Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked Paolo Bonzini <pbonzini(a)redhat.com> KVM: SVM: check validity of VMCB controls when returning from SMM Zhengchuan Liang <zcliangcn(a)gmail.com> net: af_key: zero aligned sockaddr tail in PF_KEY exports Jiawen Wu <jiawenwu(a)trustnetic.com> net: txgbe: fix RTNL assertion warning when remove module Qingfang Deng <qingfang.deng(a)linux.dev> flow_dissector: do not dissect PPPoE PFC frames Ankit Soni <Ankit.Soni(a)amd.com> iommu/amd: serialize sequence allocation under concurrent TLB invalidations Uros Bizjak <ubizjak(a)gmail.com> iommu/amd: Use atomic64_inc_return() in iommu.c Sean Christopherson <seanjc(a)google.com> KVM: x86: Fix shadow paging use-after-free due to unexpected GFN Rick Edgecombe <rick.p.edgecombe(a)intel.com> x86/shstk: Prevent deadlock during shstk sigreturn Linus Torvalds <torvalds(a)linux-foundation.org> x86: shadow stacks: proper error handling for mmap lock Suren Baghdasaryan <surenb(a)google.com> mm: convert mm_lock_seq to a proper seqcount DaeMyung Kang <charsyam(a)gmail.com> ksmbd: rewrite stop_sessions() with restartable iteration Johan Hovold <johan(a)kernel.org> spi: rockchip: fix controller deregistration Mark Brown <broonie(a)kernel.org> ASoC: SOF: Don't allow pointer operations on unconfigured streams Sina Hassani <sina(a)openai.com> iommufd: Fix a race with concurrent allocation and unmap Shivam Kalra <shivamkalra98(a)zohomail.in> ACPI: video: force native backlight on HP OMEN 16 (8A44) Jinjie Ruan <ruanjinjie(a)huawei.com> ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug Jan Schär <jan(a)jschaer.ch> ACPI: video: Add backlight=native quirk for Dell OptiPlex 7770 AIO Guangshuo Li <lgs201920130244(a)gmail.com> ACPI: scan: Use acpi_dev_put() in object add error paths Rajat Gupta <rajgupt(a)qti.qualcomm.com> fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free Corey Minyard <corey(a)minyard.net> ipmi:si: Return state to normal if message allocation fails Corey Minyard <corey(a)minyard.net> ipmi: Check event message buffer response for bad data Corey Minyard <corey(a)minyard.net> ipmi: Add limits to event and receive message requests Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() ------------- Diffstat: Makefile | 4 +- arch/arm64/include/asm/kvm_host.h | 2 +- arch/arm64/kvm/arm.c | 5 + arch/arm64/kvm/hyp/nvhe/setup.c | 8 +- arch/arm64/kvm/vgic/vgic-mmio-v2.c | 2 +- arch/arm64/kvm/vgic/vgic-mmio-v3.c | 2 +- arch/loongarch/include/asm/linkage.h | 2 +- arch/loongarch/kvm/exit.c | 1 + arch/loongarch/kvm/interrupt.c | 14 ++ arch/loongarch/kvm/mmu.c | 2 +- arch/loongarch/kvm/switch.S | 2 +- arch/loongarch/kvm/timer.c | 10 +- arch/loongarch/kvm/vm.c | 2 +- arch/loongarch/pci/acpi.c | 5 + arch/loongarch/pci/pci.c | 3 + arch/powerpc/kexec/Makefile | 2 +- arch/powerpc/platforms/pseries/svm.c | 1 + arch/riscv/kvm/vcpu_vector.c | 5 +- arch/s390/kernel/debug.c | 5 + arch/x86/include/asm/msr-index.h | 3 +- arch/x86/kernel/cpu/amd.c | 3 + arch/x86/kernel/shstk.c | 45 ++++-- arch/x86/kvm/hyperv.c | 2 +- arch/x86/kvm/mmu/mmu.c | 35 ++-- arch/x86/kvm/svm/nested.c | 12 +- arch/x86/kvm/svm/svm.c | 4 + arch/x86/kvm/svm/svm.h | 1 + block/blk.h | 2 + drivers/acpi/cppc_acpi.c | 6 +- drivers/acpi/power.c | 2 +- drivers/acpi/scan.c | 2 +- drivers/acpi/video_detect.c | 16 ++ drivers/bluetooth/btmtk.c | 15 +- drivers/bluetooth/virtio_bt.c | 39 ++++- drivers/char/ipmi/ipmi_si_intf.c | 70 ++++++-- drivers/char/ipmi/ipmi_ssif.c | 23 ++- drivers/clk/clk-rk808.c | 2 +- drivers/clk/imx/clk-imx8-acm.c | 3 +- drivers/clk/microchip/clk-mpfs-ccc.c | 6 +- drivers/cpuidle/cpuidle-powernv.c | 5 +- drivers/cpuidle/cpuidle-pseries.c | 5 +- drivers/crypto/caam/caamalg_qi2.c | 4 +- drivers/crypto/caam/caamhash.c | 4 +- drivers/crypto/nx/nx-842.c | 41 ++--- drivers/crypto/nx/nx-842.h | 15 +- drivers/crypto/nx/nx-common-powernv.c | 31 ++-- drivers/crypto/nx/nx-common-pseries.c | 33 ++-- drivers/extcon/extcon-ptn5150.c | 14 ++ drivers/gpio/gpiolib-of.c | 9 +- drivers/hwmon/corsair-psu.c | 4 +- drivers/hwmon/ltc2992.c | 41 +++-- drivers/hwmon/powerz.c | 5 +- drivers/infiniband/hw/hns/hns_roce_qp.c | 7 + drivers/infiniband/hw/mana/qp.c | 16 +- drivers/infiniband/hw/mlx4/srq.c | 4 +- drivers/infiniband/hw/mlx5/main.c | 1 + drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 4 +- drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c | 2 +- drivers/infiniband/sw/rxe/rxe_recv.c | 11 ++ drivers/infiniband/sw/rxe/rxe_resp.c | 14 +- drivers/iommu/amd/amd_iommu_types.h | 2 +- drivers/iommu/amd/init.c | 2 +- drivers/iommu/amd/iommu.c | 18 ++- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 7 + drivers/iommu/iommufd/io_pagetable.c | 10 ++ drivers/md/dm-ioctl.c | 6 +- drivers/md/dm-verity-fec.c | 8 +- drivers/md/persistent-data/dm-btree-remove.c | 8 + drivers/md/raid10.c | 2 + drivers/mmc/core/card.h | 5 + drivers/mmc/core/queue.c | 9 +- drivers/mmc/core/quirks.h | 9 ++ drivers/mtd/nand/spi/winbond.c | 4 +- drivers/mtd/spi-nor/debugfs.c | 4 +- drivers/net/ethernet/ibm/ibmveth.c | 22 +++ drivers/net/ethernet/ibm/ibmveth.h | 1 + drivers/net/ethernet/intel/ice/ice_sf_eth.c | 2 + .../ethernet/marvell/octeon_ep_vf/octep_vf_rx.c | 36 ++++- drivers/net/ethernet/stmicro/stmmac/chain_mode.c | 2 +- drivers/net/ethernet/stmicro/stmmac/common.h | 2 +- drivers/net/ethernet/stmicro/stmmac/ring_mode.c | 2 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 47 +++--- drivers/net/ethernet/wangxun/libwx/wx_hw.c | 7 +- drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c | 2 + drivers/net/gtp.c | 2 + drivers/net/wireless/ath/ath5k/base.c | 3 +- drivers/net/wireless/broadcom/b43/xmit.c | 3 +- drivers/net/wireless/broadcom/b43legacy/xmit.c | 3 +- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 6 +- drivers/net/wireless/mediatek/mt76/mt7921/main.c | 7 +- drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | 3 + drivers/net/wireless/mediatek/mt76/mt7925/mac.c | 6 +- drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 4 +- drivers/net/wireless/rsi/rsi_common.h | 5 +- drivers/net/wwan/t7xx/t7xx_modem_ops.c | 20 ++- drivers/net/wwan/t7xx/t7xx_port_ctrl_msg.c | 18 ++- drivers/net/wwan/t7xx/t7xx_port_proxy.h | 2 +- drivers/nvme/host/apple.c | 6 +- drivers/nvme/target/core.c | 2 +- drivers/nvme/target/tcp.c | 26 +++ drivers/parisc/lasi.c | 12 +- drivers/pci/pci.c | 7 +- drivers/pci/pcie/aer.c | 2 - drivers/pci/pcie/aspm.c | 17 +- drivers/pci/setup-res.c | 2 + drivers/pmdomain/core.c | 10 +- drivers/power/supply/max17042_battery.c | 2 +- drivers/spi/spi-microchip-core-qspi.c | 12 +- drivers/spi/spi-rockchip.c | 4 +- drivers/spi/spi-s3c64xx.c | 5 - drivers/spi/spi-sun4i.c | 10 +- drivers/spi/spi-sun6i.c | 8 +- drivers/spi/spi-synquacer.c | 8 +- drivers/spi/spi-ti-qspi.c | 14 +- drivers/spi/spi-topcliff-pch.c | 11 +- drivers/spi/spi-zynqmp-gqspi.c | 4 +- drivers/staging/vme_user/vme_fake.c | 2 + drivers/target/target_core_configfs.c | 2 +- drivers/thermal/sprd_thermal.c | 4 +- drivers/thermal/thermal_core.c | 6 +- drivers/usb/class/usblp.c | 3 +- drivers/usb/common/ulpi.c | 5 +- drivers/usb/gadget/udc/omap_udc.c | 4 - drivers/usb/serial/option.c | 4 + drivers/usb/typec/tcpm/tcpm.c | 2 + drivers/video/fbdev/core/fb_defio.c | 179 ++++++++++++++++----- drivers/video/fbdev/udlfb.c | 31 +++- fs/btrfs/space-info.c | 2 +- fs/erofs/compress.h | 2 +- fs/erofs/decompressor.c | 163 +++++++++---------- fs/erofs/decompressor_deflate.c | 8 +- fs/erofs/decompressor_lzma.c | 8 +- fs/erofs/decompressor_zstd.c | 8 +- fs/erofs/zdata.c | 2 + fs/f2fs/data.c | 28 +++- fs/f2fs/extent_cache.c | 17 +- fs/f2fs/inode.c | 2 +- fs/f2fs/sysfs.c | 10 +- fs/file_table.c | 22 ++- fs/hfsplus/bfind.c | 51 ++++++ fs/hfsplus/catalog.c | 4 +- fs/hfsplus/dir.c | 2 +- fs/hfsplus/hfsplus_fs.h | 9 ++ fs/hfsplus/super.c | 6 +- fs/isofs/export.c | 2 +- fs/isofs/rock.c | 9 ++ fs/notify/fsnotify.c | 2 +- fs/notify/mark.c | 18 ++- fs/smb/client/cached_dir.c | 8 + fs/smb/client/cifsacl.c | 37 ++++- fs/smb/client/smb2inode.c | 12 +- fs/smb/client/smb2misc.c | 3 +- fs/smb/client/smb2ops.c | 11 ++ fs/smb/server/connection.c | 48 ++++-- fs/smb/server/connection.h | 1 + fs/tracefs/event_inode.c | 14 ++ fs/tracefs/inode.c | 5 +- fs/tracefs/internal.h | 3 + fs/udf/misc.c | 8 +- fs/udf/super.c | 4 +- include/linux/dma-mapping.h | 17 +- include/linux/fb.h | 4 +- include/linux/fsnotify_backend.h | 1 + include/linux/mm.h | 12 +- include/linux/mm_types.h | 7 +- include/linux/mmap_lock.h | 101 +++++++----- include/linux/mmc/card.h | 1 + include/linux/printk.h | 13 ++ include/trace/events/rxrpc.h | 1 + include/video/udlfb.h | 1 + kernel/bpf/arena.c | 19 ++- kernel/exit.c | 1 + kernel/fork.c | 5 +- kernel/tracepoint.c | 2 + lib/crypto/mpi/mpicoder.c | 2 +- lib/scatterlist.c | 8 +- mm/damon/sysfs-schemes.c | 12 +- mm/init-mm.c | 2 +- net/bluetooth/hci_event.c | 29 +++- net/bluetooth/l2cap_core.c | 8 +- net/bluetooth/l2cap_sock.c | 6 + net/ceph/auth.c | 2 +- net/ceph/mon_client.c | 2 + net/core/flow_dissector.c | 13 +- net/core/rtnetlink.c | 1 + net/ipv4/ah4.c | 14 +- net/ipv6/ah6.c | 14 +- net/ipv6/ip6_gre.c | 5 +- net/ipv6/xfrm6_protocol.c | 4 +- net/key/af_key.c | 52 +++--- net/mac80211/mlme.c | 9 +- net/mac80211/rx.c | 2 +- net/mac80211/util.c | 4 +- net/mptcp/protocol.c | 3 +- net/mptcp/sockopt.c | 12 +- net/mptcp/subflow.c | 4 +- net/openvswitch/vport-netdev.c | 6 +- net/rds/message.c | 20 ++- net/rxrpc/call_event.c | 4 +- net/rxrpc/conn_event.c | 30 +++- net/sched/sch_red.c | 2 +- net/unix/af_unix.c | 3 + net/vmw_vsock/hyperv_transport.c | 4 +- net/xfrm/xfrm_state.c | 12 +- net/xfrm/xfrm_user.c | 1 + rust/kernel/init/__internal.rs | 28 ++-- rust/kernel/init/macros.rs | 91 ++++++----- security/selinux/hooks.c | 3 +- security/selinux/selinuxfs.c | 54 ++----- sound/core/oss/pcm_oss.c | 29 +++- sound/drivers/aloop.c | 44 +++-- sound/firewire/tascam/tascam-hwdep.c | 1 + sound/soc/amd/yc/acp6x-mach.c | 14 ++ sound/soc/fsl/fsl_easrc.c | 2 +- sound/soc/intel/boards/bytcr_wm5102.c | 1 + sound/soc/qcom/qdsp6/q6apm-dai.c | 1 + sound/soc/qcom/qdsp6/q6apm-lpass-dais.c | 2 +- sound/soc/qcom/qdsp6/q6apm.c | 3 + sound/soc/sof/compress.c | 3 + sound/usb/midi2.c | 9 +- sound/usb/misc/ua101.c | 7 + sound/usb/stream.c | 4 +- tools/arch/x86/include/asm/msr-index.h | 3 +- tools/testing/selftests/net/mptcp/mptcp_lib.sh | 16 +- tools/testing/selftests/net/mptcp/pm_netlink.sh | 20 ++- tools/testing/vma/vma.c | 4 +- tools/testing/vma/vma_internal.h | 4 +- 227 files changed, 1903 insertions(+), 785 deletions(-)

4 weeks

[PATCH 6.12 000/202] 6.12.88-rc2 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.12.88 release. There are 202 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Fri, 15 May 2026 15:37:24 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.88-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.12.88-rc2 Prathyushi Nangia <prathyushi.nangia(a)amd.com> x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache Marc Zyngier <maz(a)kernel.org> KVM: arm64: Wake-up from WFI when iqrchip is in userspace David Carlier <devnexen(a)gmail.com> tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7925: fix incorrect TLV length in CLC command Sam Edwards <cfsworks(a)gmail.com> net: stmmac: Prevent NULL deref when RX memory exhausted Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY() Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> net: stmmac: avoid shadowing global buf_sz Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: aloop: Fix peer runtime UAF during format-change stop Thorsten Blum <thorsten.blum(a)linux.dev> crypto: caam - guard HMAC key hex dumps in hash_digest_key Thorsten Blum <thorsten.blum(a)linux.dev> printk: add print_hex_dump_devel() David Carlier <devnexen(a)gmail.com> gtp: disable BH before calling udp_tunnel_xmit_skb() Junrui Luo <moonafterrain(a)outlook.com> erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap() Gao Xiang <xiang(a)kernel.org> erofs: tidy up z_erofs_lz4_handle_overlap() Gao Xiang <xiang(a)kernel.org> erofs: move {in,out}pages into struct z_erofs_decompress_req Thorsten Blum <thorsten.blum(a)linux.dev> crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx Zilin Guan <zilin(a)seu.edu.cn> hfsplus: fix held lock freed on hfsplus_fill_super() Deepanshu Kartikey <kartikey406(a)gmail.com> hfsplus: fix uninit-value by validating catalog record size Miquel Raynal <miquel.raynal(a)bootlin.com> mtd: spinand: winbond: Declare the QE bit on W25NxxJW Seohyeon Maeng <bioloidgp(a)gmail.com> udf: fix partition descriptor append bookkeeping Luke Wang <ziniu.wang_1(a)nxp.com> mmc: core: Optimize time for secure erase/trim for some Kingston eMMCs David Carlier <devnexen(a)gmail.com> octeon_ep_vf: add NULL check for napi_build_skb() Thomas Weißschuh <linux(a)weissschuh.net> hwmon: (powerz) Avoid cacheline sharing for DMA buffer Michael S. Tsirkin <mst(a)redhat.com> dma-mapping: add __dma_from_device_group_begin()/end() Christoph Hellwig <hch(a)lst.de> dma-mapping: drop unneeded includes from dma-mapping.h Amir Goldstein <amir73il(a)gmail.com> fs: prepare for adding LSM blob to backing_file Thomas Zimmermann <tzimmermann(a)suse.de> fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info Alexei Starovoitov <ast(a)kernel.org> bpf: Fix use-after-free in arena_vm_close on fork Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Use per-root-bridge PCIH flag to skip mem resource fixup Tao Cui <cuitao(a)kylinos.cn> LoongArch: KVM: Use kvm_set_pte() in kvm_flush_pte() Bibo Mao <maobibo(a)loongson.cn> LoongArch: KVM: Move unconditional delay into timer clear scenery Bibo Mao <maobibo(a)loongson.cn> LoongArch: KVM: Fix HW timer interrupt lost when inject interrupt by software Xianglai Li <lixianglai(a)loongson.cn> LoongArch: KVM: Fix "unreliable stack" for kvm_exc_entry Qiang Ma <maqianga(a)uniontech.com> LoongArch: KVM: Cap KVM_CAP_NR_VCPUS by KVM_CAP_MAX_VCPUS Wentao Guan <guanwentao(a)uniontech.com> LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang() Quentin Perret <qperret(a)google.com> KVM: arm64: Fix initialisation order in __pkvm_init_finalise() David Woodhouse <dwmw(a)amazon.co.uk> KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value Guangshuo Li <lgs201920130244(a)gmail.com> f2fs: fix uninitialized kobject put in f2fs_init_sysfs() Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix node_cnt race between extent node destroy and writeback Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix incorrect multidevice info in trace_f2fs_map_blocks() Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix fiemap boundary handling when read extent cache is incomplete Cen Zhang <zzzccc427(a)gmail.com> f2fs: add READ_ONCE() for i_blocks in f2fs_update_inode() Gang Yan <yangang(a)kylinos.cn> mptcp: fix scheduling with atomic in timestamp sockopt Gang Yan <yangang(a)kylinos.cn> mptcp: sockopt: set timestamp flags on subflow socket, not msk Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: fastclose msk when linger time is 0 Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: mptcp: pm: restrict 'unknown' check to pm_nl_ctl Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: mptcp: check output: catch cmd errors Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/rxe: Reject unknown opcodes before ICRC processing Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() Junrui Luo <moonafterrain(a)outlook.com> RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Validate rx_hash_key_len Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() André Draszik <andre.draszik(a)linaro.org> power: supply: max17042: avoid overflow when determining health Lukas Wunner <lukas(a)wunner.de> PCI/ASPM: Fix pci_clear_and_set_config_dword() usage Lukas Wunner <lukas(a)wunner.de> PCI/AER: Stop ruling out unbound devices as error source Shuai Xue <xueshuai(a)linux.alibaba.com> PCI/AER: Clear only error bits in PCIe Device Status Lukas Wunner <lukas(a)wunner.de> PCI: Update saved_config_space upon resource assignment SeongJae Park <sj(a)kernel.org> mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock Paolo Bonzini <pbonzini(a)redhat.com> KVM: x86: check for nEPT/nNPT in slow flush hypercalls Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: validate dacloffset before building DACL pointers Bjoern Doebel <doebel(a)amazon.de> smb: client: use kzalloc to zero-initialize security descriptor buffer Zisen Ye <zisenye(a)stu.xidian.edu.cn> smb/client: fix out-of-bounds read in symlink_data() Zisen Ye <zisenye(a)stu.xidian.edu.cn> smb/client: fix out-of-bounds read in smb2_compound_op() Vasily Gorbik <gor(a)linux.ibm.com> s390/debug: Reject zero-length input in debug_input_flush_fn() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/hns: Fix unlocked call to hns_roce_qp_remove() Ulf Hansson <ulf.hansson(a)linaro.org> pmdomain: core: Fix detach procedure for virtual devices in genpd Ilya Maximets <i.maximets(a)ovn.org> openvswitch: vport: fix self-deadlock on release of tunnel ports Chaitanya Kulkarni <kch(a)nvidia.com> nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free Chaitanya Kulkarni <kch(a)nvidia.com> nvmet-tcp: fix race between ICReq handling and queue teardown Fedor Pchelkin <pchelkin(a)ispras.ru> nvme-apple: drop invalid put of admin queue reference count Junrui Luo <moonafterrain(a)outlook.com> md/raid10: fix divide-by-zero in setup_geo() with zero far_copies Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Fix slab-out-of-bounds access in auth message processing Christian A. Ehrhardt <lk(a)c--e.de> lib/scatterlist: fix temp buffer in extract_user_to_sg() Christian A. Ehrhardt <lk(a)c--e.de> lib/scatterlist: fix length calculations in extract_kvec_to_sg Lukas Wunner <lukas(a)wunner.de> lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() Nicolin Chen <nicolinc(a)nvidia.com> iommu/arm-smmu-v3: Add a missing dma_wmb() for hitless STE update Michael Bommarito <michael.bommarito(a)gmail.com> isofs: validate block number from NFS file handle in isofs_export_iget Michael Bommarito <michael.bommarito(a)gmail.com> isofs: validate Rock Ridge CE continuation extent against volume size Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: correctly reject too-small hash devices Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: correctly reject too-small FEC devices David Carlier <devnexen(a)gmail.com> eventfs: Hold eventfs_mutex and SRCU when remount walks events Mikulas Patocka <mpatocka(a)redhat.com> dm: fix a buffer overflow in ioctl processing Mikulas Patocka <mpatocka(a)redhat.com> dm: don't report warning when doing deferred remove Mikulas Patocka <mpatocka(a)redhat.com> dm-thin: fix metadata refcount underflow Guangshuo Li <lgs201920130244(a)gmail.com> btrfs: fix double free in create_space_info() error path Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm: remove child devices when apm is removed Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error Joseph Salisbury <joseph.salisbury(a)oracle.com> ASoC: fsl_easrc: fix comment typo Tommaso Soncin <soncintommaso(a)gmail.com> ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table Shrikanth Hegde <sshegde(a)linux.ibm.com> cpuidle: powerpc: avoid double clear when breaking snooze Conor Dooley <conor.dooley(a)microchip.com> clk: microchip: mpfs-ccc: fix out of bounds access during output registration Stefan Eichenberger <stefan.eichenberger(a)toradex.com> clk: imx: imx8-acm: fix flags for acm clocks Johan Hovold <johan(a)kernel.org> spi: topcliff-pch: fix use-after-free on unbind Johan Hovold <johan(a)kernel.org> spi: topcliff-pch: fix controller deregistration Thorsten Blum <thorsten.blum(a)linux.dev> thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp Thorsten Blum <thorsten.blum(a)linux.dev> thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> thermal: core: Free thermal zone ID later during removal Michael Bommarito <michael.bommarito(a)gmail.com> udf: reject descriptors with oversized CRC length Johan Hovold <johan(a)kernel.org> spi: microchip-core-qspi: fix controller deregistration Guangshuo Li <lgs201920130244(a)gmail.com> ice: fix double free in ice_sf_eth_activate() error path Mingming Cao <mmc(a)linux.ibm.com> ibmveth: Disable GSO for packets with small MSS Hamza Mahfooz <hamzamahfooz(a)linux.microsoft.com> hv_sock: fix ARM64 support Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> gpio: of: clear OF_POPULATED on hog nodes in remove path Xu Yang <xu.yang_2(a)nxp.com> extcon: ptn5150: handle pending IRQ events during system resume Shyam Prasad N <sprasad(a)microsoft.com> cifs: change_conf needs to be called for session setup Shyam Prasad N <sprasad(a)microsoft.com> cifs: abort open_cached_dir if we don't request leases Naman Jain <namjain(a)linux.microsoft.com> block: add pgmap check to biovec_phys_mergeable Jiexun Wang <wangjiexun2025(a)gmail.com> af_unix: Reject SIOCATMARK on non-stream sockets Myeonghun Pak <mhun512(a)gmail.com> hwmon: (corsair-psu) Close HID device on probe errors Johan Hovold <johan(a)kernel.org> clk: rk808: fix OF node reference imbalance Sanman Pradhan <psanman(a)juniper.net> hwmon: (ltc2992) Fix u32 overflow in power read path Sanman Pradhan <psanman(a)juniper.net> hwmon: (ltc2992) Clamp threshold writes to hardware range Hongling Zeng <zenghongling(a)kylinos.cn> parisc: Fix IRQ leak in LASI driver Pavitra Jha <jhapavitra98(a)gmail.com> net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler Nan Li <tonanli66(a)gmail.com> net/rds: handle zerocopy send cleanup before the message is queued Maoyi Xie <maoyixie.tju(a)gmail.com> ip6_gre: Use cached t->net in ip6erspan_changelink(). Jiawen Wu <jiawenwu(a)trustnetic.com> net: libwx: fix VF illegal register access SeungJu Cheon <suunj1331(a)gmail.com> sound: ua101: fix division by zero at probe Kai Zen <kai.aizen.dev(a)gmail.com> net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Fix SYM_SIGFUNC_START definition for 32BIT Tudor Ambarus <tudor.ambarus(a)linaro.org> mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show() Fuad Tabba <tabba(a)google.com> KVM: arm64: Fix kvm_vcpu_initialized() macro parameter Miklos Szeredi <mszeredi(a)redhat.com> fanotify: fix false positive on permission events Johan Hovold <johan(a)kernel.org> staging: vme_user: fix root device leak on init failure Johan Hovold <johan(a)kernel.org> spi: s3c64xx: fix NULL-deref on driver unbind Johan Hovold <johan(a)kernel.org> spi: zynqmp-gqspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sun6i: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: ti-qspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sun4i: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: syncuacer: fix controller deregistration Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt Tristan Madani <tristan(a)talencesecurity.com> Bluetooth: btmtk: validate WMT event SKB length before struct access Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: virtio_bt: validate rx pkt_type header length Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: virtio_bt: clamp rx length before skb_put Tao Cui <cuitao(a)kylinos.cn> LoongArch: KVM: Fix missing EMULATE_FAIL in kvm_emu_mmio_read() Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: prune /sys/fs/selinux/disable Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: shrink critical section in sel_write_load() David Windsor <dwindsor(a)gmail.com> selinux: don't reserve xattr slot when we won't fill it Michael Bommarito <michael.bommarito(a)gmail.com> xfrm: ah: account for ESN high bits in async callbacks Yilin Zhu <zylzyl2333(a)gmail.com> ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() Michal Kosiorek <mkosiorek121(a)gmail.com> xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete Ruijie Li <ruijieli51(a)gmail.com> xfrm: provide message size for XFRM_MSG_MAPPING Sourabh Jain <sourabhjain(a)linux.ibm.com> powerpc/kdump: fix KASAN sanitization flag for core_$(BITS).o Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: firewire-tascam: Do not drop unread control events Takashi Iwai <tiwai(a)suse.de> ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger Felix Gu <ustc.gu(a)gmail.com> usb: ulpi: fix memory leak on ulpi_register() error paths Fabio Porcedda <fabio.porcedda(a)gmail.com> USB: serial: option: add Telit Cinterion LE910Cx compositions Aaro Koskinen <aaro.koskinen(a)iki.fi> USB: omap_udc: DMA: Don't enable burst 4 mode Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Fix UAC3 cluster descriptor size check Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: midi2: Restart output URBs on resume Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: usblp: fix heap leak in IEEE 1284 device ID via short response Marek Szyprowski <m.szyprowski(a)samsung.com> wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task Tristan Madani <tristan(a)talencesecurity.com> wifi: b43: enforce bounds check on firmware key index in b43_rx() Johannes Berg <johannes.berg(a)intel.com> wifi: mac80211: remove station if connection prep fails Jiri Slaby (SUSE) <jirislaby(a)kernel.org> wifi: ath5k: do not access array OOB Benjamin Berg <benjamin.berg(a)intel.com> wifi: mac80211: use safe list iteration in radar detect work Jeongjun Park <aha310510(a)gmail.com> wifi: rsi: fix kthread lifetime race between self-exit and external-stop Catherine <enderaoelyther(a)gmail.com> wifi: mac80211: drop stray 'static' from fast-RX rx_result Tristan Madani <tristan(a)talencesecurity.com> wifi: b43legacy: enforce bounds check on firmware key index in RX path Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work Leon Yen <leon.yen(a)mediatek.com> wifi: mt76: mt7921: fix a potential clc buffer length underflow Ming Yen Hsieh <mingyen.hsieh(a)mediatek.com> wifi: mt76: mt7925: fix incorrect length field in txpower command Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7925: fix AMPDU state handling in mt7925_tx_check_aggr Jann Horn <jannh(a)google.com> exit: prevent preemption of oopsing TASK_DEAD task Hyunwoo Kim <imv4bel(a)gmail.com> rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present David Howells <dhowells(a)redhat.com> rxrpc: Fix conn-level packet handling to unshare RESPONSE packets Hyunwoo Kim <imv4bel(a)gmail.com> Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked Paolo Bonzini <pbonzini(a)redhat.com> KVM: SVM: check validity of VMCB controls when returning from SMM Zhengchuan Liang <zcliangcn(a)gmail.com> net: af_key: zero aligned sockaddr tail in PF_KEY exports Jiawen Wu <jiawenwu(a)trustnetic.com> net: txgbe: fix RTNL assertion warning when remove module Qingfang Deng <qingfang.deng(a)linux.dev> flow_dissector: do not dissect PPPoE PFC frames Ankit Soni <Ankit.Soni(a)amd.com> iommu/amd: serialize sequence allocation under concurrent TLB invalidations Uros Bizjak <ubizjak(a)gmail.com> iommu/amd: Use atomic64_inc_return() in iommu.c Sean Christopherson <seanjc(a)google.com> KVM: x86: Fix shadow paging use-after-free due to unexpected GFN Rick Edgecombe <rick.p.edgecombe(a)intel.com> x86/shstk: Prevent deadlock during shstk sigreturn Linus Torvalds <torvalds(a)linux-foundation.org> x86: shadow stacks: proper error handling for mmap lock Suren Baghdasaryan <surenb(a)google.com> mm: convert mm_lock_seq to a proper seqcount DaeMyung Kang <charsyam(a)gmail.com> ksmbd: rewrite stop_sessions() with restartable iteration Johan Hovold <johan(a)kernel.org> spi: rockchip: fix controller deregistration Mark Brown <broonie(a)kernel.org> ASoC: SOF: Don't allow pointer operations on unconfigured streams Sina Hassani <sina(a)openai.com> iommufd: Fix a race with concurrent allocation and unmap Shivam Kalra <shivamkalra98(a)zohomail.in> ACPI: video: force native backlight on HP OMEN 16 (8A44) Jinjie Ruan <ruanjinjie(a)huawei.com> ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug Jan Schär <jan(a)jschaer.ch> ACPI: video: Add backlight=native quirk for Dell OptiPlex 7770 AIO Guangshuo Li <lgs201920130244(a)gmail.com> ACPI: scan: Use acpi_dev_put() in object add error paths Rajat Gupta <rajgupt(a)qti.qualcomm.com> fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free Corey Minyard <corey(a)minyard.net> ipmi:si: Return state to normal if message allocation fails Corey Minyard <corey(a)minyard.net> ipmi: Check event message buffer response for bad data Corey Minyard <corey(a)minyard.net> ipmi: Add limits to event and receive message requests Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() ------------- Diffstat: Makefile | 4 +- arch/arm64/include/asm/kvm_host.h | 2 +- arch/arm64/kvm/arm.c | 5 + arch/arm64/kvm/hyp/nvhe/setup.c | 8 +- arch/arm64/kvm/vgic/vgic-mmio-v2.c | 2 +- arch/arm64/kvm/vgic/vgic-mmio-v3.c | 2 +- arch/loongarch/include/asm/linkage.h | 2 +- arch/loongarch/kvm/exit.c | 1 + arch/loongarch/kvm/interrupt.c | 14 ++ arch/loongarch/kvm/mmu.c | 2 +- arch/loongarch/kvm/switch.S | 2 +- arch/loongarch/kvm/timer.c | 10 +- arch/loongarch/kvm/vm.c | 2 +- arch/loongarch/pci/acpi.c | 5 + arch/loongarch/pci/pci.c | 3 + arch/powerpc/kexec/Makefile | 2 +- arch/powerpc/platforms/pseries/svm.c | 1 + arch/s390/kernel/debug.c | 5 + arch/x86/include/asm/msr-index.h | 3 +- arch/x86/kernel/cpu/amd.c | 3 + arch/x86/kernel/shstk.c | 45 ++++-- arch/x86/kvm/hyperv.c | 2 +- arch/x86/kvm/mmu/mmu.c | 35 ++-- arch/x86/kvm/svm/nested.c | 12 +- arch/x86/kvm/svm/svm.c | 4 + arch/x86/kvm/svm/svm.h | 1 + block/blk.h | 2 + drivers/acpi/cppc_acpi.c | 6 +- drivers/acpi/power.c | 2 +- drivers/acpi/scan.c | 2 +- drivers/acpi/video_detect.c | 16 ++ drivers/bluetooth/btmtk.c | 15 +- drivers/bluetooth/virtio_bt.c | 39 ++++- drivers/char/ipmi/ipmi_si_intf.c | 70 ++++++-- drivers/char/ipmi/ipmi_ssif.c | 23 ++- drivers/clk/clk-rk808.c | 2 +- drivers/clk/imx/clk-imx8-acm.c | 3 +- drivers/clk/microchip/clk-mpfs-ccc.c | 6 +- drivers/cpuidle/cpuidle-powernv.c | 5 +- drivers/cpuidle/cpuidle-pseries.c | 5 +- drivers/crypto/caam/caamalg_qi2.c | 4 +- drivers/crypto/caam/caamhash.c | 4 +- drivers/crypto/nx/nx-842.c | 8 +- drivers/extcon/extcon-ptn5150.c | 14 ++ drivers/gpio/gpiolib-of.c | 9 +- drivers/hwmon/corsair-psu.c | 4 +- drivers/hwmon/ltc2992.c | 41 +++-- drivers/hwmon/powerz.c | 5 +- drivers/infiniband/hw/hns/hns_roce_qp.c | 7 + drivers/infiniband/hw/mana/qp.c | 16 +- drivers/infiniband/hw/mlx4/srq.c | 4 +- drivers/infiniband/hw/mlx5/main.c | 1 + drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 4 +- drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c | 2 +- drivers/infiniband/sw/rxe/rxe_recv.c | 11 ++ drivers/infiniband/sw/rxe/rxe_resp.c | 14 +- drivers/iommu/amd/amd_iommu_types.h | 2 +- drivers/iommu/amd/init.c | 2 +- drivers/iommu/amd/iommu.c | 18 ++- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 7 + drivers/iommu/iommufd/io_pagetable.c | 10 ++ drivers/md/dm-ioctl.c | 6 +- drivers/md/dm-verity-fec.c | 8 +- drivers/md/persistent-data/dm-btree-remove.c | 8 + drivers/md/raid10.c | 2 + drivers/mmc/core/card.h | 5 + drivers/mmc/core/queue.c | 9 +- drivers/mmc/core/quirks.h | 9 ++ drivers/mtd/nand/spi/winbond.c | 4 +- drivers/mtd/spi-nor/debugfs.c | 4 +- drivers/net/ethernet/ibm/ibmveth.c | 22 +++ drivers/net/ethernet/ibm/ibmveth.h | 1 + drivers/net/ethernet/intel/ice/ice_sf_eth.c | 2 + .../ethernet/marvell/octeon_ep_vf/octep_vf_rx.c | 36 ++++- drivers/net/ethernet/stmicro/stmmac/chain_mode.c | 2 +- drivers/net/ethernet/stmicro/stmmac/common.h | 2 +- drivers/net/ethernet/stmicro/stmmac/ring_mode.c | 2 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 47 +++--- drivers/net/ethernet/wangxun/libwx/wx_hw.c | 7 +- drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c | 2 + drivers/net/gtp.c | 2 + drivers/net/wireless/ath/ath5k/base.c | 3 +- drivers/net/wireless/broadcom/b43/xmit.c | 3 +- drivers/net/wireless/broadcom/b43legacy/xmit.c | 3 +- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 6 +- drivers/net/wireless/mediatek/mt76/mt7921/main.c | 7 +- drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | 3 + drivers/net/wireless/mediatek/mt76/mt7925/mac.c | 6 +- drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 4 +- drivers/net/wireless/rsi/rsi_common.h | 5 +- drivers/net/wwan/t7xx/t7xx_modem_ops.c | 20 ++- drivers/net/wwan/t7xx/t7xx_port_ctrl_msg.c | 18 ++- drivers/net/wwan/t7xx/t7xx_port_proxy.h | 2 +- drivers/nvme/host/apple.c | 6 +- drivers/nvme/target/core.c | 2 +- drivers/nvme/target/tcp.c | 26 +++ drivers/parisc/lasi.c | 12 +- drivers/pci/pci.c | 7 +- drivers/pci/pcie/aer.c | 2 - drivers/pci/pcie/aspm.c | 17 +- drivers/pci/setup-res.c | 2 + drivers/pmdomain/core.c | 10 +- drivers/power/supply/max17042_battery.c | 2 +- drivers/spi/spi-microchip-core-qspi.c | 12 +- drivers/spi/spi-rockchip.c | 4 +- drivers/spi/spi-s3c64xx.c | 5 - drivers/spi/spi-sun4i.c | 10 +- drivers/spi/spi-sun6i.c | 8 +- drivers/spi/spi-synquacer.c | 8 +- drivers/spi/spi-ti-qspi.c | 14 +- drivers/spi/spi-topcliff-pch.c | 11 +- drivers/spi/spi-zynqmp-gqspi.c | 4 +- drivers/staging/vme_user/vme_fake.c | 2 + drivers/target/target_core_configfs.c | 2 +- drivers/thermal/sprd_thermal.c | 4 +- drivers/thermal/thermal_core.c | 6 +- drivers/usb/class/usblp.c | 3 +- drivers/usb/common/ulpi.c | 5 +- drivers/usb/gadget/udc/omap_udc.c | 4 - drivers/usb/serial/option.c | 4 + drivers/video/fbdev/core/fb_defio.c | 179 ++++++++++++++++----- drivers/video/fbdev/udlfb.c | 31 +++- fs/btrfs/space-info.c | 2 +- fs/erofs/compress.h | 2 +- fs/erofs/decompressor.c | 163 +++++++++---------- fs/erofs/decompressor_deflate.c | 8 +- fs/erofs/decompressor_lzma.c | 8 +- fs/erofs/decompressor_zstd.c | 8 +- fs/erofs/zdata.c | 2 + fs/f2fs/data.c | 28 +++- fs/f2fs/extent_cache.c | 17 +- fs/f2fs/inode.c | 2 +- fs/f2fs/sysfs.c | 10 +- fs/file_table.c | 22 ++- fs/hfsplus/bfind.c | 51 ++++++ fs/hfsplus/catalog.c | 4 +- fs/hfsplus/dir.c | 2 +- fs/hfsplus/hfsplus_fs.h | 9 ++ fs/hfsplus/super.c | 6 +- fs/isofs/export.c | 2 +- fs/isofs/rock.c | 9 ++ fs/notify/fsnotify.c | 2 +- fs/notify/mark.c | 18 ++- fs/smb/client/cached_dir.c | 8 + fs/smb/client/cifsacl.c | 37 ++++- fs/smb/client/smb2inode.c | 12 +- fs/smb/client/smb2misc.c | 3 +- fs/smb/client/smb2ops.c | 11 ++ fs/smb/server/connection.c | 48 ++++-- fs/smb/server/connection.h | 1 + fs/tracefs/event_inode.c | 14 ++ fs/tracefs/inode.c | 5 +- fs/tracefs/internal.h | 3 + fs/udf/misc.c | 8 +- fs/udf/super.c | 4 +- include/linux/dma-mapping.h | 17 +- include/linux/fb.h | 4 +- include/linux/fsnotify_backend.h | 1 + include/linux/mm.h | 12 +- include/linux/mm_types.h | 7 +- include/linux/mmap_lock.h | 101 +++++++----- include/linux/mmc/card.h | 1 + include/linux/printk.h | 13 ++ include/trace/events/rxrpc.h | 1 + include/video/udlfb.h | 1 + kernel/bpf/arena.c | 19 ++- kernel/exit.c | 1 + kernel/fork.c | 5 +- kernel/tracepoint.c | 2 + lib/crypto/mpi/mpicoder.c | 2 +- lib/scatterlist.c | 8 +- mm/damon/sysfs-schemes.c | 12 +- mm/init-mm.c | 2 +- net/bluetooth/hci_event.c | 29 +++- net/bluetooth/l2cap_core.c | 8 +- net/bluetooth/l2cap_sock.c | 6 + net/ceph/auth.c | 2 +- net/ceph/mon_client.c | 2 + net/core/flow_dissector.c | 13 +- net/core/rtnetlink.c | 1 + net/ipv4/ah4.c | 14 +- net/ipv6/ah6.c | 14 +- net/ipv6/ip6_gre.c | 5 +- net/ipv6/xfrm6_protocol.c | 4 +- net/key/af_key.c | 52 +++--- net/mac80211/mlme.c | 9 +- net/mac80211/rx.c | 2 +- net/mac80211/util.c | 4 +- net/mptcp/protocol.c | 3 +- net/mptcp/sockopt.c | 12 +- net/mptcp/subflow.c | 4 +- net/openvswitch/vport-netdev.c | 6 +- net/rds/message.c | 20 ++- net/rxrpc/call_event.c | 4 +- net/rxrpc/conn_event.c | 30 +++- net/sched/sch_red.c | 2 +- net/unix/af_unix.c | 3 + net/vmw_vsock/hyperv_transport.c | 4 +- net/xfrm/xfrm_state.c | 12 +- net/xfrm/xfrm_user.c | 1 + security/selinux/hooks.c | 3 +- security/selinux/selinuxfs.c | 54 ++----- sound/core/oss/pcm_oss.c | 29 +++- sound/drivers/aloop.c | 44 +++-- sound/firewire/tascam/tascam-hwdep.c | 1 + sound/soc/amd/yc/acp6x-mach.c | 14 ++ sound/soc/fsl/fsl_easrc.c | 2 +- sound/soc/intel/boards/bytcr_wm5102.c | 1 + sound/soc/qcom/qdsp6/q6apm-dai.c | 1 + sound/soc/qcom/qdsp6/q6apm-lpass-dais.c | 2 +- sound/soc/qcom/qdsp6/q6apm.c | 3 + sound/soc/sof/compress.c | 3 + sound/usb/midi2.c | 9 +- sound/usb/misc/ua101.c | 7 + sound/usb/stream.c | 4 +- tools/arch/x86/include/asm/msr-index.h | 3 +- tools/testing/selftests/net/mptcp/mptcp_lib.sh | 16 +- tools/testing/selftests/net/mptcp/pm_netlink.sh | 20 ++- tools/testing/vma/vma.c | 4 +- tools/testing/vma/vma_internal.h | 4 +- 220 files changed, 1766 insertions(+), 684 deletions(-)

4 weeks

[PATCH 7.0 000/305] 7.0.7-rc2 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 7.0.7 release. There are 305 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Fri, 15 May 2026 15:37:27 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.0.7-rc2.… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.0.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 7.0.7-rc2 Prathyushi Nangia <prathyushi.nangia(a)amd.com> x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache Gary Guo <gary(a)garyguo.net> rust: pin-init: fix incorrect accessor reference lifetime Sam Edwards <cfsworks(a)gmail.com> net: stmmac: Prevent NULL deref when RX memory exhausted Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY() Thorsten Blum <thorsten.blum(a)linux.dev> crypto: caam - guard HMAC key hex dumps in hash_digest_key Thorsten Blum <thorsten.blum(a)linux.dev> printk: add print_hex_dump_devel() Longxuan Yu <ylong030(a)ucr.edu> 8021q: delete cleared egress QoS mappings Longxuan Yu <ylong030(a)ucr.edu> 8021q: use RCU for egress QoS mappings Zilin Guan <zilin(a)seu.edu.cn> hfsplus: fix held lock freed on hfsplus_fill_super() Deepanshu Kartikey <kartikey406(a)gmail.com> hfsplus: fix uninit-value by validating catalog record size Suman Kumar Chakraborty <suman.kumar.chakraborty(a)intel.com> crypto: qat - fix firmware loading failure for GEN6 devices Suman Kumar Chakraborty <suman.kumar.chakraborty(a)intel.com> crypto: qat - fix indentation of macros in qat_hal.c Luke Wang <ziniu.wang_1(a)nxp.com> mmc: core: Optimize time for secure erase/trim for some Kingston eMMCs Avri Altman <avri.altman(a)sandisk.com> mmc: core: Add quirk for incorrect manufacturing date Avri Altman <avri.altman(a)sandisk.com> mmc: core: Adjust MDT beyond 2025 David Carlier <devnexen(a)gmail.com> octeon_ep_vf: add NULL check for napi_build_skb() Alexei Starovoitov <ast(a)kernel.org> bpf: Fix use-after-free in arena_vm_close on fork Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Use per-root-bridge PCIH flag to skip mem resource fixup Tao Cui <cuitao(a)kylinos.cn> LoongArch: KVM: Use kvm_set_pte() in kvm_flush_pte() Bibo Mao <maobibo(a)loongson.cn> LoongArch: KVM: Move unconditional delay into timer clear scenery Bibo Mao <maobibo(a)loongson.cn> LoongArch: KVM: Fix HW timer interrupt lost when inject interrupt by software Xianglai Li <lixianglai(a)loongson.cn> LoongArch: KVM: Fix "unreliable stack" for kvm_exc_entry Qiang Ma <maqianga(a)uniontech.com> LoongArch: KVM: Cap KVM_CAP_NR_VCPUS by KVM_CAP_MAX_VCPUS Wentao Guan <guanwentao(a)uniontech.com> LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang() Fuad Tabba <tabba(a)google.com> KVM: arm64: Fix pin leak and publication ordering in __pkvm_init_vcpu() Fuad Tabba <tabba(a)google.com> KVM: arm64: Fix FEAT_Debugv8p9 to check DebugVer, not PMUVer Fuad Tabba <tabba(a)google.com> KVM: arm64: Fix FEAT_SPE_FnE to use PMSIDR_EL1.FnE, not PMSVer Quentin Perret <qperret(a)google.com> KVM: arm64: Fix initialisation order in __pkvm_init_finalise() David Woodhouse <dwmw(a)amazon.co.uk> KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value Marc Zyngier <maz(a)kernel.org> KVM: arm64: Wake-up from WFI when iqrchip is in userspace Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix fsck inconsistency caused by FGGC of node block Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix inline data not being written to disk in writeback path Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: refactor f2fs_move_node_folio function Guangshuo Li <lgs201920130244(a)gmail.com> f2fs: fix uninitialized kobject put in f2fs_init_sysfs() Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix node_cnt race between extent node destroy and writeback Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix incorrect multidevice info in trace_f2fs_map_blocks() Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix incorrect file address mapping when inline inode is unwritten Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix fsck inconsistency caused by incorrect nat_entry flag usage Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix fiemap boundary handling when read extent cache is incomplete Chao Yu <chao(a)kernel.org> f2fs: fix false alarm of lockdep on cp_global_sem lock Cen Zhang <zzzccc427(a)gmail.com> f2fs: add READ_ONCE() for i_blocks in f2fs_update_inode() Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: return early if no retrans Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: free sk if last Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: always decrease sk refcount Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: fix potential data-race Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: allow ID 0 Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: kernel: correctly retransmit ADD_ADDR ID 0 Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: kernel: reset fullmesh counter after flush Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: prio: skip closed subflows Gang Yan <yangang(a)kylinos.cn> mptcp: fix scheduling with atomic in timestamp sockopt Paolo Abeni <pabeni(a)redhat.com> mptcp: fix rx timestamp corruption on fastopen Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: sockopt: increase seq in mptcp_setsockopt_all_sf Gang Yan <yangang(a)kylinos.cn> mptcp: sockopt: set timestamp flags on subflow socket, not msk Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: fastclose msk when linger time is 0 Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: mptcp: pm: restrict 'unknown' check to pm_nl_ctl Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: mptcp: check output: catch cmd errors Tejun Heo <tj(a)kernel.org> sched_ext: Use dsq->first_task instead of list_empty() in dispatch_enqueue() FIFO-tail David Carlier <devnexen(a)gmail.com> sched_ext: idle: Recheck prev_cpu after narrowing allowed mask Chen Ni <nichen(a)iscas.ac.cn> remoteproc: k3: Fix NULL vs IS_ERR() bug in k3_reserved_mem_init() Chen Ni <nichen(a)iscas.ac.cn> remoteproc: imx_rproc: Fix NULL vs IS_ERR() bug in imx_rproc_addr_init() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/rxe: Reject unknown opcodes before ICRC processing Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() Junrui Luo <moonafterrain(a)outlook.com> RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Validate rx_hash_key_len Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/ionic: Fix typo in format string Kai Zen <kai.aizen.dev(a)gmail.com> RDMA/ionic: bound node_desc sysfs read with %.64s Dapeng Mi <dapeng1.mi(a)linux.intel.com> perf/x86/intel: Enable auto counter reload for DMR Dapeng Mi <dapeng1.mi(a)linux.intel.com> perf/x86/intel: Disable PMI for self-reloaded ACR events Dapeng Mi <dapeng1.mi(a)linux.intel.com> perf/x86/intel: Always reprogram ACR events to prevent stale masks Nilay Shroff <nilay(a)linux.ibm.com> powerpc/xive: fix kmemleak caused by incorrect chip_data lookup André Draszik <andre.draszik(a)linaro.org> power: supply: max17042: avoid overflow when determining health Lukas Wunner <lukas(a)wunner.de> PCI/ASPM: Fix pci_clear_and_set_config_dword() usage Lukas Wunner <lukas(a)wunner.de> PCI/AER: Stop ruling out unbound devices as error source Shuai Xue <xueshuai(a)linux.alibaba.com> PCI/AER: Clear only error bits in PCIe Device Status Lukas Wunner <lukas(a)wunner.de> PCI: Update saved_config_space upon resource assignment SeongJae Park <sj(a)kernel.org> mm/damon/sysfs-schemes: protect path kfree() with damon_sysfs_lock SeongJae Park <sj(a)kernel.org> mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock SeongJae Park <sj(a)kernel.org> mm/damon/stat: detect and use fresh enabled value SeongJae Park <sj(a)kernel.org> mm/damon/reclaim: detect and use fresh enabled and kdamond_pid values SeongJae Park <sj(a)kernel.org> mm/damon/lru_sort: detect and use fresh enabled and kdamond_pid values Paolo Bonzini <pbonzini(a)redhat.com> KVM: x86: Do IRR scan in __kvm_apic_update_irr even if PIR is empty Paolo Bonzini <pbonzini(a)redhat.com> KVM: x86: check for nEPT/nNPT in slow flush hypercalls Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: validate dacloffset before building DACL pointers Bjoern Doebel <doebel(a)amazon.de> smb: client: use kzalloc to zero-initialize security descriptor buffer Zisen Ye <zisenye(a)stu.xidian.edu.cn> smb/client: fix out-of-bounds read in symlink_data() Zisen Ye <zisenye(a)stu.xidian.edu.cn> smb/client: fix out-of-bounds read in smb2_compound_op() Ranjan Kumar <ranjan.kumar(a)broadcom.com> scsi: mpt3sas: Limit NVMe request size to 2 MiB Pengpeng Hou <pengpeng(a)iscas.ac.cn> s390/debug: Reject zero-length input before trimming a newline Vasily Gorbik <gor(a)linux.ibm.com> s390/debug: Reject zero-length input in debug_input_flush_fn() Osama Abdelkader <osama.abdelkader(a)gmail.com> riscv: kvm: fix vector context allocation leak Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/hns: Fix unlocked call to hns_roce_qp_remove() David Carlier <devnexen(a)gmail.com> psp: strip variable-length PSP header in psp_dev_rcv() Ulf Hansson <ulfh(a)kernel.org> pmdomain: core: Fix detach procedure for virtual devices in genpd Ilya Maximets <i.maximets(a)ovn.org> openvswitch: vport: fix self-deadlock on release of tunnel ports Chaitanya Kulkarni <kch(a)nvidia.com> nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free Chaitanya Kulkarni <kch(a)nvidia.com> nvmet-tcp: fix race between ICReq handling and queue teardown Fedor Pchelkin <pchelkin(a)ispras.ru> nvme-apple: drop invalid put of admin queue reference count Junrui Luo <moonafterrain(a)outlook.com> md/raid10: fix divide-by-zero in setup_geo() with zero far_copies Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Fix slab-out-of-bounds access in auth message processing Christian A. Ehrhardt <lk(a)c--e.de> lib/scatterlist: fix temp buffer in extract_user_to_sg() Christian A. Ehrhardt <lk(a)c--e.de> lib/scatterlist: fix length calculations in extract_kvec_to_sg Eric Biggers <ebiggers(a)kernel.org> lib/crc: tests: Make crc_kunit test only the enabled CRC variants Lukas Wunner <lukas(a)wunner.de> lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() Nicolin Chen <nicolinc(a)nvidia.com> iommu/arm-smmu-v3: Add a missing dma_wmb() for hitless STE update Zhenzhong Duan <zhenzhong.duan(a)intel.com> iommu/vt-d: Block PASID attachment to nested domain with dirty tracking Zhenzhong Duan <zhenzhong.duan(a)intel.com> iommufd: Fix return value of iommufd_fault_fops_write() Michael Bommarito <michael.bommarito(a)gmail.com> isofs: validate block number from NFS file handle in isofs_export_iget Michael Bommarito <michael.bommarito(a)gmail.com> isofs: validate Rock Ridge CE continuation extent against volume size Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: fix the size of dm_verity_fec_io::erasures Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: fix reading parity bytes split across blocks (take 3) Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: fix corrected block count stat Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: correctly reject too-small hash devices Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: correctly reject too-small FEC devices David Carlier <devnexen(a)gmail.com> eventfs: Hold eventfs_mutex and SRCU when remount walks events Mikulas Patocka <mpatocka(a)redhat.com> dm: fix a buffer overflow in ioctl processing Mikulas Patocka <mpatocka(a)redhat.com> dm: don't report warning when doing deferred remove Mikulas Patocka <mpatocka(a)redhat.com> dm-thin: fix metadata refcount underflow Filipe Manana <fdmanana(a)suse.com> btrfs: fix missing last_unlink_trans update when removing a directory Guangshuo Li <lgs201920130244(a)gmail.com> btrfs: fix double free in create_space_info_sub_group() error path Guangshuo Li <lgs201920130244(a)gmail.com> btrfs: fix double free in create_space_info() error path Yochai Eisenrich <yochaie(a)sweet.security> btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak Qu Wenruo <wqu(a)suse.com> btrfs: do not mark inode incompressible after inline attempt fails Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm: remove child devices when apm is removed Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error Joseph Salisbury <joseph.salisbury(a)oracle.com> ASoC: fsl_easrc: fix comment typo Li Jian <lazycat-xiao(a)foxmail.com> ASoC: ES8389: convert to devm_clk_get_optional() to get clock Tommaso Soncin <soncintommaso(a)gmail.com> ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table Shrikanth Hegde <sshegde(a)linux.ibm.com> cpuidle: powerpc: avoid double clear when breaking snooze Conor Dooley <conor.dooley(a)microchip.com> clk: microchip: mpfs-ccc: fix out of bounds access during output registration Stefan Eichenberger <stefan.eichenberger(a)toradex.com> clk: imx: imx8-acm: fix flags for acm clocks Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/fprobe: Check the same type fprobe on table as the unregistered one Steven Rostedt <rostedt(a)goodmis.org> tracing/probes: Limit size of event probe to 3K Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/fprobe: Unregister fprobe even if memory allocation fails Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/fprobe: Remove fprobe from hash in failure path Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/fprobe: Avoid kcalloc() in rcu_read_lock section Johan Hovold <johan(a)kernel.org> spi: topcliff-pch: fix use-after-free on unbind Johan Hovold <johan(a)kernel.org> spi: topcliff-pch: fix controller deregistration Thorsten Blum <thorsten.blum(a)linux.dev> thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp Thorsten Blum <thorsten.blum(a)linux.dev> thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> thermal: core: Free thermal zone ID later during removal David Gow <david(a)davidgow.net> x86/boot/e820: Re-enable BIOS fallback if e820 table is empty Michael Bommarito <michael.bommarito(a)gmail.com> udf: reject descriptors with oversized CRC length David Carlier <devnexen(a)gmail.com> tracefs: Fix default permissions not being applied on initial mount Conor Dooley <conor.dooley(a)microchip.com> spi: microchip-core-qspi: control built-in cs manually Conor Dooley <conor.dooley(a)microchip.com> spi: microchip-core-qspi: don't attempt to transmit during emulated read-only dual/quad operations Johan Hovold <johan(a)kernel.org> spi: microchip-core-spi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: microchip-core-qspi: fix controller deregistration Guangshuo Li <lgs201920130244(a)gmail.com> ice: fix double free in ice_sf_eth_activate() error path Mingming Cao <mmc(a)linux.ibm.com> ibmveth: Disable GSO for packets with small MSS Dexuan Cui <decui(a)microsoft.com> hv_sock: Return -EIO for malformed/short packets Dexuan Cui <decui(a)microsoft.com> hv_sock: Report EOF instead of -EIO for FIN Hamza Mahfooz <hamzamahfooz(a)linux.microsoft.com> hv_sock: fix ARM64 support Thomas Zimmermann <tzimmermann(a)suse.de> hv: Select CONFIG_SYSFB only for CONFIG_HYPERV_VMBUS Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> gpio: of: clear OF_POPULATED on hog nodes in remove path Thomas Zimmermann <tzimmermann(a)suse.de> fbcon: Avoid OOB font access if console rotation fails Xu Yang <xu.yang_2(a)nxp.com> extcon: ptn5150: handle pending IRQ events during system resume Shyam Prasad N <sprasad(a)microsoft.com> cifs: change_conf needs to be called for session setup Shyam Prasad N <sprasad(a)microsoft.com> cifs: abort open_cached_dir if we don't request leases Jens Axboe <axboe(a)kernel.dk> block: only read from sqe on initial invocation of blkdev_uring_cmd() Damien Le Moal <dlemoal(a)kernel.org> block: fix zone write plug removal Naman Jain <namjain(a)linux.microsoft.com> block: add pgmap check to biovec_phys_mergeable Wentao Liang <vulab(a)iscas.ac.cn> pmdomain: mediatek: fix use-after-free in scpsys_get_bus_protection_legacy() Breno Leitao <leitao(a)debian.org> arm64/fpsimd: ptrace: zero target's fpsimd_state, not the tracer's Jiexun Wang <wangjiexun2025(a)gmail.com> af_unix: Reject SIOCATMARK on non-stream sockets Myeonghun Pak <mhun512(a)gmail.com> hwmon: (corsair-psu) Close HID device on probe errors Johan Hovold <johan(a)kernel.org> clk: rk808: fix OF node reference imbalance Sanman Pradhan <psanman(a)juniper.net> hwmon: (ltc2992) Fix u32 overflow in power read path Sanman Pradhan <psanman(a)juniper.net> hwmon: (ltc2992) Clamp threshold writes to hardware range Ivan Hu <ivan.hu(a)canonical.com> x86/efi: Fix graceful fault handling after FPU softirq changes Hongling Zeng <zenghongling(a)kylinos.cn> parisc: Fix IRQ leak in LASI driver Tzung-Bi Shih <tzungbi(a)kernel.org> platform/chrome: cros_ec_typec: Init mutex in Thunderbolt registration Colin Walters <walters(a)verbum.org> ovl: fix verity lazy-load guard broken by fsverity_active() semantic change Pavitra Jha <jhapavitra98(a)gmail.com> net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler Nan Li <tonanli66(a)gmail.com> net/rds: handle zerocopy send cleanup before the message is queued Breno Leitao <leitao(a)debian.org> netpoll: pass buffer size to egress_dev() to avoid MAC truncation Jiawen Wu <jiawenwu(a)trustnetic.com> net: libwx: use request_irq for VF misc interrupt Maoyi Xie <maoyixie.tju(a)gmail.com> ip6_gre: Use cached t->net in ip6erspan_changelink(). Jiawen Wu <jiawenwu(a)trustnetic.com> net: libwx: fix VF illegal register access Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> pseries/papr-hvpipe: Fix the usage of copy_to_user() Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> pseries/papr-hvpipe: Fix & simplify error handling in papr_hvpipe_init() Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> pseries/papr-hvpipe: Fix null ptr deref in papr_hvpipe_dev_create_handle() Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> pseries/papr-hvpipe: Prevent kernel stack memory leak to userspace Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> pseries/papr-hvpipe: Fix race with interrupt handler SeungJu Cheon <suunj1331(a)gmail.com> sound: ua101: fix division by zero at probe Karol Wachowski <karol.wachowski(a)linux.intel.com> accel/ivpu: Disallow re-exporting imported GEM objects Thomas Gleixner <tglx(a)kernel.org> selftests/rseq: Expand for optimized RSEQ ABI v2 Thomas Gleixner <tglx(a)kernel.org> selftests/rseq: Validate legacy behavior Thomas Gleixner <tglx(a)kernel.org> selftests/rseq: Skip tests if time slice extensions are not available Thomas Gleixner <tglx(a)kernel.org> selftests/rseq: Make registration flexible for legacy and optimized mode Thomas Gleixner <tglx(a)kernel.org> rseq: Don't advertise time slice extensions if disabled Thomas Gleixner <tglx(a)kernel.org> rseq: Protect rseq_reset() against interrupts Thomas Gleixner <tglx(a)kernel.org> rseq: Set rseq::cpu_id_start to 0 on unregistration Mark Brown <broonie(a)kernel.org> selftests/rseq: Don't run tests with runner scripts outside of the scripts Dapeng Mi <dapeng1.mi(a)linux.intel.com> perf/x86/intel: Improve validation and configuration of ACR masks Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: skip inactive subflows Kai Zen <kai.aizen.dev(a)gmail.com> net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo Xianglai Li <lixianglai(a)loongson.cn> LoongArch: KVM: Compile switch.S directly into the kernel Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Fix SYM_SIGFUNC_START definition for 32BIT Sang-Heon Jeon <ekffu200098(a)gmail.com> mm/hugetlb_cma: round up per_node before logging it Kevin Brodsky <kevin.brodsky(a)arm.com> arm64: signal: Preserve POR_EL0 if poe_context is missing Tudor Ambarus <tudor.ambarus(a)linaro.org> mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show() Fuad Tabba <tabba(a)google.com> KVM: arm64: Fix kvm_vcpu_initialized() macro parameter Miklos Szeredi <mszeredi(a)redhat.com> fanotify: fix false positive on permission events Johan Hovold <johan(a)kernel.org> staging: vme_user: fix root device leak on init failure Shyam Sunder Reddy Padira <shyamsunderreddypadira(a)gmail.com> staging: rtl8723bs: os_dep: avoid NULL pointer dereference in rtw_cbuf_alloc Johan Hovold <johan(a)kernel.org> spi: s3c64xx: fix NULL-deref on driver unbind Johan Hovold <johan(a)kernel.org> spi: tegra20-sflash: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: zynqmp-gqspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: tegra114: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sun6i: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: ti-qspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: zynq-qspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sun4i: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: syncuacer: fix controller deregistration Gary Guo <gary(a)garyguo.net> rust: pin-init: internal: move alignment check to `make_field_check` Miguel Ojeda <ojeda(a)kernel.org> rust: allow `clippy::collapsible_if` globally Miguel Ojeda <ojeda(a)kernel.org> rust: allow `clippy::collapsible_match` globally Eliot Courtney <ecourtney(a)nvidia.com> rust: drm: gem: clean up GEM state in init failure case Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt David Carlier <devnexen(a)gmail.com> Bluetooth: hci_conn: fix potential UAF in create_big_sync Tristan Madani <tristan(a)talencesecurity.com> Bluetooth: btmtk: validate WMT event SKB length before struct access Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: virtio_bt: validate rx pkt_type header length Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: virtio_bt: clamp rx length before skb_put Tao Cui <cuitao(a)kylinos.cn> LoongArch: KVM: Fix missing EMULATE_FAIL in kvm_emu_mmio_read() Jens Axboe <axboe(a)kernel.dk> io_uring/tw: serialize ctx->retry_llist with ->uring_lock Martin Michaelis <code(a)mgjm.de> io_uring/kbuf: support min length left for incremental buffers Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: allow multiple opens of /sys/fs/selinux/policy Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: prune /sys/fs/selinux/user Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: prune /sys/fs/selinux/disable Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: prune /sys/fs/selinux/checkreqprot Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: shrink critical section in sel_write_load() David Windsor <dwindsor(a)gmail.com> selinux: don't reserve xattr slot when we won't fill it Zongyao Chen <ZongYao.Chen(a)linux.alibaba.com> selinux: use sk blob accessor in socket permission helpers Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: fix avdcache auditing Michael Bommarito <michael.bommarito(a)gmail.com> xfrm: ah: account for ESN high bits in async callbacks Yilin Zhu <zylzyl2333(a)gmail.com> ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() Michal Kosiorek <mkosiorek121(a)gmail.com> xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete Ruijie Li <ruijieli51(a)gmail.com> xfrm: provide message size for XFRM_MSG_MAPPING Tejun Heo <tj(a)kernel.org> sched_ext: Read scx_root under scx_cgroup_ops_rwsem in cgroup setters Ard Biesheuvel <ardb(a)kernel.org> x86/efi: Restore IRQ state in EFI page fault handler Sourabh Jain <sourabhjain(a)linux.ibm.com> powerpc/kdump: fix KASAN sanitization flag for core_$(BITS).o Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: seq: Fix UMP group 16 filtering Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: core: Serialize deferred fasync state checks Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: firewire-tascam: Do not drop unread control events Yuriy Padlyak <yuriypadlyak(a)gmail.com> ALSA: hda/realtek: Fix speaker silence after S3 resume on Xiaomi Mi Laptop Pro 15 Takashi Iwai <tiwai(a)suse.de> ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: hda: cs35l56: Propagate ASP TX source control errors Xu Yang <xu.yang_2(a)nxp.com> usb: typec: tcpm: fix debug accessory mode detection for sink ports Felix Gu <ustc.gu(a)gmail.com> usb: ulpi: fix memory leak on ulpi_register() error paths Fabio Porcedda <fabio.porcedda(a)gmail.com> USB: serial: option: add Telit Cinterion LE910Cx compositions Aaro Koskinen <aaro.koskinen(a)iki.fi> USB: omap_udc: DMA: Don't enable burst 4 mode Selvarasu Ganesan <selvarasu.g(a)samsung.com> usb: dwc3: Move GUID programming after PHY initialization Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Fix UAC3 cluster descriptor size check Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: midi2: Restart output URBs on resume Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: usblp: fix heap leak in IEEE 1284 device ID via short response Marek Szyprowski <m.szyprowski(a)samsung.com> wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task Tristan Madani <tristan(a)talencesecurity.com> wifi: b43: enforce bounds check on firmware key index in b43_rx() Johannes Berg <johannes.berg(a)intel.com> wifi: mac80211: remove station if connection prep fails Jiri Slaby (SUSE) <jirislaby(a)kernel.org> wifi: ath5k: do not access array OOB Benjamin Berg <benjamin.berg(a)intel.com> wifi: mac80211: use safe list iteration in radar detect work Jeongjun Park <aha310510(a)gmail.com> wifi: rsi: fix kthread lifetime race between self-exit and external-stop Catherine <enderaoelyther(a)gmail.com> wifi: mac80211: drop stray 'static' from fast-RX rx_result Tristan Madani <tristan(a)talencesecurity.com> wifi: b43legacy: enforce bounds check on firmware key index in RX path Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work Leon Yen <leon.yen(a)mediatek.com> wifi: mt76: mt7921: fix a potential clc buffer length underflow Ming Yen Hsieh <mingyen.hsieh(a)mediatek.com> wifi: mt76: mt7925: fix incorrect length field in txpower command Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7925: fix AMPDU state handling in mt7925_tx_check_aggr Jann Horn <jannh(a)google.com> exit: prevent preemption of oopsing TASK_DEAD task Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked Yi Kuo <yi(a)yikuo.dev> smb: client/smbdirect: fix MR registration for coalesced SG lists Qingfang Deng <qingfang.deng(a)linux.dev> flow_dissector: do not dissect PPPoE PFC frames Sean Christopherson <seanjc(a)google.com> KVM: x86: Fix shadow paging use-after-free due to unexpected GFN DaeMyung Kang <charsyam(a)gmail.com> ksmbd: rewrite stop_sessions() with restartable iteration Johan Hovold <johan(a)kernel.org> spi: rockchip: fix controller deregistration Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7925: fix incorrect TLV length in CLC command Mark Brown <broonie(a)kernel.org> ASoC: SOF: Don't allow pointer operations on unconfigured streams Sina Hassani <sina(a)openai.com> iommufd: Fix a race with concurrent allocation and unmap David Carlier <devnexen(a)gmail.com> tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() Shivam Kalra <shivamkalra98(a)zohomail.in> ACPI: video: force native backlight on HP OMEN 16 (8A44) Jinjie Ruan <ruanjinjie(a)huawei.com> ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug Jan Schär <jan(a)jschaer.ch> ACPI: video: Add backlight=native quirk for Dell OptiPlex 7770 AIO Guangshuo Li <lgs201920130244(a)gmail.com> ACPI: scan: Use acpi_dev_put() in object add error paths Breno Leitao <leitao(a)debian.org> ACPI: arm64: cpuidle: Tolerate platforms with no deep PSCI idle states Rajat Gupta <rajgupt(a)qti.qualcomm.com> fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free Corey Minyard <corey(a)minyard.net> ipmi:si: Return state to normal if message allocation fails Corey Minyard <corey(a)minyard.net> ipmi: Check event message buffer response for bad data Corey Minyard <corey(a)minyard.net> ipmi: Add limits to event and receive message requests Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() ------------- Diffstat: .../ABI/{obsolete => removed}/sysfs-selinux-user | 0 Makefile | 6 +- arch/arm64/include/asm/kvm_host.h | 2 +- arch/arm64/kernel/ptrace.c | 4 +- arch/arm64/kernel/signal.c | 54 +++- arch/arm64/kvm/arm.c | 4 + arch/arm64/kvm/config.c | 17 +- arch/arm64/kvm/hyp/nvhe/pkvm.c | 38 ++- arch/arm64/kvm/hyp/nvhe/setup.c | 8 +- arch/arm64/kvm/vgic/vgic-mmio-v2.c | 2 +- arch/arm64/kvm/vgic/vgic-mmio-v3.c | 2 +- arch/loongarch/Kbuild | 2 +- arch/loongarch/include/asm/asm-prototypes.h | 20 ++ arch/loongarch/include/asm/kvm_host.h | 3 - arch/loongarch/include/asm/linkage.h | 2 +- arch/loongarch/kvm/Makefile | 3 +- arch/loongarch/kvm/exit.c | 1 + arch/loongarch/kvm/interrupt.c | 14 ++ arch/loongarch/kvm/main.c | 35 +-- arch/loongarch/kvm/mmu.c | 2 +- arch/loongarch/kvm/switch.S | 22 +- arch/loongarch/kvm/timer.c | 10 +- arch/loongarch/kvm/vm.c | 2 +- arch/loongarch/pci/acpi.c | 5 + arch/loongarch/pci/pci.c | 3 + arch/powerpc/kexec/Makefile | 2 +- arch/powerpc/platforms/pseries/papr-hvpipe.c | 122 +++++---- arch/powerpc/sysdev/xive/common.c | 16 +- arch/riscv/kvm/vcpu_vector.c | 5 +- arch/s390/kernel/debug.c | 8 + arch/x86/events/core.c | 13 +- arch/x86/events/intel/core.c | 50 +++- arch/x86/events/perf_event.h | 10 + arch/x86/include/asm/efi.h | 3 +- arch/x86/include/asm/msr-index.h | 3 +- arch/x86/kernel/cpu/amd.c | 3 + arch/x86/kernel/e820.c | 6 +- arch/x86/kvm/hyperv.c | 2 +- arch/x86/kvm/lapic.c | 8 +- arch/x86/kvm/mmu/mmu.c | 35 ++- arch/x86/mm/fault.c | 2 +- arch/x86/platform/efi/quirks.c | 13 +- block/blk-zoned.c | 151 +++++------ block/blk.h | 2 + block/ioctl.c | 24 +- drivers/accel/ivpu/ivpu_drv.c | 21 ++ drivers/acpi/arm64/cpuidle.c | 10 +- drivers/acpi/cppc_acpi.c | 6 +- drivers/acpi/power.c | 2 +- drivers/acpi/scan.c | 2 +- drivers/acpi/video_detect.c | 16 ++ drivers/android/binder/range_alloc/array.rs | 1 - drivers/bluetooth/btmtk.c | 15 +- drivers/bluetooth/virtio_bt.c | 39 ++- drivers/char/ipmi/ipmi_si_intf.c | 70 ++++-- drivers/char/ipmi/ipmi_ssif.c | 23 +- drivers/clk/clk-rk808.c | 2 +- drivers/clk/imx/clk-imx8-acm.c | 3 +- drivers/clk/microchip/clk-mpfs-ccc.c | 6 +- drivers/cpuidle/cpuidle-powernv.c | 5 +- drivers/cpuidle/cpuidle-pseries.c | 5 +- drivers/crypto/caam/caamalg_qi2.c | 4 +- drivers/crypto/caam/caamhash.c | 4 +- .../crypto/intel/qat/qat_common/adf_accel_engine.c | 7 + .../qat/qat_common/icp_qat_fw_loader_handle.h | 1 + drivers/crypto/intel/qat/qat_common/qat_hal.c | 27 +- drivers/extcon/extcon-ptn5150.c | 14 ++ drivers/gpio/gpiolib-of.c | 9 +- drivers/hv/Kconfig | 2 +- drivers/hwmon/corsair-psu.c | 4 +- drivers/hwmon/ltc2992.c | 41 ++- drivers/infiniband/hw/hns/hns_roce_qp.c | 7 + drivers/infiniband/hw/ionic/ionic_ibdev.c | 2 +- drivers/infiniband/hw/mana/cq.c | 5 +- drivers/infiniband/hw/mana/qp.c | 16 +- drivers/infiniband/hw/mlx4/srq.c | 4 +- drivers/infiniband/hw/mlx5/main.c | 1 + drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 4 +- drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c | 2 +- drivers/infiniband/sw/rxe/rxe_recv.c | 11 + drivers/infiniband/sw/rxe/rxe_resp.c | 14 +- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 7 + drivers/iommu/intel/nested.c | 6 +- drivers/iommu/iommufd/eventq.c | 5 +- drivers/iommu/iommufd/io_pagetable.c | 10 + drivers/md/dm-ioctl.c | 6 +- drivers/md/dm-verity-fec.c | 113 ++++----- drivers/md/dm-verity-fec.h | 3 +- drivers/md/persistent-data/dm-btree-remove.c | 8 + drivers/md/raid10.c | 2 + drivers/mmc/core/card.h | 11 + drivers/mmc/core/mmc.c | 12 + drivers/mmc/core/queue.c | 9 +- drivers/mmc/core/quirks.h | 12 + drivers/mtd/spi-nor/debugfs.c | 4 +- drivers/net/ethernet/ibm/ibmveth.c | 22 ++ drivers/net/ethernet/ibm/ibmveth.h | 1 + drivers/net/ethernet/intel/ice/ice_sf_eth.c | 2 + .../ethernet/marvell/octeon_ep_vf/octep_vf_rx.c | 36 ++- drivers/net/ethernet/mellanox/mlx4/srq.c | 13 +- drivers/net/ethernet/stmicro/stmmac/chain_mode.c | 2 +- drivers/net/ethernet/stmicro/stmmac/common.h | 2 +- drivers/net/ethernet/stmicro/stmmac/ring_mode.c | 2 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 41 +-- drivers/net/ethernet/wangxun/libwx/wx_hw.c | 7 +- drivers/net/ethernet/wangxun/libwx/wx_vf_common.c | 4 +- drivers/net/wireless/ath/ath5k/base.c | 3 +- drivers/net/wireless/broadcom/b43/xmit.c | 3 +- drivers/net/wireless/broadcom/b43legacy/xmit.c | 3 +- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 6 +- drivers/net/wireless/mediatek/mt76/mt7921/main.c | 7 +- drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | 3 + drivers/net/wireless/mediatek/mt76/mt7925/mac.c | 6 +- drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 4 +- drivers/net/wireless/rsi/rsi_common.h | 5 +- drivers/net/wwan/t7xx/t7xx_modem_ops.c | 20 +- drivers/net/wwan/t7xx/t7xx_port_ctrl_msg.c | 18 +- drivers/net/wwan/t7xx/t7xx_port_proxy.h | 2 +- drivers/nvme/host/apple.c | 6 +- drivers/nvme/target/core.c | 2 +- drivers/nvme/target/tcp.c | 26 ++ drivers/parisc/lasi.c | 12 +- drivers/pci/pci.c | 7 +- drivers/pci/pcie/aer.c | 2 - drivers/pci/pcie/aspm.c | 17 +- drivers/pci/setup-res.c | 2 + drivers/platform/chrome/cros_typec_altmode.c | 1 + drivers/pmdomain/core.c | 10 +- drivers/pmdomain/mediatek/mtk-pm-domains.c | 10 +- drivers/power/supply/max17042_battery.c | 2 +- drivers/remoteproc/imx_rproc.c | 2 +- drivers/remoteproc/ti_k3_common.c | 2 +- drivers/scsi/mpt3sas/mpt3sas_scsih.c | 14 +- drivers/spi/spi-microchip-core-qspi.c | 103 ++++++-- drivers/spi/spi-microchip-core-spi.c | 4 +- drivers/spi/spi-rockchip.c | 4 +- drivers/spi/spi-s3c64xx.c | 5 - drivers/spi/spi-sun4i.c | 10 +- drivers/spi/spi-sun6i.c | 8 +- drivers/spi/spi-synquacer.c | 8 +- drivers/spi/spi-tegra114.c | 8 +- drivers/spi/spi-tegra20-sflash.c | 8 +- drivers/spi/spi-ti-qspi.c | 14 +- drivers/spi/spi-topcliff-pch.c | 11 +- drivers/spi/spi-zynq-qspi.c | 15 +- drivers/spi/spi-zynqmp-gqspi.c | 4 +- drivers/staging/rtl8723bs/os_dep/osdep_service.c | 3 +- drivers/staging/vme_user/vme_fake.c | 2 + drivers/target/target_core_configfs.c | 2 +- drivers/thermal/sprd_thermal.c | 4 +- drivers/thermal/thermal_core.c | 6 +- drivers/usb/class/usblp.c | 3 +- drivers/usb/common/ulpi.c | 5 +- drivers/usb/dwc3/core.c | 12 +- drivers/usb/gadget/udc/omap_udc.c | 4 - drivers/usb/serial/option.c | 4 + drivers/usb/typec/tcpm/tcpm.c | 25 +- drivers/video/fbdev/core/fbcon_rotate.c | 5 +- drivers/video/fbdev/udlfb.c | 31 ++- fs/btrfs/inode.c | 8 + fs/btrfs/ioctl.c | 5 +- fs/btrfs/space-info.c | 6 +- fs/f2fs/data.c | 28 ++- fs/f2fs/extent_cache.c | 17 +- fs/f2fs/f2fs.h | 5 + fs/f2fs/inline.c | 22 +- fs/f2fs/inode.c | 2 +- fs/f2fs/node.c | 95 +++---- fs/f2fs/super.c | 11 + fs/f2fs/sysfs.c | 10 +- fs/hfsplus/bfind.c | 51 ++++ fs/hfsplus/catalog.c | 4 +- fs/hfsplus/dir.c | 2 +- fs/hfsplus/hfsplus_fs.h | 9 + fs/hfsplus/super.c | 6 +- fs/isofs/export.c | 2 +- fs/isofs/rock.c | 9 + fs/notify/fsnotify.c | 2 +- fs/notify/mark.c | 18 +- fs/overlayfs/util.c | 2 +- fs/smb/client/cached_dir.c | 8 + fs/smb/client/cifsacl.c | 37 ++- fs/smb/client/smb2inode.c | 12 +- fs/smb/client/smb2misc.c | 3 +- fs/smb/client/smb2ops.c | 11 + fs/smb/client/smbdirect.c | 21 +- fs/smb/server/connection.c | 48 +++- fs/smb/server/connection.h | 1 + fs/tracefs/event_inode.c | 14 ++ fs/tracefs/inode.c | 6 +- fs/tracefs/internal.h | 3 + fs/udf/misc.c | 8 +- include/linux/fsnotify_backend.h | 1 + include/linux/if_vlan.h | 25 +- include/linux/mmc/card.h | 2 + include/linux/printk.h | 13 + include/linux/rseq.h | 2 + include/uapi/linux/io_uring.h | 3 +- include/uapi/linux/rseq.h | 5 +- include/video/udlfb.h | 1 + io_uring/kbuf.c | 8 +- io_uring/kbuf.h | 7 + io_uring/tw.c | 12 +- kernel/bpf/arena.c | 19 +- kernel/exit.c | 1 + kernel/rseq.c | 29 ++- kernel/sched/ext.c | 19 +- kernel/sched/ext_idle.c | 12 +- kernel/trace/fprobe.c | 279 ++++++++++++--------- kernel/trace/trace_probe.c | 6 + kernel/trace/trace_probe.h | 4 +- kernel/tracepoint.c | 2 + lib/crc/Kconfig | 7 +- lib/crc/tests/crc_kunit.c | 28 ++- lib/crypto/mpi/mpicoder.c | 2 +- lib/scatterlist.c | 8 +- mm/damon/lru_sort.c | 85 ++++--- mm/damon/reclaim.c | 85 ++++--- mm/damon/stat.c | 30 ++- mm/damon/sysfs-schemes.c | 24 +- mm/hugetlb_cma.c | 1 + net/8021q/vlan_dev.c | 45 ++-- net/8021q/vlan_netlink.c | 10 +- net/8021q/vlanproc.c | 12 +- net/bluetooth/hci_conn.c | 19 +- net/bluetooth/hci_event.c | 29 ++- net/bluetooth/l2cap_sock.c | 9 + net/ceph/auth.c | 2 +- net/ceph/mon_client.c | 2 + net/core/flow_dissector.c | 13 +- net/core/netpoll.c | 23 +- net/core/rtnetlink.c | 1 + net/ipv4/ah4.c | 14 +- net/ipv6/ah6.c | 14 +- net/ipv6/ip6_gre.c | 5 +- net/ipv6/xfrm6_protocol.c | 4 +- net/mac80211/mlme.c | 9 +- net/mac80211/rx.c | 2 +- net/mac80211/util.c | 4 +- net/mptcp/fastopen.c | 4 +- net/mptcp/pm.c | 62 +++-- net/mptcp/pm_kernel.c | 14 +- net/mptcp/protocol.c | 3 +- net/mptcp/sockopt.c | 16 +- net/mptcp/subflow.c | 4 +- net/openvswitch/vport-netdev.c | 6 +- net/psp/psp_main.c | 42 +++- net/rds/message.c | 20 +- net/sched/sch_red.c | 2 +- net/unix/af_unix.c | 3 + net/vmw_vsock/hyperv_transport.c | 33 ++- net/xfrm/xfrm_state.c | 12 +- net/xfrm/xfrm_user.c | 1 + rust/kernel/drm/gem/mod.rs | 13 +- rust/pin-init/internal/src/init.rs | 184 +++++++------- rust/pin-init/src/__internal.rs | 28 ++- security/selinux/hooks.c | 38 ++- security/selinux/include/objsec.h | 4 +- security/selinux/include/security.h | 2 - security/selinux/selinuxfs.c | 196 +++------------ security/selinux/ss/services.c | 125 --------- sound/core/misc.c | 8 +- sound/core/oss/pcm_oss.c | 29 ++- sound/core/seq/seq_clientmgr.c | 2 +- sound/core/seq/seq_clientmgr.h | 5 +- sound/core/seq/seq_ump_client.c | 2 +- sound/firewire/tascam/tascam-hwdep.c | 1 + sound/hda/codecs/realtek/alc269.c | 19 ++ sound/hda/codecs/side-codecs/cs35l56_hda.c | 19 +- sound/soc/amd/yc/acp6x-mach.c | 14 ++ sound/soc/codecs/es8389.c | 2 +- sound/soc/fsl/fsl_easrc.c | 2 +- sound/soc/intel/boards/bytcr_wm5102.c | 1 + sound/soc/qcom/qdsp6/q6apm-dai.c | 1 + sound/soc/qcom/qdsp6/q6apm-lpass-dais.c | 2 +- sound/soc/qcom/qdsp6/q6apm.c | 3 + sound/soc/sof/compress.c | 3 + sound/usb/midi2.c | 9 +- sound/usb/misc/ua101.c | 7 + sound/usb/stream.c | 4 +- tools/arch/x86/include/asm/msr-index.h | 3 +- tools/testing/selftests/net/mptcp/mptcp_lib.sh | 16 +- tools/testing/selftests/net/mptcp/pm_netlink.sh | 20 +- tools/testing/selftests/rseq/Makefile | 21 +- tools/testing/selftests/rseq/check_optimized.c | 17 ++ tools/testing/selftests/rseq/legacy_check.c | 65 +++++ tools/testing/selftests/rseq/param_test.c | 25 +- tools/testing/selftests/rseq/rseq-abi.h | 7 +- tools/testing/selftests/rseq/rseq.c | 39 ++- tools/testing/selftests/rseq/rseq.h | 8 +- tools/testing/selftests/rseq/run_legacy_check.sh | 4 + tools/testing/selftests/rseq/run_param_test.sh | 39 +++ tools/testing/selftests/rseq/run_timeslice_test.sh | 14 ++ tools/testing/selftests/rseq/slice_test.c | 12 +- 294 files changed, 3030 insertions(+), 1615 deletions(-)

4 weeks

[PATCH 6.18 000/270] 6.18.30-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.18.30 release. There are 270 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 14 May 2026 17:38:03 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.30-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.18.30-rc1 Prathyushi Nangia <prathyushi.nangia(a)amd.com> x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache Gary Guo <gary(a)garyguo.net> rust: pin-init: fix incorrect accessor reference lifetime Sam Edwards <cfsworks(a)gmail.com> net: stmmac: Prevent NULL deref when RX memory exhausted Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY() Thorsten Blum <thorsten.blum(a)linux.dev> crypto: caam - guard HMAC key hex dumps in hash_digest_key Thorsten Blum <thorsten.blum(a)linux.dev> printk: add print_hex_dump_devel() Junrui Luo <moonafterrain(a)outlook.com> erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap() Gao Xiang <xiang(a)kernel.org> erofs: tidy up z_erofs_lz4_handle_overlap() Zilin Guan <zilin(a)seu.edu.cn> hfsplus: fix held lock freed on hfsplus_fill_super() Deepanshu Kartikey <kartikey406(a)gmail.com> hfsplus: fix uninit-value by validating catalog record size Krzysztof Kozlowski <krzysztof.kozlowski(a)oss.qualcomm.com> firmware: exynos-acpm: Drop fake 'const' on handle pointer Kairui Song <kasong(a)tencent.com> mm, swap: speed up hibernation allocation and writeout Suman Kumar Chakraborty <suman.kumar.chakraborty(a)intel.com> crypto: qat - fix firmware loading failure for GEN6 devices Suman Kumar Chakraborty <suman.kumar.chakraborty(a)intel.com> crypto: qat - fix indentation of macros in qat_hal.c Luke Wang <ziniu.wang_1(a)nxp.com> mmc: core: Optimize time for secure erase/trim for some Kingston eMMCs Avri Altman <avri.altman(a)sandisk.com> mmc: core: Add quirk for incorrect manufacturing date Avri Altman <avri.altman(a)sandisk.com> mmc: core: Adjust MDT beyond 2025 David Carlier <devnexen(a)gmail.com> octeon_ep_vf: add NULL check for napi_build_skb() Thomas Weißschuh <linux(a)weissschuh.net> hwmon: (powerz) Avoid cacheline sharing for DMA buffer Michael S. Tsirkin <mst(a)redhat.com> dma-mapping: add __dma_from_device_group_begin()/end() Thomas Zimmermann <tzimmermann(a)suse.de> fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info SeongJae Park <sj(a)kernel.org> mm/damon/core: disallow non-power of two min_region_sz on damon_start() Alexei Starovoitov <ast(a)kernel.org> bpf: Fix use-after-free in arena_vm_close on fork Jens Axboe <axboe(a)kernel.dk> io_uring/tw: serialize ctx->retry_llist with ->uring_lock Martin Michaelis <code(a)mgjm.de> io_uring/kbuf: support min length left for incremental buffers Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Use per-root-bridge PCIH flag to skip mem resource fixup Tao Cui <cuitao(a)kylinos.cn> LoongArch: KVM: Use kvm_set_pte() in kvm_flush_pte() Bibo Mao <maobibo(a)loongson.cn> LoongArch: KVM: Move unconditional delay into timer clear scenery Bibo Mao <maobibo(a)loongson.cn> LoongArch: KVM: Fix HW timer interrupt lost when inject interrupt by software Xianglai Li <lixianglai(a)loongson.cn> LoongArch: KVM: Fix "unreliable stack" for kvm_exc_entry Qiang Ma <maqianga(a)uniontech.com> LoongArch: KVM: Cap KVM_CAP_NR_VCPUS by KVM_CAP_MAX_VCPUS Wentao Guan <guanwentao(a)uniontech.com> LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang() Fuad Tabba <tabba(a)google.com> KVM: arm64: Fix pin leak and publication ordering in __pkvm_init_vcpu() Fuad Tabba <tabba(a)google.com> KVM: arm64: Fix FEAT_Debugv8p9 to check DebugVer, not PMUVer Fuad Tabba <tabba(a)google.com> KVM: arm64: Fix FEAT_SPE_FnE to use PMSIDR_EL1.FnE, not PMSVer Quentin Perret <qperret(a)google.com> KVM: arm64: Fix initialisation order in __pkvm_init_finalise() David Woodhouse <dwmw(a)amazon.co.uk> KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value Marc Zyngier <maz(a)kernel.org> KVM: arm64: Wake-up from WFI when iqrchip is in userspace Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix fsck inconsistency caused by FGGC of node block Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix inline data not being written to disk in writeback path Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: refactor f2fs_move_node_folio function Guangshuo Li <lgs201920130244(a)gmail.com> f2fs: fix uninitialized kobject put in f2fs_init_sysfs() Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix node_cnt race between extent node destroy and writeback Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix incorrect multidevice info in trace_f2fs_map_blocks() Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix incorrect file address mapping when inline inode is unwritten Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix fsck inconsistency caused by incorrect nat_entry flag usage Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix fiemap boundary handling when read extent cache is incomplete Cen Zhang <zzzccc427(a)gmail.com> f2fs: add READ_ONCE() for i_blocks in f2fs_update_inode() Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: return early if no retrans Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: free sk if last Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: always decrease sk refcount Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: fix potential data-race Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: allow ID 0 Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: kernel: correctly retransmit ADD_ADDR ID 0 Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: prio: skip closed subflows Gang Yan <yangang(a)kylinos.cn> mptcp: fix scheduling with atomic in timestamp sockopt Paolo Abeni <pabeni(a)redhat.com> mptcp: fix rx timestamp corruption on fastopen Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: sockopt: increase seq in mptcp_setsockopt_all_sf Gang Yan <yangang(a)kylinos.cn> mptcp: sockopt: set timestamp flags on subflow socket, not msk Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: fastclose msk when linger time is 0 Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: mptcp: pm: restrict 'unknown' check to pm_nl_ctl Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: mptcp: check output: catch cmd errors David Carlier <devnexen(a)gmail.com> sched_ext: idle: Recheck prev_cpu after narrowing allowed mask Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/rxe: Reject unknown opcodes before ICRC processing Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() Junrui Luo <moonafterrain(a)outlook.com> RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Validate rx_hash_key_len Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/ionic: Fix typo in format string Kai Zen <kai.aizen.dev(a)gmail.com> RDMA/ionic: bound node_desc sysfs read with %.64s Dapeng Mi <dapeng1.mi(a)linux.intel.com> perf/x86/intel: Always reprogram ACR events to prevent stale masks Nilay Shroff <nilay(a)linux.ibm.com> powerpc/xive: fix kmemleak caused by incorrect chip_data lookup André Draszik <andre.draszik(a)linaro.org> power: supply: max17042: avoid overflow when determining health Lukas Wunner <lukas(a)wunner.de> PCI/ASPM: Fix pci_clear_and_set_config_dword() usage Lukas Wunner <lukas(a)wunner.de> PCI/AER: Stop ruling out unbound devices as error source Shuai Xue <xueshuai(a)linux.alibaba.com> PCI/AER: Clear only error bits in PCIe Device Status Lukas Wunner <lukas(a)wunner.de> PCI: Update saved_config_space upon resource assignment SeongJae Park <sj(a)kernel.org> mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock SeongJae Park <sj(a)kernel.org> mm/damon/stat: detect and use fresh enabled value Paolo Bonzini <pbonzini(a)redhat.com> KVM: x86: Do IRR scan in __kvm_apic_update_irr even if PIR is empty Paolo Bonzini <pbonzini(a)redhat.com> KVM: x86: check for nEPT/nNPT in slow flush hypercalls Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: validate dacloffset before building DACL pointers Bjoern Doebel <doebel(a)amazon.de> smb: client: use kzalloc to zero-initialize security descriptor buffer Zisen Ye <zisenye(a)stu.xidian.edu.cn> smb/client: fix out-of-bounds read in symlink_data() Zisen Ye <zisenye(a)stu.xidian.edu.cn> smb/client: fix out-of-bounds read in smb2_compound_op() Ranjan Kumar <ranjan.kumar(a)broadcom.com> scsi: mpt3sas: Limit NVMe request size to 2 MiB Pengpeng Hou <pengpeng(a)iscas.ac.cn> s390/debug: Reject zero-length input before trimming a newline Vasily Gorbik <gor(a)linux.ibm.com> s390/debug: Reject zero-length input in debug_input_flush_fn() Osama Abdelkader <osama.abdelkader(a)gmail.com> riscv: kvm: fix vector context allocation leak Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/hns: Fix unlocked call to hns_roce_qp_remove() David Carlier <devnexen(a)gmail.com> psp: strip variable-length PSP header in psp_dev_rcv() Ulf Hansson <ulf.hansson(a)linaro.org> pmdomain: core: Fix detach procedure for virtual devices in genpd Ilya Maximets <i.maximets(a)ovn.org> openvswitch: vport: fix self-deadlock on release of tunnel ports Chaitanya Kulkarni <kch(a)nvidia.com> nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free Chaitanya Kulkarni <kch(a)nvidia.com> nvmet-tcp: fix race between ICReq handling and queue teardown Fedor Pchelkin <pchelkin(a)ispras.ru> nvme-apple: drop invalid put of admin queue reference count Junrui Luo <moonafterrain(a)outlook.com> md/raid10: fix divide-by-zero in setup_geo() with zero far_copies Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Fix slab-out-of-bounds access in auth message processing Christian A. Ehrhardt <lk(a)c--e.de> lib/scatterlist: fix temp buffer in extract_user_to_sg() Christian A. Ehrhardt <lk(a)c--e.de> lib/scatterlist: fix length calculations in extract_kvec_to_sg Lukas Wunner <lukas(a)wunner.de> lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() Nicolin Chen <nicolinc(a)nvidia.com> iommu/arm-smmu-v3: Add a missing dma_wmb() for hitless STE update Zhenzhong Duan <zhenzhong.duan(a)intel.com> iommu/vt-d: Block PASID attachment to nested domain with dirty tracking Zhenzhong Duan <zhenzhong.duan(a)intel.com> iommufd: Fix return value of iommufd_fault_fops_write() Michael Bommarito <michael.bommarito(a)gmail.com> isofs: validate block number from NFS file handle in isofs_export_iget Michael Bommarito <michael.bommarito(a)gmail.com> isofs: validate Rock Ridge CE continuation extent against volume size Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: correctly reject too-small hash devices Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: correctly reject too-small FEC devices David Carlier <devnexen(a)gmail.com> eventfs: Hold eventfs_mutex and SRCU when remount walks events Mikulas Patocka <mpatocka(a)redhat.com> dm: fix a buffer overflow in ioctl processing Mikulas Patocka <mpatocka(a)redhat.com> dm: don't report warning when doing deferred remove Mikulas Patocka <mpatocka(a)redhat.com> dm-thin: fix metadata refcount underflow Filipe Manana <fdmanana(a)suse.com> btrfs: fix missing last_unlink_trans update when removing a directory Guangshuo Li <lgs201920130244(a)gmail.com> btrfs: fix double free in create_space_info() error path Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm: remove child devices when apm is removed Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error Joseph Salisbury <joseph.salisbury(a)oracle.com> ASoC: fsl_easrc: fix comment typo Li Jian <lazycat-xiao(a)foxmail.com> ASoC: ES8389: convert to devm_clk_get_optional() to get clock Tommaso Soncin <soncintommaso(a)gmail.com> ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table Shrikanth Hegde <sshegde(a)linux.ibm.com> cpuidle: powerpc: avoid double clear when breaking snooze Conor Dooley <conor.dooley(a)microchip.com> clk: microchip: mpfs-ccc: fix out of bounds access during output registration Stefan Eichenberger <stefan.eichenberger(a)toradex.com> clk: imx: imx8-acm: fix flags for acm clocks Steven Rostedt <rostedt(a)goodmis.org> tracing/probes: Limit size of event probe to 3K Johan Hovold <johan(a)kernel.org> spi: topcliff-pch: fix use-after-free on unbind Johan Hovold <johan(a)kernel.org> spi: topcliff-pch: fix controller deregistration Thorsten Blum <thorsten.blum(a)linux.dev> thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp Thorsten Blum <thorsten.blum(a)linux.dev> thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> thermal: core: Free thermal zone ID later during removal Michael Bommarito <michael.bommarito(a)gmail.com> udf: reject descriptors with oversized CRC length David Carlier <devnexen(a)gmail.com> tracefs: Fix default permissions not being applied on initial mount Conor Dooley <conor.dooley(a)microchip.com> spi: microchip-core-qspi: control built-in cs manually Conor Dooley <conor.dooley(a)microchip.com> spi: microchip-core-qspi: don't attempt to transmit during emulated read-only dual/quad operations Johan Hovold <johan(a)kernel.org> spi: microchip-core-qspi: fix controller deregistration Guangshuo Li <lgs201920130244(a)gmail.com> ice: fix double free in ice_sf_eth_activate() error path Mingming Cao <mmc(a)linux.ibm.com> ibmveth: Disable GSO for packets with small MSS Dexuan Cui <decui(a)microsoft.com> hv_sock: Return -EIO for malformed/short packets Dexuan Cui <decui(a)microsoft.com> hv_sock: Report EOF instead of -EIO for FIN Hamza Mahfooz <hamzamahfooz(a)linux.microsoft.com> hv_sock: fix ARM64 support Thomas Zimmermann <tzimmermann(a)suse.de> hv: Select CONFIG_SYSFB only for CONFIG_HYPERV_VMBUS Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> gpio: of: clear OF_POPULATED on hog nodes in remove path Xu Yang <xu.yang_2(a)nxp.com> extcon: ptn5150: handle pending IRQ events during system resume Shyam Prasad N <sprasad(a)microsoft.com> cifs: change_conf needs to be called for session setup Shyam Prasad N <sprasad(a)microsoft.com> cifs: abort open_cached_dir if we don't request leases Jens Axboe <axboe(a)kernel.dk> block: only read from sqe on initial invocation of blkdev_uring_cmd() Naman Jain <namjain(a)linux.microsoft.com> block: add pgmap check to biovec_phys_mergeable Wentao Liang <vulab(a)iscas.ac.cn> pmdomain: mediatek: fix use-after-free in scpsys_get_bus_protection_legacy() Breno Leitao <leitao(a)debian.org> arm64/fpsimd: ptrace: zero target's fpsimd_state, not the tracer's Jiexun Wang <wangjiexun2025(a)gmail.com> af_unix: Reject SIOCATMARK on non-stream sockets Myeonghun Pak <mhun512(a)gmail.com> hwmon: (corsair-psu) Close HID device on probe errors Johan Hovold <johan(a)kernel.org> clk: rk808: fix OF node reference imbalance Sanman Pradhan <psanman(a)juniper.net> hwmon: (ltc2992) Fix u32 overflow in power read path Sanman Pradhan <psanman(a)juniper.net> hwmon: (ltc2992) Clamp threshold writes to hardware range Ivan Hu <ivan.hu(a)canonical.com> x86/efi: Fix graceful fault handling after FPU softirq changes Hongling Zeng <zenghongling(a)kylinos.cn> parisc: Fix IRQ leak in LASI driver Tzung-Bi Shih <tzungbi(a)kernel.org> platform/chrome: cros_ec_typec: Init mutex in Thunderbolt registration Pavitra Jha <jhapavitra98(a)gmail.com> net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler Nan Li <tonanli66(a)gmail.com> net/rds: handle zerocopy send cleanup before the message is queued Breno Leitao <leitao(a)debian.org> netpoll: pass buffer size to egress_dev() to avoid MAC truncation Jiawen Wu <jiawenwu(a)trustnetic.com> net: libwx: use request_irq for VF misc interrupt Maoyi Xie <maoyixie.tju(a)gmail.com> ip6_gre: Use cached t->net in ip6erspan_changelink(). Jiawen Wu <jiawenwu(a)trustnetic.com> net: libwx: fix VF illegal register access Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> pseries/papr-hvpipe: Fix the usage of copy_to_user() Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> pseries/papr-hvpipe: Fix & simplify error handling in papr_hvpipe_init() Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> pseries/papr-hvpipe: Prevent kernel stack memory leak to userspace SeungJu Cheon <suunj1331(a)gmail.com> sound: ua101: fix division by zero at probe Dapeng Mi <dapeng1.mi(a)linux.intel.com> perf/x86/intel: Improve validation and configuration of ACR masks Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: skip inactive subflows Kai Zen <kai.aizen.dev(a)gmail.com> net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo Xianglai Li <lixianglai(a)loongson.cn> LoongArch: KVM: Compile switch.S directly into the kernel Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Fix SYM_SIGFUNC_START definition for 32BIT Sang-Heon Jeon <ekffu200098(a)gmail.com> mm/hugetlb_cma: round up per_node before logging it Kevin Brodsky <kevin.brodsky(a)arm.com> arm64: signal: Preserve POR_EL0 if poe_context is missing Tudor Ambarus <tudor.ambarus(a)linaro.org> mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show() Fuad Tabba <tabba(a)google.com> KVM: arm64: Fix kvm_vcpu_initialized() macro parameter Miklos Szeredi <mszeredi(a)redhat.com> fanotify: fix false positive on permission events Johan Hovold <johan(a)kernel.org> staging: vme_user: fix root device leak on init failure Johan Hovold <johan(a)kernel.org> spi: s3c64xx: fix NULL-deref on driver unbind Johan Hovold <johan(a)kernel.org> spi: zynqmp-gqspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sun6i: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: ti-qspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sun4i: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: syncuacer: fix controller deregistration Miguel Ojeda <ojeda(a)kernel.org> rust: allow `clippy::collapsible_if` globally Miguel Ojeda <ojeda(a)kernel.org> rust: allow `clippy::collapsible_match` globally Eliot Courtney <ecourtney(a)nvidia.com> rust: drm: gem: clean up GEM state in init failure case Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt Tristan Madani <tristan(a)talencesecurity.com> Bluetooth: btmtk: validate WMT event SKB length before struct access Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: virtio_bt: validate rx pkt_type header length Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: virtio_bt: clamp rx length before skb_put Tao Cui <cuitao(a)kylinos.cn> LoongArch: KVM: Fix missing EMULATE_FAIL in kvm_emu_mmio_read() Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: prune /sys/fs/selinux/user Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: prune /sys/fs/selinux/disable Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: prune /sys/fs/selinux/checkreqprot Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: shrink critical section in sel_write_load() David Windsor <dwindsor(a)gmail.com> selinux: don't reserve xattr slot when we won't fill it Zongyao Chen <ZongYao.Chen(a)linux.alibaba.com> selinux: use sk blob accessor in socket permission helpers Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: fix avdcache auditing Michael Bommarito <michael.bommarito(a)gmail.com> xfrm: ah: account for ESN high bits in async callbacks Yilin Zhu <zylzyl2333(a)gmail.com> ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() Michal Kosiorek <mkosiorek121(a)gmail.com> xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete Ruijie Li <ruijieli51(a)gmail.com> xfrm: provide message size for XFRM_MSG_MAPPING Ard Biesheuvel <ardb(a)kernel.org> x86/efi: Restore IRQ state in EFI page fault handler Sourabh Jain <sourabhjain(a)linux.ibm.com> powerpc/kdump: fix KASAN sanitization flag for core_$(BITS).o Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: seq: Fix UMP group 16 filtering Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: core: Serialize deferred fasync state checks Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: firewire-tascam: Do not drop unread control events Yuriy Padlyak <yuriypadlyak(a)gmail.com> ALSA: hda/realtek: Fix speaker silence after S3 resume on Xiaomi Mi Laptop Pro 15 Takashi Iwai <tiwai(a)suse.de> ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: hda: cs35l56: Propagate ASP TX source control errors Xu Yang <xu.yang_2(a)nxp.com> usb: typec: tcpm: fix debug accessory mode detection for sink ports Felix Gu <ustc.gu(a)gmail.com> usb: ulpi: fix memory leak on ulpi_register() error paths Fabio Porcedda <fabio.porcedda(a)gmail.com> USB: serial: option: add Telit Cinterion LE910Cx compositions Aaro Koskinen <aaro.koskinen(a)iki.fi> USB: omap_udc: DMA: Don't enable burst 4 mode Amit Sunil Dhamne <amitsd(a)google.com> usb: typec: tcpm: reset internal port states on soft reset AMS Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Fix UAC3 cluster descriptor size check Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: midi2: Restart output URBs on resume Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: usblp: fix heap leak in IEEE 1284 device ID via short response Marek Szyprowski <m.szyprowski(a)samsung.com> wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task Tristan Madani <tristan(a)talencesecurity.com> wifi: b43: enforce bounds check on firmware key index in b43_rx() Johannes Berg <johannes.berg(a)intel.com> wifi: mac80211: remove station if connection prep fails Jiri Slaby (SUSE) <jirislaby(a)kernel.org> wifi: ath5k: do not access array OOB Benjamin Berg <benjamin.berg(a)intel.com> wifi: mac80211: use safe list iteration in radar detect work Jeongjun Park <aha310510(a)gmail.com> wifi: rsi: fix kthread lifetime race between self-exit and external-stop Catherine <enderaoelyther(a)gmail.com> wifi: mac80211: drop stray 'static' from fast-RX rx_result Tristan Madani <tristan(a)talencesecurity.com> wifi: b43legacy: enforce bounds check on firmware key index in RX path Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work Leon Yen <leon.yen(a)mediatek.com> wifi: mt76: mt7921: fix a potential clc buffer length underflow Ming Yen Hsieh <mingyen.hsieh(a)mediatek.com> wifi: mt76: mt7925: fix incorrect length field in txpower command Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7925: fix AMPDU state handling in mt7925_tx_check_aggr Jann Horn <jannh(a)google.com> exit: prevent preemption of oopsing TASK_DEAD task Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked Ovidiu Panait <ovidiu.panait.rb(a)renesas.com> net: stmmac: Disable EEE RX clock stop when VLAN is enabled Paolo Bonzini <pbonzini(a)redhat.com> KVM: SVM: check validity of VMCB controls when returning from SMM Zhengchuan Liang <zcliangcn(a)gmail.com> net: af_key: zero aligned sockaddr tail in PF_KEY exports Yi Kuo <yi(a)yikuo.dev> smb: client/smbdirect: fix MR registration for coalesced SG lists Gang Yan <yangang(a)kylinos.cn> mptcp: sync the msk->sndbuf at accept() time Qingfang Deng <qingfang.deng(a)linux.dev> flow_dissector: do not dissect PPPoE PFC frames Sam Edwards <cfsworks(a)gmail.com> ceph: fix num_ops off-by-one when crypto allocation fails Sean Christopherson <seanjc(a)google.com> KVM: x86: Fix shadow paging use-after-free due to unexpected GFN DaeMyung Kang <charsyam(a)gmail.com> ksmbd: rewrite stop_sessions() with restartable iteration Johan Hovold <johan(a)kernel.org> spi: rockchip: fix controller deregistration Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7925: fix incorrect TLV length in CLC command Mark Brown <broonie(a)kernel.org> ASoC: SOF: Don't allow pointer operations on unconfigured streams Sina Hassani <sina(a)openai.com> iommufd: Fix a race with concurrent allocation and unmap David Carlier <devnexen(a)gmail.com> tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() Shivam Kalra <shivamkalra98(a)zohomail.in> ACPI: video: force native backlight on HP OMEN 16 (8A44) Jinjie Ruan <ruanjinjie(a)huawei.com> ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug Jan Schär <jan(a)jschaer.ch> ACPI: video: Add backlight=native quirk for Dell OptiPlex 7770 AIO Guangshuo Li <lgs201920130244(a)gmail.com> ACPI: scan: Use acpi_dev_put() in object add error paths Rajat Gupta <rajgupt(a)qti.qualcomm.com> fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free Corey Minyard <corey(a)minyard.net> ipmi:si: Return state to normal if message allocation fails Corey Minyard <corey(a)minyard.net> ipmi: Check event message buffer response for bad data Corey Minyard <corey(a)minyard.net> ipmi: Add limits to event and receive message requests Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() ------------- Diffstat: .../ABI/{obsolete => removed}/sysfs-selinux-user | 0 Makefile | 6 +- arch/arm64/include/asm/kvm_host.h | 2 +- arch/arm64/kernel/ptrace.c | 4 +- arch/arm64/kernel/signal.c | 54 +++++-- arch/arm64/kvm/arm.c | 4 + arch/arm64/kvm/config.c | 17 +- arch/arm64/kvm/hyp/nvhe/pkvm.c | 38 +++-- arch/arm64/kvm/hyp/nvhe/setup.c | 8 +- arch/arm64/kvm/vgic/vgic-mmio-v2.c | 2 +- arch/arm64/kvm/vgic/vgic-mmio-v3.c | 2 +- arch/loongarch/Kbuild | 2 +- arch/loongarch/include/asm/asm-prototypes.h | 20 +++ arch/loongarch/include/asm/kvm_host.h | 3 - arch/loongarch/include/asm/linkage.h | 2 +- arch/loongarch/kvm/Makefile | 3 +- arch/loongarch/kvm/exit.c | 1 + arch/loongarch/kvm/interrupt.c | 14 ++ arch/loongarch/kvm/main.c | 35 +--- arch/loongarch/kvm/mmu.c | 2 +- arch/loongarch/kvm/switch.S | 22 ++- arch/loongarch/kvm/timer.c | 10 +- arch/loongarch/kvm/vm.c | 2 +- arch/loongarch/pci/acpi.c | 5 + arch/loongarch/pci/pci.c | 3 + arch/powerpc/kexec/Makefile | 2 +- arch/powerpc/platforms/pseries/papr-hvpipe.c | 53 +++--- arch/powerpc/sysdev/xive/common.c | 16 +- arch/riscv/kvm/vcpu_vector.c | 5 +- arch/s390/kernel/debug.c | 8 + arch/x86/events/core.c | 13 +- arch/x86/events/intel/core.c | 32 +++- arch/x86/include/asm/efi.h | 3 +- arch/x86/include/asm/msr-index.h | 3 +- arch/x86/kernel/cpu/amd.c | 3 + arch/x86/kvm/hyperv.c | 2 +- arch/x86/kvm/lapic.c | 8 +- arch/x86/kvm/mmu/mmu.c | 35 ++-- arch/x86/kvm/svm/nested.c | 12 +- arch/x86/kvm/svm/svm.c | 4 + arch/x86/kvm/svm/svm.h | 1 + arch/x86/mm/fault.c | 2 +- arch/x86/platform/efi/quirks.c | 13 +- block/blk.h | 2 + block/ioctl.c | 24 +-- drivers/acpi/cppc_acpi.c | 6 +- drivers/acpi/power.c | 2 +- drivers/acpi/scan.c | 2 +- drivers/acpi/video_detect.c | 16 ++ drivers/android/binder/range_alloc/array.rs | 1 - drivers/bluetooth/btmtk.c | 15 +- drivers/bluetooth/virtio_bt.c | 39 ++++- drivers/char/ipmi/ipmi_si_intf.c | 70 ++++++-- drivers/char/ipmi/ipmi_ssif.c | 23 ++- drivers/clk/clk-rk808.c | 2 +- drivers/clk/imx/clk-imx8-acm.c | 3 +- drivers/clk/microchip/clk-mpfs-ccc.c | 6 +- drivers/cpuidle/cpuidle-powernv.c | 5 +- drivers/cpuidle/cpuidle-pseries.c | 5 +- drivers/crypto/caam/caamalg_qi2.c | 4 +- drivers/crypto/caam/caamhash.c | 4 +- .../crypto/intel/qat/qat_common/adf_accel_engine.c | 7 + .../qat/qat_common/icp_qat_fw_loader_handle.h | 1 + drivers/crypto/intel/qat/qat_common/qat_hal.c | 27 ++-- drivers/extcon/extcon-ptn5150.c | 14 ++ drivers/firmware/samsung/exynos-acpm-pmic.c | 10 +- drivers/firmware/samsung/exynos-acpm-pmic.h | 10 +- drivers/firmware/samsung/exynos-acpm.c | 16 +- drivers/firmware/samsung/exynos-acpm.h | 2 +- drivers/gpio/gpiolib-of.c | 9 +- drivers/hv/Kconfig | 2 +- drivers/hwmon/corsair-psu.c | 4 +- drivers/hwmon/ltc2992.c | 41 +++-- drivers/hwmon/powerz.c | 5 +- drivers/infiniband/hw/hns/hns_roce_qp.c | 7 + drivers/infiniband/hw/ionic/ionic_ibdev.c | 2 +- drivers/infiniband/hw/mana/cq.c | 5 +- drivers/infiniband/hw/mana/qp.c | 16 +- drivers/infiniband/hw/mlx4/srq.c | 4 +- drivers/infiniband/hw/mlx5/main.c | 1 + drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 4 +- drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c | 2 +- drivers/infiniband/sw/rxe/rxe_recv.c | 11 ++ drivers/infiniband/sw/rxe/rxe_resp.c | 14 +- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 7 + drivers/iommu/intel/nested.c | 6 +- drivers/iommu/iommufd/eventq.c | 5 +- drivers/iommu/iommufd/io_pagetable.c | 10 ++ drivers/md/dm-ioctl.c | 6 +- drivers/md/dm-verity-fec.c | 8 +- drivers/md/persistent-data/dm-btree-remove.c | 8 + drivers/md/raid10.c | 2 + drivers/mfd/sec-acpm.c | 10 +- drivers/mmc/core/card.h | 11 ++ drivers/mmc/core/mmc.c | 12 ++ drivers/mmc/core/queue.c | 9 +- drivers/mmc/core/quirks.h | 12 ++ drivers/mtd/spi-nor/debugfs.c | 4 +- drivers/net/ethernet/ibm/ibmveth.c | 22 +++ drivers/net/ethernet/ibm/ibmveth.h | 1 + drivers/net/ethernet/intel/ice/ice_sf_eth.c | 2 + .../ethernet/marvell/octeon_ep_vf/octep_vf_rx.c | 36 ++++- drivers/net/ethernet/mellanox/mlx4/srq.c | 13 +- drivers/net/ethernet/stmicro/stmmac/chain_mode.c | 2 +- drivers/net/ethernet/stmicro/stmmac/common.h | 2 +- drivers/net/ethernet/stmicro/stmmac/ring_mode.c | 2 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 47 +++--- drivers/net/ethernet/wangxun/libwx/wx_hw.c | 7 +- drivers/net/ethernet/wangxun/libwx/wx_vf_common.c | 4 +- drivers/net/wireless/ath/ath5k/base.c | 3 +- drivers/net/wireless/broadcom/b43/xmit.c | 3 +- drivers/net/wireless/broadcom/b43legacy/xmit.c | 3 +- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 6 +- drivers/net/wireless/mediatek/mt76/mt7921/main.c | 7 +- drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | 3 + drivers/net/wireless/mediatek/mt76/mt7925/mac.c | 6 +- drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 4 +- drivers/net/wireless/rsi/rsi_common.h | 5 +- drivers/net/wwan/t7xx/t7xx_modem_ops.c | 20 ++- drivers/net/wwan/t7xx/t7xx_port_ctrl_msg.c | 18 ++- drivers/net/wwan/t7xx/t7xx_port_proxy.h | 2 +- drivers/nvme/host/apple.c | 6 +- drivers/nvme/target/core.c | 2 +- drivers/nvme/target/tcp.c | 26 +++ drivers/parisc/lasi.c | 12 +- drivers/pci/pci.c | 7 +- drivers/pci/pcie/aer.c | 2 - drivers/pci/pcie/aspm.c | 17 +- drivers/pci/setup-res.c | 2 + drivers/platform/chrome/cros_typec_altmode.c | 1 + drivers/pmdomain/core.c | 10 +- drivers/pmdomain/mediatek/mtk-pm-domains.c | 10 +- drivers/power/supply/max17042_battery.c | 2 +- drivers/scsi/mpt3sas/mpt3sas_scsih.c | 14 +- drivers/spi/spi-microchip-core-qspi.c | 103 +++++++++--- drivers/spi/spi-rockchip.c | 4 +- drivers/spi/spi-s3c64xx.c | 5 - drivers/spi/spi-sun4i.c | 10 +- drivers/spi/spi-sun6i.c | 8 +- drivers/spi/spi-synquacer.c | 8 +- drivers/spi/spi-ti-qspi.c | 14 +- drivers/spi/spi-topcliff-pch.c | 11 +- drivers/spi/spi-zynqmp-gqspi.c | 4 +- drivers/staging/vme_user/vme_fake.c | 2 + drivers/target/target_core_configfs.c | 2 +- drivers/thermal/sprd_thermal.c | 4 +- drivers/thermal/thermal_core.c | 6 +- drivers/usb/class/usblp.c | 3 +- drivers/usb/common/ulpi.c | 5 +- drivers/usb/gadget/udc/omap_udc.c | 4 - drivers/usb/serial/option.c | 4 + drivers/usb/typec/tcpm/tcpm.c | 27 ++-- drivers/video/fbdev/core/fb_defio.c | 178 ++++++++++++++++----- drivers/video/fbdev/udlfb.c | 31 +++- fs/btrfs/inode.c | 2 + fs/btrfs/space-info.c | 2 +- fs/ceph/addr.c | 4 + fs/erofs/decompressor.c | 86 +++++----- fs/f2fs/data.c | 28 +++- fs/f2fs/extent_cache.c | 17 +- fs/f2fs/f2fs.h | 2 + fs/f2fs/inline.c | 22 ++- fs/f2fs/inode.c | 2 +- fs/f2fs/node.c | 95 +++++------ fs/f2fs/sysfs.c | 10 +- fs/hfsplus/bfind.c | 51 ++++++ fs/hfsplus/catalog.c | 4 +- fs/hfsplus/dir.c | 2 +- fs/hfsplus/hfsplus_fs.h | 9 ++ fs/hfsplus/super.c | 6 +- fs/isofs/export.c | 2 +- fs/isofs/rock.c | 9 ++ fs/notify/fsnotify.c | 2 +- fs/notify/mark.c | 18 ++- fs/smb/client/cached_dir.c | 8 + fs/smb/client/cifsacl.c | 37 ++++- fs/smb/client/smb2inode.c | 12 +- fs/smb/client/smb2misc.c | 3 +- fs/smb/client/smb2ops.c | 11 ++ fs/smb/client/smbdirect.c | 21 +-- fs/smb/server/connection.c | 48 ++++-- fs/smb/server/connection.h | 1 + fs/tracefs/event_inode.c | 14 ++ fs/tracefs/inode.c | 6 +- fs/tracefs/internal.h | 3 + fs/udf/misc.c | 8 +- include/linux/dma-mapping.h | 13 ++ include/linux/fb.h | 4 +- .../linux/firmware/samsung/exynos-acpm-protocol.h | 29 ++-- include/linux/fsnotify_backend.h | 1 + include/linux/mmc/card.h | 2 + include/linux/printk.h | 13 ++ include/uapi/linux/io_uring.h | 3 +- include/video/udlfb.h | 1 + io_uring/io_uring.c | 12 +- io_uring/kbuf.c | 12 +- io_uring/kbuf.h | 7 + kernel/bpf/arena.c | 19 ++- kernel/exit.c | 1 + kernel/sched/ext_idle.c | 12 +- kernel/trace/trace_probe.c | 6 + kernel/trace/trace_probe.h | 4 +- kernel/tracepoint.c | 2 + lib/crypto/mpi/mpicoder.c | 2 +- lib/scatterlist.c | 8 +- mm/damon/core.c | 5 + mm/damon/stat.c | 30 ++-- mm/damon/sysfs-schemes.c | 12 +- mm/hugetlb_cma.c | 1 + mm/swapfile.c | 21 ++- net/bluetooth/hci_event.c | 29 +++- net/bluetooth/l2cap_sock.c | 9 ++ net/ceph/auth.c | 2 +- net/ceph/mon_client.c | 2 + net/core/flow_dissector.c | 13 +- net/core/netpoll.c | 23 +-- net/core/rtnetlink.c | 1 + net/ipv4/ah4.c | 14 +- net/ipv6/ah6.c | 14 +- net/ipv6/ip6_gre.c | 5 +- net/ipv6/xfrm6_protocol.c | 4 +- net/key/af_key.c | 52 +++--- net/mac80211/mlme.c | 9 +- net/mac80211/rx.c | 2 +- net/mac80211/util.c | 4 +- net/mptcp/fastopen.c | 4 +- net/mptcp/pm.c | 62 ++++--- net/mptcp/pm_kernel.c | 13 +- net/mptcp/protocol.c | 6 +- net/mptcp/sockopt.c | 16 +- net/mptcp/subflow.c | 4 +- net/openvswitch/vport-netdev.c | 6 +- net/psp/psp_main.c | 42 +++-- net/rds/message.c | 20 ++- net/sched/sch_red.c | 2 +- net/unix/af_unix.c | 3 + net/vmw_vsock/hyperv_transport.c | 33 +++- net/xfrm/xfrm_state.c | 12 +- net/xfrm/xfrm_user.c | 1 + rust/kernel/drm/gem/mod.rs | 13 +- rust/pin-init/src/__internal.rs | 28 ++-- rust/pin-init/src/macros.rs | 91 ++++++----- security/selinux/hooks.c | 38 ++--- security/selinux/include/objsec.h | 4 +- security/selinux/include/security.h | 2 - security/selinux/selinuxfs.c | 169 ++++--------------- security/selinux/ss/services.c | 125 --------------- sound/core/misc.c | 8 +- sound/core/oss/pcm_oss.c | 29 +++- sound/core/seq/seq_clientmgr.c | 2 +- sound/core/seq/seq_clientmgr.h | 5 +- sound/core/seq/seq_ump_client.c | 2 +- sound/firewire/tascam/tascam-hwdep.c | 1 + sound/hda/codecs/realtek/alc269.c | 19 +++ sound/hda/codecs/side-codecs/cs35l56_hda.c | 19 ++- sound/soc/amd/yc/acp6x-mach.c | 14 ++ sound/soc/codecs/es8389.c | 2 +- sound/soc/fsl/fsl_easrc.c | 2 +- sound/soc/intel/boards/bytcr_wm5102.c | 1 + sound/soc/qcom/qdsp6/q6apm-dai.c | 1 + sound/soc/qcom/qdsp6/q6apm-lpass-dais.c | 2 +- sound/soc/qcom/qdsp6/q6apm.c | 3 + sound/soc/sof/compress.c | 3 + sound/usb/midi2.c | 9 +- sound/usb/misc/ua101.c | 7 + sound/usb/stream.c | 4 +- tools/arch/x86/include/asm/msr-index.h | 3 +- tools/testing/selftests/net/mptcp/mptcp_lib.sh | 16 +- tools/testing/selftests/net/mptcp/pm_netlink.sh | 20 ++- 269 files changed, 2440 insertions(+), 1165 deletions(-)

4 weeks, 1 day

[PATCH 7.0 000/307] 7.0.7-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 7.0.7 release. There are 307 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 14 May 2026 17:38:03 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.0.7-rc1.… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.0.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 7.0.7-rc1 Prathyushi Nangia <prathyushi.nangia(a)amd.com> x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache Gary Guo <gary(a)garyguo.net> rust: pin-init: fix incorrect accessor reference lifetime Sam Edwards <cfsworks(a)gmail.com> net: stmmac: Prevent NULL deref when RX memory exhausted Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY() Thorsten Blum <thorsten.blum(a)linux.dev> crypto: caam - guard HMAC key hex dumps in hash_digest_key Thorsten Blum <thorsten.blum(a)linux.dev> printk: add print_hex_dump_devel() Longxuan Yu <ylong030(a)ucr.edu> 8021q: delete cleared egress QoS mappings Longxuan Yu <ylong030(a)ucr.edu> 8021q: use RCU for egress QoS mappings Zilin Guan <zilin(a)seu.edu.cn> hfsplus: fix held lock freed on hfsplus_fill_super() Deepanshu Kartikey <kartikey406(a)gmail.com> hfsplus: fix uninit-value by validating catalog record size Suman Kumar Chakraborty <suman.kumar.chakraborty(a)intel.com> crypto: qat - fix firmware loading failure for GEN6 devices Suman Kumar Chakraborty <suman.kumar.chakraborty(a)intel.com> crypto: qat - fix indentation of macros in qat_hal.c Luke Wang <ziniu.wang_1(a)nxp.com> mmc: core: Optimize time for secure erase/trim for some Kingston eMMCs Avri Altman <avri.altman(a)sandisk.com> mmc: core: Add quirk for incorrect manufacturing date Avri Altman <avri.altman(a)sandisk.com> mmc: core: Adjust MDT beyond 2025 David Carlier <devnexen(a)gmail.com> octeon_ep_vf: add NULL check for napi_build_skb() Alexei Starovoitov <ast(a)kernel.org> bpf: Fix use-after-free in arena_vm_close on fork Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Use per-root-bridge PCIH flag to skip mem resource fixup Tao Cui <cuitao(a)kylinos.cn> LoongArch: KVM: Use kvm_set_pte() in kvm_flush_pte() Bibo Mao <maobibo(a)loongson.cn> LoongArch: KVM: Move unconditional delay into timer clear scenery Bibo Mao <maobibo(a)loongson.cn> LoongArch: KVM: Fix HW timer interrupt lost when inject interrupt by software Xianglai Li <lixianglai(a)loongson.cn> LoongArch: KVM: Fix "unreliable stack" for kvm_exc_entry Qiang Ma <maqianga(a)uniontech.com> LoongArch: KVM: Cap KVM_CAP_NR_VCPUS by KVM_CAP_MAX_VCPUS Wentao Guan <guanwentao(a)uniontech.com> LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang() Fuad Tabba <tabba(a)google.com> KVM: arm64: Fix pin leak and publication ordering in __pkvm_init_vcpu() Fuad Tabba <tabba(a)google.com> KVM: arm64: Fix FEAT_Debugv8p9 to check DebugVer, not PMUVer Fuad Tabba <tabba(a)google.com> KVM: arm64: Fix FEAT_SPE_FnE to use PMSIDR_EL1.FnE, not PMSVer Quentin Perret <qperret(a)google.com> KVM: arm64: Fix initialisation order in __pkvm_init_finalise() David Woodhouse <dwmw(a)amazon.co.uk> KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value Marc Zyngier <maz(a)kernel.org> KVM: arm64: Wake-up from WFI when iqrchip is in userspace Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix fsck inconsistency caused by FGGC of node block Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix inline data not being written to disk in writeback path Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: refactor f2fs_move_node_folio function Guangshuo Li <lgs201920130244(a)gmail.com> f2fs: fix uninitialized kobject put in f2fs_init_sysfs() Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix node_cnt race between extent node destroy and writeback Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix incorrect multidevice info in trace_f2fs_map_blocks() Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix incorrect file address mapping when inline inode is unwritten Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix fsck inconsistency caused by incorrect nat_entry flag usage Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix fiemap boundary handling when read extent cache is incomplete Chao Yu <chao(a)kernel.org> f2fs: fix false alarm of lockdep on cp_global_sem lock Cen Zhang <zzzccc427(a)gmail.com> f2fs: add READ_ONCE() for i_blocks in f2fs_update_inode() Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: return early if no retrans Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: free sk if last Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: always decrease sk refcount Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: fix potential data-race Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: allow ID 0 Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: kernel: correctly retransmit ADD_ADDR ID 0 Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: kernel: reset fullmesh counter after flush Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: prio: skip closed subflows Gang Yan <yangang(a)kylinos.cn> mptcp: fix scheduling with atomic in timestamp sockopt Paolo Abeni <pabeni(a)redhat.com> mptcp: fix rx timestamp corruption on fastopen Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: sockopt: increase seq in mptcp_setsockopt_all_sf Gang Yan <yangang(a)kylinos.cn> mptcp: sockopt: set timestamp flags on subflow socket, not msk Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: fastclose msk when linger time is 0 Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: mptcp: pm: restrict 'unknown' check to pm_nl_ctl Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: mptcp: check output: catch cmd errors Tejun Heo <tj(a)kernel.org> sched_ext: Use dsq->first_task instead of list_empty() in dispatch_enqueue() FIFO-tail Tejun Heo <tj(a)kernel.org> sched_ext: Skip tasks with stale task_rq in bypass_lb_cpu() David Carlier <devnexen(a)gmail.com> sched_ext: idle: Recheck prev_cpu after narrowing allowed mask Chen Ni <nichen(a)iscas.ac.cn> remoteproc: k3: Fix NULL vs IS_ERR() bug in k3_reserved_mem_init() Chen Ni <nichen(a)iscas.ac.cn> remoteproc: imx_rproc: Fix NULL vs IS_ERR() bug in imx_rproc_addr_init() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/rxe: Reject unknown opcodes before ICRC processing Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() Junrui Luo <moonafterrain(a)outlook.com> RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Validate rx_hash_key_len Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/ionic: Fix typo in format string Kai Zen <kai.aizen.dev(a)gmail.com> RDMA/ionic: bound node_desc sysfs read with %.64s Dapeng Mi <dapeng1.mi(a)linux.intel.com> perf/x86/intel: Enable auto counter reload for DMR Dapeng Mi <dapeng1.mi(a)linux.intel.com> perf/x86/intel: Disable PMI for self-reloaded ACR events Dapeng Mi <dapeng1.mi(a)linux.intel.com> perf/x86/intel: Always reprogram ACR events to prevent stale masks Nilay Shroff <nilay(a)linux.ibm.com> powerpc/xive: fix kmemleak caused by incorrect chip_data lookup André Draszik <andre.draszik(a)linaro.org> power: supply: max17042: avoid overflow when determining health Lukas Wunner <lukas(a)wunner.de> PCI/ASPM: Fix pci_clear_and_set_config_dword() usage Lukas Wunner <lukas(a)wunner.de> PCI/AER: Stop ruling out unbound devices as error source Shuai Xue <xueshuai(a)linux.alibaba.com> PCI/AER: Clear only error bits in PCIe Device Status Lukas Wunner <lukas(a)wunner.de> PCI: Update saved_config_space upon resource assignment SeongJae Park <sj(a)kernel.org> mm/damon/sysfs-schemes: protect path kfree() with damon_sysfs_lock SeongJae Park <sj(a)kernel.org> mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock SeongJae Park <sj(a)kernel.org> mm/damon/stat: detect and use fresh enabled value SeongJae Park <sj(a)kernel.org> mm/damon/reclaim: detect and use fresh enabled and kdamond_pid values SeongJae Park <sj(a)kernel.org> mm/damon/lru_sort: detect and use fresh enabled and kdamond_pid values Paolo Bonzini <pbonzini(a)redhat.com> KVM: x86: Do IRR scan in __kvm_apic_update_irr even if PIR is empty Paolo Bonzini <pbonzini(a)redhat.com> KVM: x86: check for nEPT/nNPT in slow flush hypercalls Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: validate dacloffset before building DACL pointers Bjoern Doebel <doebel(a)amazon.de> smb: client: use kzalloc to zero-initialize security descriptor buffer Zisen Ye <zisenye(a)stu.xidian.edu.cn> smb/client: fix out-of-bounds read in symlink_data() Zisen Ye <zisenye(a)stu.xidian.edu.cn> smb/client: fix out-of-bounds read in smb2_compound_op() Ranjan Kumar <ranjan.kumar(a)broadcom.com> scsi: mpt3sas: Limit NVMe request size to 2 MiB Pengpeng Hou <pengpeng(a)iscas.ac.cn> s390/debug: Reject zero-length input before trimming a newline Vasily Gorbik <gor(a)linux.ibm.com> s390/debug: Reject zero-length input in debug_input_flush_fn() Osama Abdelkader <osama.abdelkader(a)gmail.com> riscv: kvm: fix vector context allocation leak Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/hns: Fix unlocked call to hns_roce_qp_remove() David Carlier <devnexen(a)gmail.com> psp: strip variable-length PSP header in psp_dev_rcv() Ulf Hansson <ulfh(a)kernel.org> pmdomain: core: Fix detach procedure for virtual devices in genpd Ilya Maximets <i.maximets(a)ovn.org> openvswitch: vport: fix self-deadlock on release of tunnel ports Chaitanya Kulkarni <kch(a)nvidia.com> nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free Chaitanya Kulkarni <kch(a)nvidia.com> nvmet-tcp: fix race between ICReq handling and queue teardown Fedor Pchelkin <pchelkin(a)ispras.ru> nvme-apple: drop invalid put of admin queue reference count Junrui Luo <moonafterrain(a)outlook.com> md/raid10: fix divide-by-zero in setup_geo() with zero far_copies Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Fix slab-out-of-bounds access in auth message processing Christian A. Ehrhardt <lk(a)c--e.de> lib/scatterlist: fix temp buffer in extract_user_to_sg() Christian A. Ehrhardt <lk(a)c--e.de> lib/scatterlist: fix length calculations in extract_kvec_to_sg Eric Biggers <ebiggers(a)kernel.org> lib/crc: tests: Make crc_kunit test only the enabled CRC variants Lukas Wunner <lukas(a)wunner.de> lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() Nicolin Chen <nicolinc(a)nvidia.com> iommu/arm-smmu-v3: Add a missing dma_wmb() for hitless STE update Zhenzhong Duan <zhenzhong.duan(a)intel.com> iommu/vt-d: Block PASID attachment to nested domain with dirty tracking Zhenzhong Duan <zhenzhong.duan(a)intel.com> iommufd: Fix return value of iommufd_fault_fops_write() Michael Bommarito <michael.bommarito(a)gmail.com> isofs: validate block number from NFS file handle in isofs_export_iget Michael Bommarito <michael.bommarito(a)gmail.com> isofs: validate Rock Ridge CE continuation extent against volume size Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: fix the size of dm_verity_fec_io::erasures Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: fix reading parity bytes split across blocks (take 3) Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: fix corrected block count stat Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: correctly reject too-small hash devices Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: correctly reject too-small FEC devices David Carlier <devnexen(a)gmail.com> eventfs: Hold eventfs_mutex and SRCU when remount walks events Mikulas Patocka <mpatocka(a)redhat.com> dm: fix a buffer overflow in ioctl processing Mikulas Patocka <mpatocka(a)redhat.com> dm: don't report warning when doing deferred remove Mikulas Patocka <mpatocka(a)redhat.com> dm-thin: fix metadata refcount underflow Filipe Manana <fdmanana(a)suse.com> btrfs: fix missing last_unlink_trans update when removing a directory Guangshuo Li <lgs201920130244(a)gmail.com> btrfs: fix double free in create_space_info_sub_group() error path Guangshuo Li <lgs201920130244(a)gmail.com> btrfs: fix double free in create_space_info() error path Yochai Eisenrich <yochaie(a)sweet.security> btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak Qu Wenruo <wqu(a)suse.com> btrfs: do not mark inode incompressible after inline attempt fails Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm: remove child devices when apm is removed Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error Joseph Salisbury <joseph.salisbury(a)oracle.com> ASoC: fsl_easrc: fix comment typo Li Jian <lazycat-xiao(a)foxmail.com> ASoC: ES8389: convert to devm_clk_get_optional() to get clock Tommaso Soncin <soncintommaso(a)gmail.com> ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table Shrikanth Hegde <sshegde(a)linux.ibm.com> cpuidle: powerpc: avoid double clear when breaking snooze Conor Dooley <conor.dooley(a)microchip.com> clk: microchip: mpfs-ccc: fix out of bounds access during output registration Stefan Eichenberger <stefan.eichenberger(a)toradex.com> clk: imx: imx8-acm: fix flags for acm clocks Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/fprobe: Check the same type fprobe on table as the unregistered one Steven Rostedt <rostedt(a)goodmis.org> tracing/probes: Limit size of event probe to 3K Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/fprobe: Unregister fprobe even if memory allocation fails Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/fprobe: Remove fprobe from hash in failure path Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/fprobe: Avoid kcalloc() in rcu_read_lock section Johan Hovold <johan(a)kernel.org> spi: topcliff-pch: fix use-after-free on unbind Johan Hovold <johan(a)kernel.org> spi: topcliff-pch: fix controller deregistration Thorsten Blum <thorsten.blum(a)linux.dev> thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp Thorsten Blum <thorsten.blum(a)linux.dev> thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> thermal: core: Free thermal zone ID later during removal David Gow <david(a)davidgow.net> x86/boot/e820: Re-enable BIOS fallback if e820 table is empty Michael Bommarito <michael.bommarito(a)gmail.com> udf: reject descriptors with oversized CRC length David Carlier <devnexen(a)gmail.com> tracefs: Fix default permissions not being applied on initial mount Conor Dooley <conor.dooley(a)microchip.com> spi: microchip-core-qspi: control built-in cs manually Conor Dooley <conor.dooley(a)microchip.com> spi: microchip-core-qspi: don't attempt to transmit during emulated read-only dual/quad operations Johan Hovold <johan(a)kernel.org> spi: microchip-core-spi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: microchip-core-qspi: fix controller deregistration Guangshuo Li <lgs201920130244(a)gmail.com> ice: fix double free in ice_sf_eth_activate() error path Mingming Cao <mmc(a)linux.ibm.com> ibmveth: Disable GSO for packets with small MSS Dexuan Cui <decui(a)microsoft.com> hv_sock: Return -EIO for malformed/short packets Dexuan Cui <decui(a)microsoft.com> hv_sock: Report EOF instead of -EIO for FIN Hamza Mahfooz <hamzamahfooz(a)linux.microsoft.com> hv_sock: fix ARM64 support Thomas Zimmermann <tzimmermann(a)suse.de> hv: Select CONFIG_SYSFB only for CONFIG_HYPERV_VMBUS Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> gpio: of: clear OF_POPULATED on hog nodes in remove path Thomas Zimmermann <tzimmermann(a)suse.de> fbcon: Avoid OOB font access if console rotation fails Xu Yang <xu.yang_2(a)nxp.com> extcon: ptn5150: handle pending IRQ events during system resume Shyam Prasad N <sprasad(a)microsoft.com> cifs: change_conf needs to be called for session setup Shyam Prasad N <sprasad(a)microsoft.com> cifs: abort open_cached_dir if we don't request leases Jens Axboe <axboe(a)kernel.dk> block: only read from sqe on initial invocation of blkdev_uring_cmd() Damien Le Moal <dlemoal(a)kernel.org> block: fix zone write plug removal Naman Jain <namjain(a)linux.microsoft.com> block: add pgmap check to biovec_phys_mergeable Wentao Liang <vulab(a)iscas.ac.cn> pmdomain: mediatek: fix use-after-free in scpsys_get_bus_protection_legacy() Breno Leitao <leitao(a)debian.org> arm64/fpsimd: ptrace: zero target's fpsimd_state, not the tracer's Jiexun Wang <wangjiexun2025(a)gmail.com> af_unix: Reject SIOCATMARK on non-stream sockets Myeonghun Pak <mhun512(a)gmail.com> hwmon: (corsair-psu) Close HID device on probe errors Johan Hovold <johan(a)kernel.org> clk: rk808: fix OF node reference imbalance Sanman Pradhan <psanman(a)juniper.net> hwmon: (ltc2992) Fix u32 overflow in power read path Sanman Pradhan <psanman(a)juniper.net> hwmon: (ltc2992) Clamp threshold writes to hardware range Ivan Hu <ivan.hu(a)canonical.com> x86/efi: Fix graceful fault handling after FPU softirq changes Hongling Zeng <zenghongling(a)kylinos.cn> parisc: Fix IRQ leak in LASI driver Tzung-Bi Shih <tzungbi(a)kernel.org> platform/chrome: cros_ec_typec: Init mutex in Thunderbolt registration Colin Walters <walters(a)verbum.org> ovl: fix verity lazy-load guard broken by fsverity_active() semantic change Pavitra Jha <jhapavitra98(a)gmail.com> net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler Nan Li <tonanli66(a)gmail.com> net/rds: handle zerocopy send cleanup before the message is queued Breno Leitao <leitao(a)debian.org> netpoll: pass buffer size to egress_dev() to avoid MAC truncation Jiawen Wu <jiawenwu(a)trustnetic.com> net: libwx: use request_irq for VF misc interrupt Maoyi Xie <maoyixie.tju(a)gmail.com> ip6_gre: Use cached t->net in ip6erspan_changelink(). Jiawen Wu <jiawenwu(a)trustnetic.com> net: libwx: fix VF illegal register access Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> pseries/papr-hvpipe: Fix the usage of copy_to_user() Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> pseries/papr-hvpipe: Fix & simplify error handling in papr_hvpipe_init() Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> pseries/papr-hvpipe: Fix null ptr deref in papr_hvpipe_dev_create_handle() Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> pseries/papr-hvpipe: Prevent kernel stack memory leak to userspace Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> pseries/papr-hvpipe: Fix race with interrupt handler SeungJu Cheon <suunj1331(a)gmail.com> sound: ua101: fix division by zero at probe Karol Wachowski <karol.wachowski(a)linux.intel.com> accel/ivpu: Disallow re-exporting imported GEM objects Thomas Gleixner <tglx(a)kernel.org> selftests/rseq: Expand for optimized RSEQ ABI v2 Thomas Gleixner <tglx(a)kernel.org> selftests/rseq: Validate legacy behavior Thomas Gleixner <tglx(a)kernel.org> selftests/rseq: Skip tests if time slice extensions are not available Thomas Gleixner <tglx(a)kernel.org> selftests/rseq: Make registration flexible for legacy and optimized mode Thomas Gleixner <tglx(a)kernel.org> rseq: Don't advertise time slice extensions if disabled Thomas Gleixner <tglx(a)kernel.org> rseq: Protect rseq_reset() against interrupts Thomas Gleixner <tglx(a)kernel.org> rseq: Set rseq::cpu_id_start to 0 on unregistration Mark Brown <broonie(a)kernel.org> selftests/rseq: Don't run tests with runner scripts outside of the scripts Dapeng Mi <dapeng1.mi(a)linux.intel.com> perf/x86/intel: Improve validation and configuration of ACR masks Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: skip inactive subflows Kai Zen <kai.aizen.dev(a)gmail.com> net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo Xianglai Li <lixianglai(a)loongson.cn> LoongArch: KVM: Compile switch.S directly into the kernel Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Fix SYM_SIGFUNC_START definition for 32BIT Sang-Heon Jeon <ekffu200098(a)gmail.com> mm/hugetlb_cma: round up per_node before logging it Kevin Brodsky <kevin.brodsky(a)arm.com> arm64: signal: Preserve POR_EL0 if poe_context is missing Tudor Ambarus <tudor.ambarus(a)linaro.org> mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show() Fuad Tabba <tabba(a)google.com> KVM: arm64: Fix kvm_vcpu_initialized() macro parameter Miklos Szeredi <mszeredi(a)redhat.com> fanotify: fix false positive on permission events Johan Hovold <johan(a)kernel.org> staging: vme_user: fix root device leak on init failure Shyam Sunder Reddy Padira <shyamsunderreddypadira(a)gmail.com> staging: rtl8723bs: os_dep: avoid NULL pointer dereference in rtw_cbuf_alloc Johan Hovold <johan(a)kernel.org> spi: s3c64xx: fix NULL-deref on driver unbind Johan Hovold <johan(a)kernel.org> spi: tegra20-sflash: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: zynqmp-gqspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: tegra114: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sun6i: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: ti-qspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: zynq-qspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sun4i: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: syncuacer: fix controller deregistration Gary Guo <gary(a)garyguo.net> rust: pin-init: internal: move alignment check to `make_field_check` Miguel Ojeda <ojeda(a)kernel.org> rust: allow `clippy::collapsible_if` globally Miguel Ojeda <ojeda(a)kernel.org> rust: allow `clippy::collapsible_match` globally Eliot Courtney <ecourtney(a)nvidia.com> rust: drm: gem: clean up GEM state in init failure case Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt David Carlier <devnexen(a)gmail.com> Bluetooth: hci_conn: fix potential UAF in create_big_sync Tristan Madani <tristan(a)talencesecurity.com> Bluetooth: btmtk: validate WMT event SKB length before struct access Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: virtio_bt: validate rx pkt_type header length Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: virtio_bt: clamp rx length before skb_put Tao Cui <cuitao(a)kylinos.cn> LoongArch: KVM: Fix missing EMULATE_FAIL in kvm_emu_mmio_read() Jens Axboe <axboe(a)kernel.dk> io_uring/tw: serialize ctx->retry_llist with ->uring_lock Martin Michaelis <code(a)mgjm.de> io_uring/kbuf: support min length left for incremental buffers Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: allow multiple opens of /sys/fs/selinux/policy Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: prune /sys/fs/selinux/user Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: prune /sys/fs/selinux/disable Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: prune /sys/fs/selinux/checkreqprot Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: shrink critical section in sel_write_load() David Windsor <dwindsor(a)gmail.com> selinux: don't reserve xattr slot when we won't fill it Zongyao Chen <ZongYao.Chen(a)linux.alibaba.com> selinux: use sk blob accessor in socket permission helpers Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: fix avdcache auditing Michael Bommarito <michael.bommarito(a)gmail.com> xfrm: ah: account for ESN high bits in async callbacks Yilin Zhu <zylzyl2333(a)gmail.com> ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() Michal Kosiorek <mkosiorek121(a)gmail.com> xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete Ruijie Li <ruijieli51(a)gmail.com> xfrm: provide message size for XFRM_MSG_MAPPING Tejun Heo <tj(a)kernel.org> sched_ext: Read scx_root under scx_cgroup_ops_rwsem in cgroup setters Ard Biesheuvel <ardb(a)kernel.org> x86/efi: Restore IRQ state in EFI page fault handler Sourabh Jain <sourabhjain(a)linux.ibm.com> powerpc/kdump: fix KASAN sanitization flag for core_$(BITS).o Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: seq: Fix UMP group 16 filtering Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: core: Serialize deferred fasync state checks Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: firewire-tascam: Do not drop unread control events Yuriy Padlyak <yuriypadlyak(a)gmail.com> ALSA: hda/realtek: Fix speaker silence after S3 resume on Xiaomi Mi Laptop Pro 15 Takashi Iwai <tiwai(a)suse.de> ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: hda: cs35l56: Propagate ASP TX source control errors Xu Yang <xu.yang_2(a)nxp.com> usb: typec: tcpm: fix debug accessory mode detection for sink ports Felix Gu <ustc.gu(a)gmail.com> usb: ulpi: fix memory leak on ulpi_register() error paths Fabio Porcedda <fabio.porcedda(a)gmail.com> USB: serial: option: add Telit Cinterion LE910Cx compositions Aaro Koskinen <aaro.koskinen(a)iki.fi> USB: omap_udc: DMA: Don't enable burst 4 mode Amit Sunil Dhamne <amitsd(a)google.com> usb: typec: tcpm: reset internal port states on soft reset AMS Selvarasu Ganesan <selvarasu.g(a)samsung.com> usb: dwc3: Move GUID programming after PHY initialization Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Fix UAC3 cluster descriptor size check Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: midi2: Restart output URBs on resume Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: usblp: fix heap leak in IEEE 1284 device ID via short response Marek Szyprowski <m.szyprowski(a)samsung.com> wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task Tristan Madani <tristan(a)talencesecurity.com> wifi: b43: enforce bounds check on firmware key index in b43_rx() Johannes Berg <johannes.berg(a)intel.com> wifi: mac80211: remove station if connection prep fails Jiri Slaby (SUSE) <jirislaby(a)kernel.org> wifi: ath5k: do not access array OOB Benjamin Berg <benjamin.berg(a)intel.com> wifi: mac80211: use safe list iteration in radar detect work Jeongjun Park <aha310510(a)gmail.com> wifi: rsi: fix kthread lifetime race between self-exit and external-stop Catherine <enderaoelyther(a)gmail.com> wifi: mac80211: drop stray 'static' from fast-RX rx_result Tristan Madani <tristan(a)talencesecurity.com> wifi: b43legacy: enforce bounds check on firmware key index in RX path Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work Leon Yen <leon.yen(a)mediatek.com> wifi: mt76: mt7921: fix a potential clc buffer length underflow Ming Yen Hsieh <mingyen.hsieh(a)mediatek.com> wifi: mt76: mt7925: fix incorrect length field in txpower command Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7925: fix AMPDU state handling in mt7925_tx_check_aggr Jann Horn <jannh(a)google.com> exit: prevent preemption of oopsing TASK_DEAD task Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked Yi Kuo <yi(a)yikuo.dev> smb: client/smbdirect: fix MR registration for coalesced SG lists Qingfang Deng <qingfang.deng(a)linux.dev> flow_dissector: do not dissect PPPoE PFC frames Sean Christopherson <seanjc(a)google.com> KVM: x86: Fix shadow paging use-after-free due to unexpected GFN DaeMyung Kang <charsyam(a)gmail.com> ksmbd: rewrite stop_sessions() with restartable iteration Johan Hovold <johan(a)kernel.org> spi: rockchip: fix controller deregistration Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7925: fix incorrect TLV length in CLC command Mark Brown <broonie(a)kernel.org> ASoC: SOF: Don't allow pointer operations on unconfigured streams Sina Hassani <sina(a)openai.com> iommufd: Fix a race with concurrent allocation and unmap David Carlier <devnexen(a)gmail.com> tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() Shivam Kalra <shivamkalra98(a)zohomail.in> ACPI: video: force native backlight on HP OMEN 16 (8A44) Jinjie Ruan <ruanjinjie(a)huawei.com> ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug Jan Schär <jan(a)jschaer.ch> ACPI: video: Add backlight=native quirk for Dell OptiPlex 7770 AIO Guangshuo Li <lgs201920130244(a)gmail.com> ACPI: scan: Use acpi_dev_put() in object add error paths Breno Leitao <leitao(a)debian.org> ACPI: arm64: cpuidle: Tolerate platforms with no deep PSCI idle states Rajat Gupta <rajgupt(a)qti.qualcomm.com> fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free Corey Minyard <corey(a)minyard.net> ipmi:si: Return state to normal if message allocation fails Corey Minyard <corey(a)minyard.net> ipmi: Check event message buffer response for bad data Corey Minyard <corey(a)minyard.net> ipmi: Add limits to event and receive message requests Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() ------------- Diffstat: .../ABI/{obsolete => removed}/sysfs-selinux-user | 0 Makefile | 6 +- arch/arm64/include/asm/kvm_host.h | 2 +- arch/arm64/kernel/ptrace.c | 4 +- arch/arm64/kernel/signal.c | 54 +++- arch/arm64/kvm/arm.c | 4 + arch/arm64/kvm/config.c | 17 +- arch/arm64/kvm/hyp/nvhe/pkvm.c | 38 ++- arch/arm64/kvm/hyp/nvhe/setup.c | 8 +- arch/arm64/kvm/vgic/vgic-mmio-v2.c | 2 +- arch/arm64/kvm/vgic/vgic-mmio-v3.c | 2 +- arch/loongarch/Kbuild | 2 +- arch/loongarch/include/asm/asm-prototypes.h | 20 ++ arch/loongarch/include/asm/kvm_host.h | 3 - arch/loongarch/include/asm/linkage.h | 2 +- arch/loongarch/kvm/Makefile | 3 +- arch/loongarch/kvm/exit.c | 1 + arch/loongarch/kvm/interrupt.c | 14 ++ arch/loongarch/kvm/main.c | 35 +-- arch/loongarch/kvm/mmu.c | 2 +- arch/loongarch/kvm/switch.S | 22 +- arch/loongarch/kvm/timer.c | 10 +- arch/loongarch/kvm/vm.c | 2 +- arch/loongarch/pci/acpi.c | 5 + arch/loongarch/pci/pci.c | 3 + arch/powerpc/kexec/Makefile | 2 +- arch/powerpc/platforms/pseries/papr-hvpipe.c | 122 +++++---- arch/powerpc/sysdev/xive/common.c | 16 +- arch/riscv/kvm/vcpu_vector.c | 5 +- arch/s390/kernel/debug.c | 8 + arch/x86/events/core.c | 13 +- arch/x86/events/intel/core.c | 50 +++- arch/x86/events/perf_event.h | 10 + arch/x86/include/asm/efi.h | 3 +- arch/x86/include/asm/msr-index.h | 3 +- arch/x86/kernel/cpu/amd.c | 3 + arch/x86/kernel/e820.c | 6 +- arch/x86/kvm/hyperv.c | 2 +- arch/x86/kvm/lapic.c | 8 +- arch/x86/kvm/mmu/mmu.c | 35 ++- arch/x86/mm/fault.c | 2 +- arch/x86/platform/efi/quirks.c | 13 +- block/blk-zoned.c | 151 +++++------ block/blk.h | 2 + block/ioctl.c | 24 +- drivers/accel/ivpu/ivpu_drv.c | 21 ++ drivers/acpi/arm64/cpuidle.c | 10 +- drivers/acpi/cppc_acpi.c | 6 +- drivers/acpi/power.c | 2 +- drivers/acpi/scan.c | 2 +- drivers/acpi/video_detect.c | 16 ++ drivers/android/binder/range_alloc/array.rs | 1 - drivers/bluetooth/btmtk.c | 15 +- drivers/bluetooth/virtio_bt.c | 39 ++- drivers/char/ipmi/ipmi_si_intf.c | 70 ++++-- drivers/char/ipmi/ipmi_ssif.c | 23 +- drivers/clk/clk-rk808.c | 2 +- drivers/clk/imx/clk-imx8-acm.c | 3 +- drivers/clk/microchip/clk-mpfs-ccc.c | 6 +- drivers/cpuidle/cpuidle-powernv.c | 5 +- drivers/cpuidle/cpuidle-pseries.c | 5 +- drivers/crypto/caam/caamalg_qi2.c | 4 +- drivers/crypto/caam/caamhash.c | 4 +- .../crypto/intel/qat/qat_common/adf_accel_engine.c | 7 + .../qat/qat_common/icp_qat_fw_loader_handle.h | 1 + drivers/crypto/intel/qat/qat_common/qat_hal.c | 27 +- drivers/extcon/extcon-ptn5150.c | 14 ++ drivers/gpio/gpiolib-of.c | 9 +- drivers/hv/Kconfig | 2 +- drivers/hwmon/corsair-psu.c | 4 +- drivers/hwmon/ltc2992.c | 41 ++- drivers/infiniband/hw/hns/hns_roce_qp.c | 7 + drivers/infiniband/hw/ionic/ionic_ibdev.c | 2 +- drivers/infiniband/hw/mana/cq.c | 5 +- drivers/infiniband/hw/mana/qp.c | 16 +- drivers/infiniband/hw/mlx4/srq.c | 4 +- drivers/infiniband/hw/mlx5/main.c | 1 + drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 4 +- drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c | 2 +- drivers/infiniband/sw/rxe/rxe_recv.c | 11 + drivers/infiniband/sw/rxe/rxe_resp.c | 14 +- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 7 + drivers/iommu/intel/nested.c | 6 +- drivers/iommu/iommufd/eventq.c | 5 +- drivers/iommu/iommufd/io_pagetable.c | 10 + drivers/md/dm-ioctl.c | 6 +- drivers/md/dm-verity-fec.c | 113 ++++----- drivers/md/dm-verity-fec.h | 3 +- drivers/md/persistent-data/dm-btree-remove.c | 8 + drivers/md/raid10.c | 2 + drivers/mmc/core/card.h | 11 + drivers/mmc/core/mmc.c | 12 + drivers/mmc/core/queue.c | 9 +- drivers/mmc/core/quirks.h | 12 + drivers/mtd/spi-nor/debugfs.c | 4 +- drivers/net/ethernet/ibm/ibmveth.c | 22 ++ drivers/net/ethernet/ibm/ibmveth.h | 1 + drivers/net/ethernet/intel/ice/ice_sf_eth.c | 2 + .../ethernet/marvell/octeon_ep_vf/octep_vf_rx.c | 36 ++- drivers/net/ethernet/mellanox/mlx4/srq.c | 13 +- drivers/net/ethernet/stmicro/stmmac/chain_mode.c | 2 +- drivers/net/ethernet/stmicro/stmmac/common.h | 2 +- drivers/net/ethernet/stmicro/stmmac/ring_mode.c | 2 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 41 +-- drivers/net/ethernet/wangxun/libwx/wx_hw.c | 7 +- drivers/net/ethernet/wangxun/libwx/wx_vf_common.c | 4 +- drivers/net/wireless/ath/ath5k/base.c | 3 +- drivers/net/wireless/broadcom/b43/xmit.c | 3 +- drivers/net/wireless/broadcom/b43legacy/xmit.c | 3 +- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 6 +- drivers/net/wireless/mediatek/mt76/mt7921/main.c | 7 +- drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | 3 + drivers/net/wireless/mediatek/mt76/mt7925/mac.c | 6 +- drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 4 +- drivers/net/wireless/rsi/rsi_common.h | 5 +- drivers/net/wwan/t7xx/t7xx_modem_ops.c | 20 +- drivers/net/wwan/t7xx/t7xx_port_ctrl_msg.c | 18 +- drivers/net/wwan/t7xx/t7xx_port_proxy.h | 2 +- drivers/nvme/host/apple.c | 6 +- drivers/nvme/target/core.c | 2 +- drivers/nvme/target/tcp.c | 26 ++ drivers/parisc/lasi.c | 12 +- drivers/pci/pci.c | 7 +- drivers/pci/pcie/aer.c | 2 - drivers/pci/pcie/aspm.c | 17 +- drivers/pci/setup-res.c | 2 + drivers/platform/chrome/cros_typec_altmode.c | 1 + drivers/pmdomain/core.c | 10 +- drivers/pmdomain/mediatek/mtk-pm-domains.c | 10 +- drivers/power/supply/max17042_battery.c | 2 +- drivers/remoteproc/imx_rproc.c | 2 +- drivers/remoteproc/ti_k3_common.c | 2 +- drivers/scsi/mpt3sas/mpt3sas_scsih.c | 14 +- drivers/spi/spi-microchip-core-qspi.c | 103 ++++++-- drivers/spi/spi-microchip-core-spi.c | 4 +- drivers/spi/spi-rockchip.c | 4 +- drivers/spi/spi-s3c64xx.c | 5 - drivers/spi/spi-sun4i.c | 10 +- drivers/spi/spi-sun6i.c | 8 +- drivers/spi/spi-synquacer.c | 8 +- drivers/spi/spi-tegra114.c | 8 +- drivers/spi/spi-tegra20-sflash.c | 8 +- drivers/spi/spi-ti-qspi.c | 14 +- drivers/spi/spi-topcliff-pch.c | 11 +- drivers/spi/spi-zynq-qspi.c | 15 +- drivers/spi/spi-zynqmp-gqspi.c | 4 +- drivers/staging/rtl8723bs/os_dep/osdep_service.c | 3 +- drivers/staging/vme_user/vme_fake.c | 2 + drivers/target/target_core_configfs.c | 2 +- drivers/thermal/sprd_thermal.c | 4 +- drivers/thermal/thermal_core.c | 6 +- drivers/usb/class/usblp.c | 3 +- drivers/usb/common/ulpi.c | 5 +- drivers/usb/dwc3/core.c | 12 +- drivers/usb/gadget/udc/omap_udc.c | 4 - drivers/usb/serial/option.c | 4 + drivers/usb/typec/tcpm/tcpm.c | 27 +- drivers/video/fbdev/core/fbcon_rotate.c | 5 +- drivers/video/fbdev/udlfb.c | 31 ++- fs/btrfs/inode.c | 8 + fs/btrfs/ioctl.c | 5 +- fs/btrfs/space-info.c | 6 +- fs/f2fs/data.c | 28 ++- fs/f2fs/extent_cache.c | 17 +- fs/f2fs/f2fs.h | 5 + fs/f2fs/inline.c | 22 +- fs/f2fs/inode.c | 2 +- fs/f2fs/node.c | 95 +++---- fs/f2fs/super.c | 11 + fs/f2fs/sysfs.c | 10 +- fs/hfsplus/bfind.c | 51 ++++ fs/hfsplus/catalog.c | 4 +- fs/hfsplus/dir.c | 2 +- fs/hfsplus/hfsplus_fs.h | 9 + fs/hfsplus/super.c | 6 +- fs/isofs/export.c | 2 +- fs/isofs/rock.c | 9 + fs/notify/fsnotify.c | 2 +- fs/notify/mark.c | 18 +- fs/overlayfs/util.c | 2 +- fs/smb/client/cached_dir.c | 8 + fs/smb/client/cifsacl.c | 37 ++- fs/smb/client/smb2inode.c | 12 +- fs/smb/client/smb2misc.c | 3 +- fs/smb/client/smb2ops.c | 11 + fs/smb/client/smbdirect.c | 21 +- fs/smb/server/connection.c | 48 +++- fs/smb/server/connection.h | 1 + fs/tracefs/event_inode.c | 14 ++ fs/tracefs/inode.c | 6 +- fs/tracefs/internal.h | 3 + fs/udf/misc.c | 8 +- include/linux/fsnotify_backend.h | 1 + include/linux/if_vlan.h | 25 +- include/linux/mmc/card.h | 2 + include/linux/printk.h | 13 + include/linux/rseq.h | 2 + include/uapi/linux/io_uring.h | 3 +- include/uapi/linux/rseq.h | 5 +- include/video/udlfb.h | 1 + io_uring/kbuf.c | 8 +- io_uring/kbuf.h | 7 + io_uring/tw.c | 12 +- kernel/bpf/arena.c | 19 +- kernel/exit.c | 1 + kernel/rseq.c | 29 ++- kernel/sched/ext.c | 28 ++- kernel/sched/ext_idle.c | 12 +- kernel/trace/fprobe.c | 279 ++++++++++++--------- kernel/trace/trace_probe.c | 6 + kernel/trace/trace_probe.h | 4 +- kernel/tracepoint.c | 2 + lib/crc/Kconfig | 7 +- lib/crc/tests/crc_kunit.c | 28 ++- lib/crypto/mpi/mpicoder.c | 2 +- lib/scatterlist.c | 8 +- mm/damon/lru_sort.c | 85 ++++--- mm/damon/reclaim.c | 85 ++++--- mm/damon/stat.c | 30 ++- mm/damon/sysfs-schemes.c | 24 +- mm/hugetlb_cma.c | 1 + net/8021q/vlan_dev.c | 45 ++-- net/8021q/vlan_netlink.c | 10 +- net/8021q/vlanproc.c | 12 +- net/bluetooth/hci_conn.c | 19 +- net/bluetooth/hci_event.c | 29 ++- net/bluetooth/l2cap_sock.c | 9 + net/ceph/auth.c | 2 +- net/ceph/mon_client.c | 2 + net/core/flow_dissector.c | 13 +- net/core/netpoll.c | 23 +- net/core/rtnetlink.c | 1 + net/ipv4/ah4.c | 14 +- net/ipv6/ah6.c | 14 +- net/ipv6/ip6_gre.c | 5 +- net/ipv6/xfrm6_protocol.c | 4 +- net/mac80211/mlme.c | 9 +- net/mac80211/rx.c | 2 +- net/mac80211/util.c | 4 +- net/mptcp/fastopen.c | 4 +- net/mptcp/pm.c | 62 +++-- net/mptcp/pm_kernel.c | 14 +- net/mptcp/protocol.c | 3 +- net/mptcp/sockopt.c | 16 +- net/mptcp/subflow.c | 4 +- net/openvswitch/vport-netdev.c | 6 +- net/psp/psp_main.c | 42 +++- net/rds/message.c | 20 +- net/sched/sch_red.c | 2 +- net/unix/af_unix.c | 3 + net/vmw_vsock/hyperv_transport.c | 33 ++- net/xfrm/xfrm_state.c | 12 +- net/xfrm/xfrm_user.c | 1 + rust/kernel/drm/gem/mod.rs | 13 +- rust/pin-init/internal/src/init.rs | 184 +++++++------- rust/pin-init/src/__internal.rs | 28 ++- security/selinux/hooks.c | 38 ++- security/selinux/include/objsec.h | 4 +- security/selinux/include/security.h | 2 - security/selinux/selinuxfs.c | 196 +++------------ security/selinux/ss/services.c | 125 --------- sound/core/misc.c | 8 +- sound/core/oss/pcm_oss.c | 29 ++- sound/core/seq/seq_clientmgr.c | 2 +- sound/core/seq/seq_clientmgr.h | 5 +- sound/core/seq/seq_ump_client.c | 2 +- sound/firewire/tascam/tascam-hwdep.c | 1 + sound/hda/codecs/realtek/alc269.c | 19 ++ sound/hda/codecs/side-codecs/cs35l56_hda.c | 19 +- sound/soc/amd/yc/acp6x-mach.c | 14 ++ sound/soc/codecs/es8389.c | 2 +- sound/soc/fsl/fsl_easrc.c | 2 +- sound/soc/intel/boards/bytcr_wm5102.c | 1 + sound/soc/qcom/qdsp6/q6apm-dai.c | 1 + sound/soc/qcom/qdsp6/q6apm-lpass-dais.c | 2 +- sound/soc/qcom/qdsp6/q6apm.c | 3 + sound/soc/sof/compress.c | 3 + sound/usb/midi2.c | 9 +- sound/usb/misc/ua101.c | 7 + sound/usb/stream.c | 4 +- tools/arch/x86/include/asm/msr-index.h | 3 +- tools/testing/selftests/net/mptcp/mptcp_lib.sh | 16 +- tools/testing/selftests/net/mptcp/pm_netlink.sh | 20 +- tools/testing/selftests/rseq/Makefile | 21 +- tools/testing/selftests/rseq/check_optimized.c | 17 ++ tools/testing/selftests/rseq/legacy_check.c | 65 +++++ tools/testing/selftests/rseq/param_test.c | 25 +- tools/testing/selftests/rseq/rseq-abi.h | 7 +- tools/testing/selftests/rseq/rseq.c | 39 ++- tools/testing/selftests/rseq/rseq.h | 8 +- tools/testing/selftests/rseq/run_legacy_check.sh | 4 + tools/testing/selftests/rseq/run_param_test.sh | 39 +++ tools/testing/selftests/rseq/run_timeslice_test.sh | 14 ++ tools/testing/selftests/rseq/slice_test.c | 12 +- 294 files changed, 3041 insertions(+), 1615 deletions(-)

4 weeks, 1 day

[PATCH 6.12 000/215] 6.12.86-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.12.86 release. There are 215 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 06 May 2026 13:50:52 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.86-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.12.86-rc1 Kai Ma <k4729.23098(a)gmail.com> netfilter: reject zero shift in nft_bitwise Andrea Mayer <andrea.mayer(a)uniroma2.it> net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels Deepanshu Kartikey <kartikey406(a)gmail.com> ALSA: caiaq: fix usb_dev refcount leak on probe failure Arjan van de Ven <arjan(a)linux.intel.com> drm/amdgpu: fix zero-size GDS range init on RDNA4 Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> ipv6: rpl: reserve mac_len headroom when recompressed SRH grows David Howells <dhowells(a)redhat.com> rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets Takashi Iwai <tiwai(a)suse.de> ALSA: caiaq: Don't abort when no input device is available Takashi Iwai <tiwai(a)suse.de> ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path Douglas Anderson <dianders(a)chromium.org> driver core: Add kernel-doc for DEV_FLAG_COUNT enum value Xiang Mei <xmei5(a)asu.edu> net: bonding: fix use-after-free in bond_xmit_broadcast() Yucheng Lu <kanolyc(a)gmail.com> crypto: authencesn - reject short ahash digests during instance creation Anthony Yznaga <anthony.yznaga(a)oracle.com> mm: prevent droppable mappings from being locked Johan Hovold <johan(a)kernel.org> spi: fix resource leaks on device setup failure Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Limit the total number of nodes Yuan Zhaoming <yuanzm2(a)lenovo.com> net: mctp: fix don't require received header reserved bits to be zero Zhengchuan Liang <zcliangcn(a)gmail.com> net: bridge: use a stable FDB dst snapshot in RCU readers Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Limit the maximum number of lookups Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Limit the maximum server registration per node David Howells <dhowells(a)redhat.com> rxrpc: Fix potential UAF after skb_unshare() failure Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: frequency: admv1013: fix NULL pointer dereference on str Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: frequency: admv1013: add dev variable Naman Jain <namjain(a)linux.microsoft.com> block: relax pgmap check in bio_add_page for compatible zone device pages Long Li <longli(a)microsoft.com> RDMA/mana_ib: Disable RX steering on RSS QP destroy Oliver Neukum <oneukum(a)suse.com> media: rc: igorplugusb: heed coherency rules Thorsten Blum <thorsten.blum(a)linux.dev> ALSA: aoa: Skip devices with no codecs in i2sbus_resume() Oliver Neukum <oneukum(a)suse.com> media: rc: ttusbir: respect DMA coherency rules Shigeru Yoshida <syoshida(a)redhat.com> mm/zsmalloc: copy KMSAN metadata in zs_page_migrate() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: aoa: i2sbus: clear stale prepared state Takashi Iwai <tiwai(a)suse.de> ALSA: aoa: Use guard() for mutex locks Usama Arif <usama.arif(a)linux.dev> mm: migrate: requeue destination folio on deferred split queue David Hildenbrand <david(a)redhat.com> mm/migrate: move movable_ops page handling out of move_to_new_folio() David Hildenbrand <david(a)redhat.com> mm/migrate: factor out movable_ops page handling into migrate_movable_ops_page() Daniel Hodges <git(a)danielhodges.dev> wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() Sean Wang <sean.wang(a)mediatek.com> wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling Sean Wang <sean.wang(a)mediatek.com> wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> thermal: core: Fix thermal zone governor cleanup issues DaeMyung Kang <charsyam(a)gmail.com> ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id() Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: replace connection list with hash table Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: use msleep instaed of schedule_timeout_interruptible() Chao Yu <chao(a)kernel.org> f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally Alistair Popple <apopple(a)nvidia.com> lib: test_hmm: evict device pages on file close to avoid use-after-free Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io() Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: validate the whole DACL before rewriting it in cifsacl Andrea Mayer <andrea.mayer(a)uniroma2.it> seg6: fix seg6 lwtunnel output redirect for L2 reduced encap mode Yang Xiuwei <yangxiuwei(a)kylinos.cn> scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails Keenan Dong <keenanat2000(a)gmail.com> rtmutex: Use waiter::task instead of current in remove_waiter() Tobias Gaertner <tob.gaertner(a)me.com> ntfs3: fix integer overflow in run_unpack() volume boundary check Tobias Gaertner <tob.gaertner(a)me.com> ntfs3: add buffer boundary checks to run_unpack() Steven Rostedt <rostedt(a)goodmis.org> ktest: Fix the month in the name of the failure directory Chen Zhao <chezhao(a)nvidia.com> IB/core: Fix zero dmac race in neighbor resolution Max Kellermann <max.kellermann(a)ionos.com> ceph: only d_add() negative dentries when they are unhashed Junrui Luo <moonafterrain(a)outlook.com> dm mirror: fix integer overflow in create_dirty_log() Gustavo A. R. Silva <gustavoars(a)kernel.org> crypto: nx - Fix packed layout in struct nx842_crypto_header Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-sha204a - Fix uninitialized data access on OTP read error Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-sha204a - Fix error codes in OTP reads Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-tdes - fix DMA sync direction Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> crypto: ccree - fix a memory leak in cc_mac_digest() Thomas Fourier <fourier.thomas(a)gmail.com> crypto: hisilicon - Fix dma_unmap_single() direction Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-ecc - Release client on allocation failure Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup Eric Biggers <ebiggers(a)kernel.org> crypto: arm64/aes - Fix 32-bit aes_mac_update() arg treated as 64-bit Johan Hovold <johan(a)kernel.org> can: ucan: fix devres lifetime Qiang Yu <qiang.yu(a)oss.qualcomm.com> bus: mhi: host: pci_generic: Switch to async power up to avoid boot delays Shuvam Pandey <shuvampandey1(a)gmail.com> Bluetooth: hci_event: fix potential UAF in SSP passkey handlers Cengiz Can <cengiz.can(a)canonical.com> apparmor: use target task's context in apparmor_getprocattr() Brian Mak <makb(a)juniper.net> mfd: core: Preserve OF node when ACPI handle is present Yiyang Chen <cyyzero16(a)gmail.com> taskstats: set version in TGID exit notifications Zhenzhong Wu <jt26wzz(a)gmail.com> tcp: call sk_data_ready() after listener migration Yi Cong <yicong(a)kylinos.cn> wifi: rtl8xxxu: fix potential use of uninitialized value Dave Hansen <dave.hansen(a)linux.intel.com> x86/cpu: Disable FRED when PTI is forced on Chia-Ming Chang <chiamingc(a)synology.com> inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails Aditya Garg <gargaditya08(a)live.com> HID: apple: ensure the keyboard backlight is off if suspending Arnd Bergmann <arnd(a)arndb.de> check-uapi: link into shared objects Junrui Luo <moonafterrain(a)outlook.com> md/raid5: validate payload size before accessing journal metadata Chia-Ming Chang <chiamingc(a)synology.com> md/raid5: fix soft lockup in retry_aligned_read() David (Ming Qiang) Wu <David.Wu3(a)amd.com> amdgpu/jpeg: fix deepsleep register for jpeg 5_0_0 and 5_0_2 Sanjaikumar V S <sanjaikumar.vs(a)dicortech.com> mtd: spi-nor: sst: Fix write enable before AAI sequence Sohei Koyama <skoyama(a)ddn.com> ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() Deepanshu Kartikey <kartikey406(a)gmail.com> ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access Rong Bao <rong.bao(a)csmantle.top> perf annotate: Use jump__delete when freeing LoongArch jumps Jens Axboe <axboe(a)kernel.dk> io_uring/poll: fix multishot recv missing EOF on wakeup race Sean Christopherson <seanjc(a)google.com> KVM: nSVM: Always intercept VMMCALL when L2 is active Kevin Cheng <chengkev(a)google.com> KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Add missing consistency check for nCR3 validity Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Add missing consistency check for EFER, CR0, CR4, and CS Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Clear tracking of L1->L2 NMI and soft IRQ on nested #VMEXIT Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Clear EVENTINJ fields in vmcb12 on nested #VMEXIT Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID) Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Always inject a #GP if mapping VMCB12 fails on nested VMRUN Yosry Ahmed <yosry.ahmed(a)linux.dev> KVM: nSVM: Use vcpu->arch.cr2 when updating vmcb12 on nested #VMEXIT Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode Sean Christopherson <seanjc(a)google.com> KVM: SVM: Explicitly mark vmcb01 dirty after modifying VMCB intercepts Kevin Cheng <chengkev(a)google.com> KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Sync NextRIP to cached vmcb12 after VMRUN of L2 Yosry Ahmed <yosry.ahmed(a)linux.dev> KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state Sean Christopherson <seanjc(a)google.com> KVM: x86: Defer non-architectural deliver of exception payload to userspace read Denis M. Karpov <komlomal(a)gmail.com> userfaultfd: allow registration of ranges below mmap_min_addr SeongJae Park <sj(a)kernel.org> mm/damon/core: use time_in_range_open() for damos quota window start Johan Hovold <johan(a)kernel.org> rtc: ntxec: fix OF node reference imbalance Jacqueline Wong <jacqwong(a)google.com> tpm: tpm_tis: stop transmit if retries are exhausted Jacqueline Wong <jacqwong(a)google.com> tpm: tpm_tis: add error logging for data transfer Gunnar Kudrjavets <gunnarku(a)amazon.com> tpm: Use kfree_sensitive() to free auth session in tpm_dev_release() Gunnar Kudrjavets <gunnarku(a)amazon.com> tpm: Fix auth session leak in tpm2_get_random() error path Viorel Suman (OSS) <viorel.suman(a)oss.nxp.com> pwm: imx-tpm: Count the number of enabled channels in probe Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos - rename first/last to first_desc/last_desc Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos - fix SEC1 32k ahash request limitation Thomas Zimmermann <tzimmermann(a)suse.de> firmware: google: framebuffer: Do not unregister platform device Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> xfs: fix a resource leak in xfs_alloc_buftarg() Francesco Dolcini <francesco.dolcini(a)toradex.com> arm64: dts: ti: am62-verdin: Enable pullup for eMMC data pins Shawn Lin <shawn.lin(a)rock-chips.com> mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration Bin Liu <b-liu(a)ti.com> mmc: block: use single block write in retry Ryan Roberts <ryan.roberts(a)arm.com> randomize_kstack: Maintain kstack_offset per task Sanman Pradhan <psanman(a)juniper.net> hwmon: (pt5161l) Fix bugs in pt5161l_read_block_data() Krzysztof Kozlowski <krzysztof.kozlowski(a)oss.qualcomm.com> power: supply: axp288_charger: Do not cancel work before initializing it Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Show CPU vulnerabilites correctly Arnd Bergmann <arnd(a)arndb.de> tpm: avoid -Wunused-but-set-variable Nathan Chancellor <nathan(a)kernel.org> extract-cert: Wrap key_pass with '#ifdef USE_PKCS11_ENGINE' Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() Ruide Cao <caoruide123(a)gmail.com> ipv4: icmp: validate reply type before using icmp_pointers hkbinbin <hkbinbinbin(a)gmail.com> RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv Luca Ceresoli <luca.ceresoli(a)bootlin.com> drm/arcpgu: fix device node leak Marek Vasut <marex(a)nabladev.com> net: ks8851: Avoid excess softirq scheduling Breno Leitao <leitao(a)debian.org> netconsole: avoid out-of-bounds access on empty string in trim_newline() Marek Vasut <marex(a)nabladev.com> net: ks8851: Reinstate disabling of BHs around IRQ handler Ruijie Li <ruijieli51(a)gmail.com> net/smc: avoid early lgr access in smc_clc_wait_msg Jiawen Wu <jiawenwu(a)trustnetic.com> net: txgbe: fix firmware version check Ao Zhou <draw51280(a)163.com> net: rds: fix MR cleanup on copy error Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Free the node during ctrl_cmd_bye() Robert Marko <robert.marko(a)sartura.hr> arm64: dts: marvell: uDPU: add ethernet aliases Yiyang Chen <cyyzero16(a)gmail.com> tools/accounting: handle truncated taskstats netlink messages David Howells <dhowells(a)redhat.com> rxrpc: Fix re-decryption of RESPONSE packets David Howells <dhowells(a)redhat.com> rxrpc: Fix rxkad crypto unalignment handling David Howells <dhowells(a)redhat.com> rxrpc: Fix memory leaks in rxkad_verify_response() Jonathan Santos <Jonathan.Santos(a)analog.com> iio: adc: ad7768-1: fix one-shot mode data acquisition Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: pcmtest: Fix resource leaks in module init error paths Guangshuo Li <lgs201920130244(a)gmail.com> ALSA: pcmtest: fix reference leak on failed device registration Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: 6fire: Fix input volume change detection Takashi Iwai <tiwai(a)suse.de> ALSA: caiaq: Handle probe errors properly Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: caiaq: Fix control_put() result and cache rollback Takashi Iwai <tiwai(a)suse.de> ALSA: core: Fix potential data race at fasync handling Jens Axboe <axboe(a)kernel.dk> io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE Longxuan Yu <ylong030(a)ucr.edu> io_uring/poll: fix signed comparison in io_poll_get_ownership() David Lechner <dlechner(a)baylibre.com> iio: adc: ti-ads7950: use iio_push_to_buffers_with_ts_unaligned() Pavel Begunkov <asml.silence(a)gmail.com> io_uring/timeout: check unused sqe fields Damien Le Moal <dlemoal(a)kernel.org> block: fix zone write plugs refcount handling in disk_zone_wplug_schedule_bio_work() Dawei Feng <dawei.feng(a)seu.edu.cn> rbd: fix null-ptr-deref when device_add_disk() fails Mickaël Salaün <mic(a)digikod.net> selftests/landlock: Fix format warning for __u64 in net_test Simon Liebold <simonlie(a)amazon.de> selftests/mqueue: Fix incorrectly named file Joseph Salisbury <joseph.salisbury(a)oracle.com> sched: Use u64 for bandwidth ratio calculations Ben Levinsky <ben.levinsky(a)amd.com> remoteproc: xlnx: Only access buffer information if IPI is buffered Helge Deller <deller(a)gmx.de> parisc: _llseek syscall is only available for 32-bit userspace Robert Beckett <bob.beckett(a)collabora.com> nvme: respect NVME_QUIRK_DISABLE_WRITE_ZEROES when wzsl is set Robert Beckett <bob.beckett(a)collabora.com> nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4 James Kim <james010kim(a)gmail.com> mtd: docg3: fix use-after-free in docg3_release() Marek Vasut <marex(a)nabladev.com> mfd: stpmic1: Attempt system shutdown twice in case PMIC is confused Josh Hunt <johunt(a)akamai.com> md/raid10: fix deadlock with check operation and nowait requests Zhang Yi <yi.zhang(a)huawei.com> jbd2: fix deadlock in jbd2_journal_cancel_revoke() Gao Xiang <xiang(a)kernel.org> erofs: fix the out-of-bounds nameoff handling for trailing dirents Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes Harin Lee <me(a)harin.net> ALSA: ctxfi: Add fallback to default RSR for S/PDIF Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: aoa: i2sbus: fix OF node lifetime handling Vasiliy Kovalev <kovalev(a)altlinux.org> ext2: reject inodes with zero i_nlink and valid mode in ext2_iget() Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Fix use-after-free in driver remove() Chen Ni <nichen(a)iscas.ac.cn> media: i2c: imx219: Check return value of devm_gpiod_get_optional() in imx219_probe() Josh Law <objecting(a)objecting.org> lib/ts_kmp: fix integer overflow in pattern length calculation Daniel Hodges <git(a)danielhodges.dev> PCI: epf-mhi: Return 0, not remaining timeout, when eDMA ops complete Rong Zhang <i(a)rong.moe> Revert "ALSA: usb: Increase volume range that triggers a warning" Koichiro Den <den(a)valinux.co.jp> PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-sha204a - Fix OTP sysfs read and error handling Fan Wu <fanwu01(a)zju.edu.cn> media: mtk-jpeg: fix use-after-free in release path due to uncancelled work Luxiao Xu <rakukuip(a)gmail.com> net: strparser: fix skb_head leak in strp_abort_strp() Zhengchuan Liang <zcliangcn(a)gmail.com> net: caif: clear client service pointer on teardown Ziqing Chen <chenziqing(a)xiaomi.com> ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() Ming Qian <ming.qian(a)oss.nxp.com> media: amphion: Fix race between m2m job_abort and device_run Sanman Pradhan <psanman(a)juniper.net> hwmon: (powerz) Fix missing usb_kill_urb() on signal interrupt Wentao Liang <vulab(a)iscas.ac.cn> of: unittest: fix use-after-free in testdrv_probe() Wentao Liang <vulab(a)iscas.ac.cn> of: unittest: fix use-after-free in of_unittest_changeset() Herbert Xu <herbert(a)gondor.apana.org.au> crypto: pcrypt - Fix handling of MAY_BACKLOG requests Jinjiang Tu <tujinjiang(a)huawei.com> mm/memory_hotplug: fix hwpoisoned large folio handling in do_migrate_range() Johan Hovold <johan(a)kernel.org> spi: ch341: fix memory leaks on probe failures Johan Hovold <johan(a)kernel.org> spi: imx: fix use-after-free on unbind Michael Bommarito <michael.bommarito(a)gmail.com> um: drivers: call kernel_strrchr() explicitly in cow_user.c Prasanna Kumar T S M <ptsm(a)linux.microsoft.com> vfio/cdx: Fix NULL pointer dereference in interrupt trigger path Alex Williamson <alex.williamson(a)nvidia.com> vfio/cdx: Serialize VFIO_DEVICE_SET_IRQS with a per-device mutex Fedor Pchelkin <pchelkin(a)ispras.ru> wifi: rtw88: check for PCI upstream bridge existence Sergey Senozhatsky <senozhatsky(a)chromium.org> zram: do not forget to endio for partial discard requests Heming Zhao <heming.zhao(a)suse.com> ocfs2: split transactions in dio completion to avoid credit exhaustion Douglas Anderson <dianders(a)chromium.org> device property: Make modifications of fwnode "flags" thread safe Jesse.Zhang <Jesse.Zhang(a)amd.com> drm/amdgpu: Limit BO list entry count to prevent resource exhaustion Tvrtko Ursulin <tvrtko.ursulin(a)igalia.com> drm/amdgpu: Use vmemdup_array_user in amdgpu_bo_create_list_entry_array Miguel Ojeda <ojeda(a)kernel.org> rust: init: fix `clippy::undocumented_unsafe_blocks` warnings Herbert Xu <herbert(a)gondor.apana.org.au> padata: Remove comment for reorder_work Herbert Xu <herbert(a)gondor.apana.org.au> padata: Fix pd UAF once and for all Anshuman Khandual <anshuman.khandual(a)arm.com> arm64/mm: Enable batched TLB flush in unmap_hotplug_range() Thomas Zimmermann <tzimmermann(a)suse.de> firmware: google: framebuffer: Do not mark framebuffer as busy Miguel Ojeda <ojeda(a)kernel.org> kbuild: rust: allow `clippy::uninlined_format_args` David Carlier <devnexen(a)gmail.com> drm/nouveau: fix nvkm_device leak on aperture removal failure Douglas Anderson <dianders(a)chromium.org> driver core: Don't let a device probe until it's ready Tyllis Xu <livelycarpet87(a)gmail.com> ibmasm: fix heap over-read in ibmasm_send_i2o_message() Tyllis Xu <livelycarpet87(a)gmail.com> ibmasm: fix OOB reads in command_file_write due to missing size checks Tyllis Xu <livelycarpet87(a)gmail.com> misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt() Weigang He <geoffreyhe2(a)gmail.com> greybus: gb-beagleplay: fix sleep in atomic context in hdlc_tx_frames() Pengpeng Hou <pengpeng(a)iscas.ac.cn> greybus: gb-beagleplay: bound bootloader receive buffering Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> leds: qcom-lpg: Check for array overflow when selecting the high resolution Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> drm/nouveau: fix u32 overflow in pushbuf reloc bounds check Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> LoongArch: Add spectre boundry for syscall dispatch table Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Evaluate packsize caps at the right place Xu Yang <xu.yang_2(a)nxp.com> usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change Xu Yang <xu.yang_2(a)nxp.com> usb: chipidea: otg: not wait vbus drop if use role_switch Michal Pecio <michal.pecio(a)gmail.com> usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Avoid false E-MU sample-rate notifications Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES ------------- Diffstat: Makefile | 5 +- arch/arm64/boot/dts/marvell/armada-3720-uDPU.dtsi | 5 + arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi | 20 +- arch/arm64/crypto/aes-modes.S | 4 +- arch/arm64/mm/mmu.c | 36 ++- arch/loongarch/kernel/cpu-probe.c | 7 + arch/loongarch/kernel/syscall.c | 3 +- arch/parisc/kernel/syscalls/syscall.tbl | 2 +- arch/um/drivers/cow_user.c | 8 +- arch/x86/kvm/hyperv.h | 8 - arch/x86/kvm/svm/hyperv.h | 9 +- arch/x86/kvm/svm/nested.c | 55 ++-- arch/x86/kvm/svm/svm.c | 32 +- arch/x86/kvm/svm/svm.h | 1 + arch/x86/kvm/x86.c | 62 ++-- arch/x86/mm/pti.c | 5 + block/bio-integrity.c | 2 + block/bio.c | 14 +- block/blk-zoned.c | 12 +- block/blk.h | 19 ++ certs/extract-cert.c | 6 +- crypto/authencesn.c | 5 + crypto/pcrypt.c | 7 +- drivers/base/core.c | 39 ++- drivers/base/dd.c | 20 ++ drivers/block/rbd.c | 6 +- drivers/block/zram/zram_drv.c | 3 +- drivers/bus/imx-weim.c | 2 +- drivers/bus/mhi/host/pci_generic.c | 2 +- drivers/char/tpm/tpm-chip.c | 2 +- drivers/char/tpm/tpm2-cmd.c | 6 +- drivers/char/tpm/tpm_tis_core.c | 11 +- drivers/crypto/atmel-aes.c | 2 +- drivers/crypto/atmel-ecc.c | 1 + drivers/crypto/atmel-i2c.c | 4 +- drivers/crypto/atmel-sha204a.c | 37 ++- drivers/crypto/atmel-tdes.c | 8 +- drivers/crypto/ccree/cc_hash.c | 1 + drivers/crypto/hisilicon/sec/sec_algs.c | 2 +- drivers/crypto/nx/nx-842.h | 4 +- drivers/crypto/talitos.c | 340 +++++++++++++-------- drivers/firmware/google/framebuffer-coreboot.c | 12 +- drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c | 43 ++- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 3 + drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c | 52 +++- drivers/gpu/drm/nouveau/nouveau_drm.c | 2 +- drivers/gpu/drm/nouveau/nouveau_gem.c | 2 +- drivers/gpu/drm/tiny/arcpgu.c | 3 +- drivers/greybus/gb-beagleplay.c | 112 ++++++- drivers/hid/hid-apple.c | 2 + drivers/hwmon/powerz.c | 11 +- drivers/hwmon/pt5161l.c | 4 +- drivers/i2c/i2c-core-of.c | 2 +- drivers/iio/adc/ad7768-1.c | 9 +- drivers/iio/adc/ti-ads7950.c | 11 +- drivers/iio/frequency/admv1013.c | 90 +++--- drivers/infiniband/core/addr.c | 3 + drivers/infiniband/hw/mana/qp.c | 15 + drivers/infiniband/sw/rxe/rxe_recv.c | 3 +- drivers/leds/rgb/leds-qcom-lpg.c | 7 +- drivers/md/dm-raid1.c | 6 +- drivers/md/raid10.c | 4 +- drivers/md/raid5-cache.c | 48 ++- drivers/md/raid5.c | 8 +- drivers/media/i2c/imx219.c | 3 + drivers/media/platform/amphion/vpu_v4l2.c | 9 +- .../media/platform/mediatek/jpeg/mtk_jpeg_core.c | 1 + drivers/media/rc/igorplugusb.c | 16 +- drivers/media/rc/ttusbir.c | 13 +- drivers/mfd/mfd-core.c | 12 +- drivers/mfd/stpmic1.c | 20 +- drivers/misc/ibmasm/ibmasmfs.c | 7 + drivers/misc/ibmasm/lowlevel.c | 12 +- drivers/misc/ibmasm/remote.c | 5 + drivers/mmc/core/block.c | 12 +- drivers/mmc/core/queue.h | 3 + drivers/mmc/host/sdhci-of-dwcmshc.c | 19 +- drivers/mtd/devices/docg3.c | 3 +- drivers/mtd/spi-nor/sst.c | 13 + drivers/net/bonding/bond_main.c | 12 +- drivers/net/can/usb/ucan.c | 2 +- drivers/net/ethernet/micrel/ks8851.h | 6 +- drivers/net/ethernet/micrel/ks8851_common.c | 69 ++--- drivers/net/ethernet/micrel/ks8851_par.c | 15 +- drivers/net/ethernet/micrel/ks8851_spi.c | 11 +- drivers/net/ethernet/microsoft/mana/mana_en.c | 11 +- drivers/net/ethernet/wangxun/txgbe/txgbe_main.c | 3 +- drivers/net/netconsole.c | 2 + drivers/net/phy/mdio_bus.c | 4 +- drivers/net/wireless/marvell/mwifiex/init.c | 2 +- drivers/net/wireless/mediatek/mt76/mt792x_regs.h | 4 + drivers/net/wireless/mediatek/mt76/mt792x_usb.c | 51 +++- drivers/net/wireless/realtek/rtl8xxxu/core.c | 28 +- drivers/net/wireless/realtek/rtw88/pci.c | 3 +- drivers/nvme/host/core.c | 2 +- drivers/nvme/host/pci.c | 2 + drivers/of/base.c | 2 +- drivers/of/dynamic.c | 2 +- drivers/of/platform.c | 2 +- drivers/of/unittest.c | 4 +- drivers/pci/endpoint/functions/pci-epf-mhi.c | 4 + drivers/pci/endpoint/functions/pci-epf-ntb.c | 56 +--- drivers/power/supply/axp288_charger.c | 19 +- drivers/pwm/pwm-imx-tpm.c | 9 +- drivers/remoteproc/xlnx_r5_remoteproc.c | 20 +- drivers/rtc/rtc-ntxec.c | 2 +- drivers/scsi/sd.c | 1 + drivers/spi/spi-ch341.c | 36 ++- drivers/spi/spi-imx.c | 4 + drivers/spi/spi.c | 63 ++-- drivers/thermal/thermal_core.c | 7 +- drivers/usb/chipidea/core.c | 45 +-- drivers/usb/chipidea/otg.c | 7 +- drivers/usb/host/xhci.c | 1 - drivers/vfio/cdx/intr.c | 13 +- drivers/vfio/cdx/main.c | 19 ++ drivers/vfio/cdx/private.h | 3 + fs/ceph/dir.c | 6 +- fs/erofs/dir.c | 28 +- fs/ext2/inode.c | 14 +- fs/ext4/xattr.c | 6 +- fs/f2fs/data.c | 4 +- fs/f2fs/f2fs.h | 2 +- fs/f2fs/segment.c | 6 +- fs/f2fs/super.c | 11 +- fs/jbd2/revoke.c | 8 +- fs/notify/inotify/inotify_user.c | 1 + fs/ntfs3/run.c | 18 +- fs/ocfs2/aops.c | 74 +++-- fs/smb/client/cifsacl.c | 116 +++++-- fs/smb/server/connection.c | 28 +- fs/smb/server/connection.h | 6 +- fs/smb/server/smb2pdu.c | 4 +- fs/smb/server/transport_rdma.c | 5 + fs/smb/server/transport_tcp.c | 25 +- fs/userfaultfd.c | 2 - fs/xfs/xfs_buf.c | 1 + include/linux/device.h | 45 +++ include/linux/fwnode.h | 44 ++- include/linux/hugetlb_inline.h | 4 +- include/linux/padata.h | 4 - include/linux/randomize_kstack.h | 26 +- include/linux/sched.h | 4 + include/linux/tpm_eventlog.h | 9 +- include/linux/usb.h | 3 +- include/net/mana/mana.h | 1 + include/net/mctp.h | 3 + include/trace/events/rxrpc.h | 6 +- init/main.c | 1 - io_uring/poll.c | 15 +- io_uring/timeout.c | 4 + kernel/fork.c | 2 + kernel/locking/rtmutex.c | 13 +- kernel/padata.c | 136 +++------ kernel/sched/core.c | 2 +- kernel/sched/rt.c | 2 +- kernel/sched/sched.h | 2 +- kernel/taskstats.c | 1 + lib/test_hmm.c | 86 +++--- lib/ts_kmp.c | 18 +- mm/damon/core.c | 3 +- mm/internal.h | 10 + mm/memory_hotplug.c | 10 +- mm/migrate.c | 152 +++++---- mm/mlock.c | 10 +- mm/mmap.c | 4 +- mm/zsmalloc.c | 1 + net/bluetooth/hci_event.c | 18 +- net/bridge/br_arp_nd_proxy.c | 8 +- net/bridge/br_fdb.c | 28 +- net/caif/cfsrvl.c | 14 +- net/ceph/auth.c | 2 +- net/ipv4/icmp.c | 5 +- net/ipv4/inet_connection_sock.c | 3 + net/ipv6/exthdrs.c | 9 +- net/ipv6/rpl_iptunnel.c | 9 + net/ipv6/seg6_iptunnel.c | 12 +- net/mctp/route.c | 8 +- net/netfilter/nft_bitwise.c | 3 +- net/qrtr/ns.c | 86 +++++- net/rds/rdma.c | 4 - net/rxrpc/ar-internal.h | 1 - net/rxrpc/call_event.c | 25 +- net/rxrpc/conn_event.c | 14 +- net/rxrpc/io_thread.c | 24 +- net/rxrpc/rxkad.c | 112 +++---- net/rxrpc/skbuff.c | 9 - net/smc/smc_clc.c | 4 +- net/strparser/strparser.c | 8 + rust/kernel/init/macros.rs | 7 +- scripts/check-uapi.sh | 7 +- security/apparmor/lsm.c | 16 +- sound/aoa/codecs/onyx.c | 104 ++----- sound/aoa/codecs/tas.c | 113 +++---- sound/aoa/core/gpio-feature.c | 20 +- sound/aoa/core/gpio-pmf.c | 26 +- sound/aoa/soundbus/i2sbus/core.c | 12 +- sound/aoa/soundbus/i2sbus/pcm.c | 143 ++++----- sound/core/control.c | 4 + sound/core/misc.c | 13 +- sound/core/seq/oss/seq_oss_rw.c | 6 +- sound/drivers/pcmtest.c | 19 +- sound/pci/ctxfi/ctatc.c | 3 +- sound/usb/6fire/control.c | 10 +- sound/usb/caiaq/control.c | 52 +++- sound/usb/caiaq/device.c | 35 ++- sound/usb/caiaq/input.c | 2 +- sound/usb/endpoint.c | 6 +- sound/usb/format.c | 2 +- sound/usb/mixer.c | 7 +- sound/usb/mixer_quirks.c | 12 +- tools/accounting/getdelays.c | 41 ++- tools/accounting/procacct.c | 40 ++- tools/perf/arch/loongarch/annotate/instructions.c | 1 + tools/perf/util/disasm.c | 1 + tools/testing/ktest/ktest.pl | 2 +- tools/testing/selftests/landlock/net_test.c | 2 +- .../testing/selftests/mqueue/{setting => settings} | 0 218 files changed, 2506 insertions(+), 1555 deletions(-)

1 month

← Newer
1
2
3
4
5
6
7
...
3413
Older →

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

Lkft-triage