- Lkft-triage - lists.linaro.org

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.18.32 release. There are 188 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sun, 17 May 2026 15:46:37 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.32-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.18.32-rc1 Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vcn4: Avoid overflow on msg bound check Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vcn3: Avoid overflow on msg bound check Dudu Lu <phx0fer(a)gmail.com> vsock/virtio: fix accept queue count leak on transport mismatch Eric Dumazet <edumazet(a)google.com> vsock/virtio: fix potential unbounded skb queue Stefano Garzarella <sgarzare(a)redhat.com> vsock/virtio: fix empty payload in tap skb for non-linear buffers Stefano Garzarella <sgarzare(a)redhat.com> vsock/virtio: fix length and offset in tap skb for split packets Norbert Szetei <norbert(a)doyensec.com> vsock: fix buffer size clamping order Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: fix tp_num leak on kmalloc failure Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/fprobe: Remove fprobe from hash in failure path Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/fprobe: Unregister fprobe even if memory allocation fails Menglong Dong <menglong8.dong(a)gmail.com> tracing: fprobe: optimization for entry only case Menglong Dong <menglong8.dong(a)gmail.com> tracing: fprobe: use rhltable for fprobe_ip_table Yochai Eisenrich <yochaie(a)sweet.security> btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak Guangshuo Li <lgs201920130244(a)gmail.com> btrfs: fix double free in create_space_info_sub_group() error path Filipe Manana <fdmanana(a)suse.com> btrfs: remove fs_info argument from btrfs_sysfs_add_space_info_type() Selvarasu Ganesan <selvarasu.g(a)samsung.com> usb: dwc3: Move GUID programming after PHY initialization Prashanth K <prashanth.k(a)oss.qualcomm.com> usb: dwc3: Add dwc pointer to dwc3_readl/writel Prashanth K <prashanth.k(a)oss.qualcomm.com> usb: dwc3: Remove of dep->regs Tejun Heo <tj(a)kernel.org> sched_ext: Read scx_root under scx_cgroup_ops_rwsem in cgroup setters zhidao su <suzhidao(a)xiaomi.com> sched/ext: Implement cgroup_set_idle() callback David Carlier <devnexen(a)gmail.com> Bluetooth: hci_conn: fix potential UAF in create_big_sync Johan Hovold <johan(a)kernel.org> spi: zynq-qspi: fix controller deregistration Pei Xiao <xiaopei01(a)kylinos.cn> spi: zynq-qspi: Simplify clock handling with devm_clk_get_enabled() Johan Hovold <johan(a)kernel.org> spi: tegra114: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: tegra20-sflash: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: uniphier: fix controller deregistration Pei Xiao <xiaopei01(a)kylinos.cn> spi: uniphier: Simplify clock handling with devm_clk_get_enabled() Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> pseries/papr-hvpipe: Fix race with interrupt handler Christian Brauner <brauner(a)kernel.org> papr-hvpipe: convert papr_hvpipe_dev_create_handle() to FD_PREPARE() Prasanna Kumar T S M <ptsm(a)linux.microsoft.com> EDAC/versalnet: Fix device name memory leak Damien Le Moal <dlemoal(a)kernel.org> block: fix zone write plug removal Thomas Zimmermann <tzimmermann(a)suse.de> fbcon: Avoid OOB font access if console rotation fails Thomas Zimmermann <tzimmermann(a)suse.de> fbcon: Rename struct fbcon_ops to struct fbcon_par Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu: rework how we handle TLB fences Prike Liang <Prike.Liang(a)amd.com> Revert "drm/amdgpu: don't attach the tlb fence for SI" Timur Kristóf <timur.kristof(a)gmail.com> drm/amdgpu: Fix validating flush_gpu_tlb_pasid() Prike Liang <Prike.Liang(a)amd.com> drm/amdgpu: validate the flush_gpu_tlb_pasid() SeongJae Park <sj(a)kernel.org> mm/damon/core: disallow time-quota setting zero esz Amit Sunil Dhamne <amitsd(a)google.com> usb: typec: tcpm: reset internal port states on soft reset AMS SeongJae Park <sj(a)kernel.org> mm/damon/reclaim: detect and use fresh enabled and kdamond_pid values SeongJae Park <sj(a)kernel.org> mm/damon/lru_sort: detect and use fresh enabled and kdamond_pid values SeongJae Park <sj(a)kernel.org> mm/damon/core: implement damon_kdamond_pid() Xianglai Li <lixianglai(a)loongson.cn> LoongArch: KVM: Compile switch.S directly into the kernel Pavel Begunkov <asml.silence(a)gmail.com> io_uring/zcrx: warn on freelist violations Pavel Begunkov <asml.silence(a)gmail.com> io_uring/zcrx: use guards for locking Andrea Righi <arighi(a)nvidia.com> sched_ext: Use HK_TYPE_DOMAIN_BOOT to detect isolcpus= domain isolation Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: put backbone reference on failed claim hash insert Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: only purge non-released claims Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: prevent use-after-free when deleting claims Jiexun Wang <wangjiexun2025(a)gmail.com> batman-adv: stop caching unowned originator pointers in BAT IV Jiexun Wang <wangjiexun2025(a)gmail.com> batman-adv: stop tp_meter sessions during mesh teardown Jiexun Wang <wangjiexun2025(a)gmail.com> batman-adv: reject new tp_meter sessions during teardown Lyes Bourennani <lbourennani(a)fuzzinglabs.com> batman-adv: fix integer overflow on buff_pos Ben Morris <bmorris(a)anthropic.com> sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL Siddharth Vadapalli <s-vadapalli(a)ti.com> arm64: dts: ti: k3-am62a7-sk: Fix pin name in comment from M19 to N22 Viken Dadhaniya <viken.dadhaniya(a)oss.qualcomm.com> arm64: dts: qcom: lemans: Correct QUP interrupt numbers Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/pm: align Hawaii mclk workaround with radeon Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/pm: add missing revision check for CI John B. Moore <jbmoore61(a)gmail.com> drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission Felix Kuehling <felix.kuehling(a)amd.com> drm/amdkfd: Make all TLB-flushes heavy-weight Icenowy Zheng <zhengxingda(a)iscas.ac.cn> drm/panel: boe-tv101wum-nl6: restore MODE_LPM after sending disable cmds Kory Maincent (TI) <kory.maincent(a)bootlin.com> drm/bridge: tda998x: Use __be32 for audio port OF property pointer John B. Moore <jbmoore61(a)gmail.com> drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ Icenowy Zheng <zhengxingda(a)iscas.ac.cn> drm/panel: himax-hx83102: restore MODE_LPM after sending disable cmds Osama Abdelkader <osama.abdelkader(a)gmail.com> drm/exynos: remove bridge when component_add fails Philip Yang <Philip.Yang(a)amd.com> drm/amdgpu: zero-initialize GART table on allocation Alex Deucher <alexander.deucher(a)amd.com> drm/radeon: add missing revision check for CI Francis, David <David.Francis(a)amd.com> drm: Set old handle to NULL before prime swap in change_handle Jia Yao <jia.yao(a)intel.com> drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise Shuicheng Lin <shuicheng.lin(a)intel.com> drm/xe/bo: Fix bo leak on unaligned size validation in xe_bo_init_locked() Shuicheng Lin <shuicheng.lin(a)intel.com> drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() Shuicheng Lin <shuicheng.lin(a)intel.com> drm/xe/bo: Fix bo leak on GGTT flag validation in xe_bo_init_locked() Shuicheng Lin <shuicheng.lin(a)intel.com> drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure Shixiong Ou <oushixiong(a)kylinos.cn> drm/udl: Increase GET_URB_TIMEOUT Alysa Liu <Alysa.Liu(a)amd.com> drm/amdkfd: validate SVM ioctl nattr against buffer size Sasha Finkelstein <k(a)chaosmail.tech> drm/appletbdrm: Use kvzalloc for big allocations Ashutosh Desai <ashutoshdesai993(a)gmail.com> drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() Mario Kleiner <mario.kleiner.de(a)gmail.com> drm/amd/display: Change dither policy for 10 bpc output back to dithering Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vce: Prevent partial address patches Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vcn4: Prevent OOB reads when parsing IB Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu: Add bounds checking to ib_{get,set}_value Alysa Liu <Alysa.Liu(a)amd.com> drm/amdkfd: Add upper bound check for num_of_nodes Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: fix incorrect FeatureCtrlMask setting on smu v14.0.x Chenglei Xie <Chenglei.Xie(a)amd.com> drm/amdgpu: gate VM CPU HDP flush on reset lock Ramalingeswara Reddy, Kanala <Kanala.RamalingeswaraReddy(a)amd.com> drm/amdgpu: Use SMUIO 15.0.0 offsets for TSC upper and lower count. Amir Shetaia <Amir.Shetaia(a)amd.com> drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Init variable to avoid early exit from et alignment loop Anna Maniscalco <anna.maniscalco2000(a)gmail.com> drm/msm: always recover the gpu Marek Vasut <marex(a)nabladev.com> drm/imx: parallel-display: Prefer bus format set via legacy "interface-pix-fmt" DT property Yasuaki Torimaru <yasuakitorimaru(a)gmail.com> drm/msm/gem: fix error handling in msm_ioctl_gem_info_get_metadata() Johan Hovold <johan(a)kernel.org> spi: cadence: fix clock imbalance on probe failure Johan Hovold <johan(a)kernel.org> spi: cadence: fix unclocked access on unbind Johan Hovold <johan(a)kernel.org> spi: cadence: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: mpc52xx: fix use-after-free on unbind Johan Hovold <johan(a)kernel.org> spi: mpc52xx: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: mpc52xx: fix use-after-free on registration failure Johan Hovold <johan(a)kernel.org> spi: orion: fix clock imbalance on registration failure Johan Hovold <johan(a)kernel.org> spi: orion: fix runtime pm leak on unbind Johan Hovold <johan(a)kernel.org> spi: orion: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: mxic: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: imx: fix runtime pm leak on probe deferral Johan Hovold <johan(a)kernel.org> spi: mpfs: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: img-spfi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: slave-mt27xx: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sh-msiof: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: rspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sprd: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: pic32-sqi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: cavium-thunderx: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: npcm-pspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: coldfire-qspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: bcmbca-hsspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: fsl: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sh-hspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: ch341: fix devres lifetime Johan Hovold <johan(a)kernel.org> spi: pl022: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: mtk-nor: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: pic32: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: omap2-mcspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: fsl-espi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: s3c64xx: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: dln2: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: mt65xx: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: mxs: fix controller deregistration Wenmeng Liu <wenmeng.liu(a)oss.qualcomm.com> media: qcom: camss: Add missing clocks for VFE lite on sa8775p Thomas Fourier <fourier.thomas(a)gmail.com> media: iris: Fix dma_free_attrs() size in iris_hfi_queues_init() Arnd Bergmann <arnd(a)arndb.de> media: venus: fix QCOM_MDT_LOADER dependency Dmitry Baryshkov <dmitry.baryshkov(a)oss.qualcomm.com> media: qcom: iris: increase H265D_MAX_SLICE to fix H.265 decoding on SC7280 Wenmeng Liu <wenmeng.liu(a)oss.qualcomm.com> media: qcom: camss: Fix csid IRQ offset for sa8775p Wenmeng Liu <wenmeng.liu(a)oss.qualcomm.com> media: qcom: camss: Fix csid clock configuration for sa8775p Dikshita Agarwal <dikshita.agarwal(a)oss.qualcomm.com> media: iris: Fix use-after-free in iris_release_internal_buffers() Arnd Bergmann <arnd(a)arndb.de> media: iris: fix QCOM_MDT_LOADER dependency Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> media: omap3isp: drop the use count of v4l2 pipeline Matthias Fend <matthias.fend(a)emfend.at> media: i2c: ov08d10: fix runtime PM handling in probe Matthias Fend <matthias.fend(a)emfend.at> media: i2c: ov08d10: fix image vertical start setting Michael Tretter <m.tretter(a)pengutronix.de> media: staging: imx: request mbus_config in csi_start Wenmeng Liu <wenmeng.liu(a)oss.qualcomm.com> media: i2c: imx412: Assert reset GPIO during probe Sergey Shtylyov <s.shtylyov(a)auroraos.dev> media: dib8000: avoid division by 0 in dib8000_set_dds() Abdun Nihaal <nihaal(a)cse.iitm.ac.in> media: pci: zoran: fix potential memory leak in zoran_probe() Gregor Herburger <gregor.herburger(a)linutronix.de> arm64: dts: broadcom: bcm2712-d-rpi-5-b: update uart10 interrupt Gregor Herburger <gregor.herburger(a)linutronix.de> arm64: dts: broadcom: bcm2712-d-rpi-5-b: add fixes for pinctrl/pinctrl_aon Luigi Leonardi <leonardi(a)redhat.com> vsock/virtio: fix MSG_PEEK ignoring skb offset when calculating bytes to copy Krishna Chomal <krishna.chomal108(a)gmail.com> platform/x86: hp-wmi: Ignore backlight and FnLock events Johan Hovold <johan(a)kernel.org> spi: aspeed-smc: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: amlogic-spisg: fix controller deregistration Wang Jun <1742789905(a)qq.com> media: saa7164: add ioremap return checks and cleanups Johan Hovold <johan(a)kernel.org> spi: at91-usart: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: qup: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: meson-spicc: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: lantiq-ssc: fix controller deregistration Johan Hovold <johan(a)kernel.org> regulator: bd9571mwv: fix OF node reference imbalance Johan Hovold <johan(a)kernel.org> regulator: s2dos05: fix OF node reference imbalance Johan Hovold <johan(a)kernel.org> regulator: act8945a: fix OF node reference imbalance Jai Luthra <jai.luthra(a)ideasonboard.com> media: i2c: imx283: Fix hang when going from large to small resolution Ethan Tidmore <ethantidmore06(a)gmail.com> media: intel/ipu6: fix error pointer dereference Janne Grunau <j(a)jannau.net> media: videobuf2: Set vma_flags in vb2_dma_sg_mmap Johan Hovold <johan(a)kernel.org> regulator: rk808: fix OF node reference imbalance Johan Hovold <johan(a)kernel.org> regulator: bq257xx: fix OF node reference imbalance Jai Luthra <jai.luthra(a)ideasonboard.com> media: i2c: imx283: Enter full standby when stopping streaming Oliver Neukum <oneukum(a)suse.com> media: rc: streamzap: Error handling in probe Oliver Neukum <oneukum(a)suse.com> media: rc: xbox_remote: heed DMA restrictions Johan Hovold <johan(a)kernel.org> regulator: max77650: fix OF node reference imbalance Johan Hovold <johan(a)kernel.org> spi: st-ssc4: fix controller deregistration Johan Hovold <johan(a)kernel.org> regulator: mt6357: fix OF node reference imbalance Sakari Ailus <sakari.ailus(a)linux.intel.com> staging: media: atomisp: Disallow all private IOCTLs Josua Mayer <josua(a)solid-run.com> arm64: dts: lx2160a-cex7/lx2162a-sr-som: fix usd-cd & gpio pinmux Johan Hovold <johan(a)kernel.org> spi: atmel: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: bcm63xx: fix controller deregistration Matthew Brost <matthew.brost(a)intel.com> drm/gpusvm: Force unmapping on error in drm_gpusvm_get_pages Ziyi Guo <n7l8m4(a)u.northwestern.edu> media: chips-media: wave5: add missing spinlock protection for handle_dynamic_resolution_change() Ziyi Guo <n7l8m4(a)u.northwestern.edu> media: chips-media: wave5: add missing spinlock protection for send_eos_event() Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> media: chips-media: wave5: fix a potential memory leak in wave5_vdi_init() Cristian Ciocaltea <cristian.ciocaltea(a)collabora.com> media: dt-bindings: rockchip,vdec: Mark reg-names required for RK35{76,88} Cristian Ciocaltea <cristian.ciocaltea(a)collabora.com> media: dt-bindings: rockchip,vdec: Add alternative reg-names order for RK35{76,88} Alexander Koskovich <akoskovich(a)pm.me> media: i2c: ov8856: free control handler on error in ov8856_init_controls() Tomi Valkeinen <tomi.valkeinen+renesas(a)ideasonboard.com> media: renesas: vin: Fix RAW8 (again) Tomi Valkeinen <tomi.valkeinen+renesas(a)ideasonboard.com> media: renesas: vsp1: Fix NULL pointer deref on module unload Guoniu Zhou <guoniu.zhou(a)nxp.com> media: nxp: imx8-isi: Reduce minimum queued buffers from 2 to 0 Krzysztof Kozlowski <krzysztof.kozlowski(a)oss.qualcomm.com> drm/msm/hdmi: Fix wrong CTRL1 register used in writing info frames Ricardo Ribalda <ribalda(a)chromium.org> media: uvcvideo: Enable VB2_DMABUF for metadata stream Tomasz Pakuła <tomasz.pakula.oficjalny(a)gmail.com> HID: pidff: Fix integer overflow in pidff_rescale Benjamin Tissoires <bentiss(a)kernel.org> HID: core: introduce hid_safe_input_report() Benjamin Tissoires <bentiss(a)kernel.org> HID: pass the buffer size to hid_report_raw_event Sangyun Kim <sangyun.kim(a)snu.ac.kr> HID: appletb-kbd: run inactivity autodim from workqueues Sangyun Kim <sangyun.kim(a)snu.ac.kr> HID: appletb-kbd: fix UAF in inactivity-timer cleanup path T.J. Mercier <tjmercier(a)google.com> HID: playstation: Clamp num_touch_reports ------------- Diffstat: .../devicetree/bindings/media/rockchip,vdec.yaml | 22 +- Makefile | 4 +- arch/arm64/boot/dts/broadcom/bcm2712-d-rpi-5-b.dts | 14 + .../arm64/boot/dts/freescale/fsl-lx2160a-cex7.dtsi | 7 + .../dts/freescale/fsl-lx2160a-clearfog-itx.dtsi | 2 + arch/arm64/boot/dts/freescale/fsl-lx2160a.dtsi | 24 ++ .../boot/dts/freescale/fsl-lx2162a-clearfog.dts | 2 + .../boot/dts/freescale/fsl-lx2162a-sr-som.dtsi | 7 + arch/arm64/boot/dts/qcom/lemans.dtsi | 8 +- arch/arm64/boot/dts/ti/k3-am62a7-sk.dts | 2 +- arch/loongarch/Kbuild | 2 +- arch/loongarch/include/asm/asm-prototypes.h | 20 + arch/loongarch/include/asm/kvm_host.h | 3 - arch/loongarch/kvm/Makefile | 3 +- arch/loongarch/kvm/main.c | 35 +- arch/loongarch/kvm/switch.S | 20 +- arch/powerpc/platforms/pseries/papr-hvpipe.c | 59 +-- block/blk-zoned.c | 149 +++----- drivers/edac/versalnet_edac.c | 3 +- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 3 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c | 13 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c | 6 + drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h | 11 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c | 3 + drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 9 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h | 2 + drivers/gpu/drm/amd/amdgpu/amdgpu_vm_cpu.c | 12 +- drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 31 +- drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 3 - drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c | 4 +- drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c | 25 +- drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c | 46 ++- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 33 +- .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 6 +- drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 10 +- drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 4 +- drivers/gpu/drm/amd/amdkfd/kfd_topology.c | 11 + drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 2 +- .../gpu/drm/amd/pm/powerplay/smumgr/ci_smumgr.c | 13 +- .../gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c | 10 +- drivers/gpu/drm/bridge/tda998x_drv.c | 2 +- drivers/gpu/drm/drm_gem.c | 25 +- drivers/gpu/drm/drm_gem_framebuffer_helper.c | 4 +- drivers/gpu/drm/drm_gpusvm.c | 1 + drivers/gpu/drm/exynos/exynos_drm_mic.c | 8 +- drivers/gpu/drm/i915/display/intel_psr.c | 2 +- drivers/gpu/drm/imx/ipuv3/parallel-display.c | 15 +- drivers/gpu/drm/msm/hdmi/hdmi_bridge.c | 4 +- drivers/gpu/drm/msm/msm_drv.c | 7 +- drivers/gpu/drm/msm/msm_gpu.c | 42 +-- drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c | 2 + drivers/gpu/drm/panel/panel-himax-hx83102.c | 2 + drivers/gpu/drm/radeon/ci_dpm.c | 9 +- drivers/gpu/drm/tiny/appletbdrm.c | 4 +- drivers/gpu/drm/udl/udl_main.c | 3 +- drivers/gpu/drm/udl/udl_modeset.c | 5 +- drivers/gpu/drm/xe/xe_bo.c | 8 +- drivers/gpu/drm/xe/xe_dma_buf.c | 23 +- drivers/gpu/drm/xe/xe_vm_madvise.c | 47 +++ drivers/hid/bpf/hid_bpf_dispatch.c | 6 +- drivers/hid/hid-appletb-kbd.c | 58 +-- drivers/hid/hid-core.c | 67 +++- drivers/hid/hid-gfrm.c | 4 +- drivers/hid/hid-logitech-hidpp.c | 2 +- drivers/hid/hid-multitouch.c | 2 +- drivers/hid/hid-playstation.c | 6 +- drivers/hid/hid-primax.c | 2 +- drivers/hid/hid-vivaldi-common.c | 2 +- drivers/hid/i2c-hid/i2c-hid-core.c | 7 +- drivers/hid/usbhid/hid-core.c | 11 +- drivers/hid/usbhid/hid-pidff.c | 7 +- drivers/hid/wacom_sys.c | 6 +- drivers/media/common/videobuf2/videobuf2-dma-sg.c | 1 + drivers/media/dvb-frontends/dib8000.c | 4 +- drivers/media/i2c/imx283.c | 15 +- drivers/media/i2c/imx412.c | 2 +- drivers/media/i2c/ov08d10.c | 21 +- drivers/media/i2c/ov8856.c | 10 +- drivers/media/pci/intel/ipu6/ipu6.c | 2 +- drivers/media/pci/saa7164/saa7164-core.c | 47 ++- drivers/media/pci/zoran/zoran_card.c | 2 +- .../media/platform/chips-media/wave5/wave5-vdi.c | 1 + .../platform/chips-media/wave5/wave5-vpu-dec.c | 14 +- .../media/platform/nxp/imx8-isi/imx8-isi-video.c | 2 +- .../media/platform/qcom/camss/camss-csid-gen3.c | 6 +- drivers/media/platform/qcom/camss/camss.c | 80 ++-- drivers/media/platform/qcom/iris/Kconfig | 2 +- drivers/media/platform/qcom/iris/iris_buffer.c | 8 +- drivers/media/platform/qcom/iris/iris_hfi_queue.c | 2 +- drivers/media/platform/qcom/iris/iris_vpu_buffer.h | 2 +- drivers/media/platform/qcom/venus/Kconfig | 2 +- drivers/media/platform/renesas/rcar-vin/rcar-dma.c | 22 ++ .../media/platform/renesas/rcar-vin/rcar-v4l2.c | 12 + drivers/media/platform/renesas/vsp1/vsp1_drv.c | 8 +- drivers/media/platform/ti/omap3isp/ispvideo.c | 1 + drivers/media/rc/streamzap.c | 12 +- drivers/media/rc/xbox_remote.c | 9 +- drivers/media/usb/uvc/uvc_queue.c | 3 +- drivers/platform/x86/hp/hp-wmi.c | 5 + drivers/regulator/act8945a-regulator.c | 3 +- drivers/regulator/bd9571mwv-regulator.c | 3 +- drivers/regulator/bq257xx-regulator.c | 3 +- drivers/regulator/max77650-regulator.c | 2 +- drivers/regulator/mt6357-regulator.c | 2 +- drivers/regulator/rk808-regulator.c | 3 +- drivers/regulator/s2dos05-regulator.c | 2 +- drivers/spi/spi-amlogic-spisg.c | 4 +- drivers/spi/spi-aspeed-smc.c | 9 +- drivers/spi/spi-at91-usart.c | 8 +- drivers/spi/spi-atmel.c | 8 +- drivers/spi/spi-bcm63xx.c | 8 +- drivers/spi/spi-bcmbca-hsspi.c | 4 +- drivers/spi/spi-cadence.c | 21 +- drivers/spi/spi-cavium-thunderx.c | 8 +- drivers/spi/spi-ch341.c | 7 +- drivers/spi/spi-coldfire-qspi.c | 10 +- drivers/spi/spi-dln2.c | 8 +- drivers/spi/spi-fsl-espi.c | 10 +- drivers/spi/spi-fsl-spi.c | 14 +- drivers/spi/spi-img-spfi.c | 8 +- drivers/spi/spi-imx.c | 1 + drivers/spi/spi-lantiq-ssc.c | 8 +- drivers/spi/spi-meson-spicc.c | 8 +- drivers/spi/spi-mpc52xx.c | 9 +- drivers/spi/spi-mpfs.c | 4 +- drivers/spi/spi-mt65xx.c | 4 +- drivers/spi/spi-mtk-nor.c | 4 +- drivers/spi/spi-mxic.c | 3 +- drivers/spi/spi-mxs.c | 8 +- drivers/spi/spi-npcm-pspi.c | 8 +- drivers/spi/spi-omap2-mcspi.c | 8 +- drivers/spi/spi-orion.c | 16 +- drivers/spi/spi-pic32-sqi.c | 8 +- drivers/spi/spi-pic32.c | 11 +- drivers/spi/spi-pl022.c | 8 +- drivers/spi/spi-qup.c | 8 +- drivers/spi/spi-rspi.c | 10 +- drivers/spi/spi-s3c64xx.c | 4 +- drivers/spi/spi-sh-hspi.c | 10 +- drivers/spi/spi-sh-msiof.c | 10 +- drivers/spi/spi-slave-mt27xx.c | 10 +- drivers/spi/spi-sprd.c | 8 +- drivers/spi/spi-st-ssc4.c | 8 +- drivers/spi/spi-tegra114.c | 8 +- drivers/spi/spi-tegra20-sflash.c | 8 +- drivers/spi/spi-uniphier.c | 24 +- drivers/spi/spi-zynq-qspi.c | 55 +-- drivers/staging/greybus/hid.c | 2 +- drivers/staging/media/atomisp/pci/atomisp_ioctl.c | 4 + drivers/staging/media/imx/imx-media-csi.c | 40 +- drivers/usb/dwc3/core.c | 204 +++++----- drivers/usb/dwc3/core.h | 10 +- drivers/usb/dwc3/debugfs.c | 44 +-- drivers/usb/dwc3/drd.c | 76 ++-- drivers/usb/dwc3/ep0.c | 20 +- drivers/usb/dwc3/gadget.c | 162 ++++---- drivers/usb/dwc3/gadget.h | 4 +- drivers/usb/dwc3/io.h | 7 +- drivers/usb/dwc3/ulpi.c | 10 +- drivers/usb/typec/tcpm/tcpm.c | 2 + drivers/video/fbdev/core/bitblit.c | 120 +++--- drivers/video/fbdev/core/fbcon.c | 419 ++++++++++----------- drivers/video/fbdev/core/fbcon.h | 6 +- drivers/video/fbdev/core/fbcon_ccw.c | 146 +++---- drivers/video/fbdev/core/fbcon_cw.c | 146 +++---- drivers/video/fbdev/core/fbcon_rotate.c | 43 ++- drivers/video/fbdev/core/fbcon_rotate.h | 6 +- drivers/video/fbdev/core/fbcon_ud.c | 162 ++++---- drivers/video/fbdev/core/softcursor.c | 18 +- drivers/video/fbdev/core/tileblit.c | 28 +- fs/btrfs/ioctl.c | 5 +- fs/btrfs/space-info.c | 8 +- fs/btrfs/sysfs.c | 5 +- fs/btrfs/sysfs.h | 3 +- include/linux/damon.h | 1 + include/linux/fprobe.h | 3 +- include/linux/hid.h | 6 +- include/linux/hid_bpf.h | 14 +- include/linux/sched/ext.h | 1 + io_uring/zcrx.c | 17 +- kernel/sched/ext.c | 26 +- kernel/sched/ext_internal.h | 13 +- kernel/trace/fprobe.c | 380 +++++++++++++------ mm/damon/core.c | 25 +- mm/damon/lru_sort.c | 83 ++-- mm/damon/reclaim.c | 83 ++-- net/batman-adv/bat_iv_ogm.c | 85 +++-- net/batman-adv/bridge_loop_avoidance.c | 11 +- net/batman-adv/main.c | 1 + net/batman-adv/tp_meter.c | 116 +++++- net/batman-adv/tp_meter.h | 1 + net/batman-adv/types.h | 4 + net/bluetooth/hci_conn.c | 19 +- net/sctp/socket.c | 9 + net/vmw_vsock/af_vsock.c | 6 +- net/vmw_vsock/virtio_transport_common.c | 57 ++- 196 files changed, 2699 insertions(+), 1709 deletions(-)

1 hour, 37 minutes

11
11
0 0

[PATCH 6.18 000/187] 6.18.32-rc2 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.18.32 release. There are 187 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Mon, 18 May 2026 10:22:18 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.32-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.18.32-rc2 Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vcn4: Avoid overflow on msg bound check Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vcn3: Avoid overflow on msg bound check Dudu Lu <phx0fer(a)gmail.com> vsock/virtio: fix accept queue count leak on transport mismatch Eric Dumazet <edumazet(a)google.com> vsock/virtio: fix potential unbounded skb queue Stefano Garzarella <sgarzare(a)redhat.com> vsock/virtio: fix empty payload in tap skb for non-linear buffers Stefano Garzarella <sgarzare(a)redhat.com> vsock/virtio: fix length and offset in tap skb for split packets Norbert Szetei <norbert(a)doyensec.com> vsock: fix buffer size clamping order Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: fix tp_num leak on kmalloc failure Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/fprobe: Remove fprobe from hash in failure path Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/fprobe: Unregister fprobe even if memory allocation fails Menglong Dong <menglong8.dong(a)gmail.com> tracing: fprobe: optimization for entry only case Menglong Dong <menglong8.dong(a)gmail.com> tracing: fprobe: use rhltable for fprobe_ip_table Yochai Eisenrich <yochaie(a)sweet.security> btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak Guangshuo Li <lgs201920130244(a)gmail.com> btrfs: fix double free in create_space_info_sub_group() error path Filipe Manana <fdmanana(a)suse.com> btrfs: remove fs_info argument from btrfs_sysfs_add_space_info_type() Selvarasu Ganesan <selvarasu.g(a)samsung.com> usb: dwc3: Move GUID programming after PHY initialization Prashanth K <prashanth.k(a)oss.qualcomm.com> usb: dwc3: Add dwc pointer to dwc3_readl/writel Prashanth K <prashanth.k(a)oss.qualcomm.com> usb: dwc3: Remove of dep->regs Tejun Heo <tj(a)kernel.org> sched_ext: Read scx_root under scx_cgroup_ops_rwsem in cgroup setters zhidao su <suzhidao(a)xiaomi.com> sched/ext: Implement cgroup_set_idle() callback David Carlier <devnexen(a)gmail.com> Bluetooth: hci_conn: fix potential UAF in create_big_sync Johan Hovold <johan(a)kernel.org> spi: zynq-qspi: fix controller deregistration Pei Xiao <xiaopei01(a)kylinos.cn> spi: zynq-qspi: Simplify clock handling with devm_clk_get_enabled() Johan Hovold <johan(a)kernel.org> spi: tegra114: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: tegra20-sflash: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: uniphier: fix controller deregistration Pei Xiao <xiaopei01(a)kylinos.cn> spi: uniphier: Simplify clock handling with devm_clk_get_enabled() Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> pseries/papr-hvpipe: Fix race with interrupt handler Christian Brauner <brauner(a)kernel.org> papr-hvpipe: convert papr_hvpipe_dev_create_handle() to FD_PREPARE() Prasanna Kumar T S M <ptsm(a)linux.microsoft.com> EDAC/versalnet: Fix device name memory leak Damien Le Moal <dlemoal(a)kernel.org> block: fix zone write plug removal Thomas Zimmermann <tzimmermann(a)suse.de> fbcon: Avoid OOB font access if console rotation fails Thomas Zimmermann <tzimmermann(a)suse.de> fbcon: Rename struct fbcon_ops to struct fbcon_par Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu: rework how we handle TLB fences Prike Liang <Prike.Liang(a)amd.com> Revert "drm/amdgpu: don't attach the tlb fence for SI" Timur Kristóf <timur.kristof(a)gmail.com> drm/amdgpu: Fix validating flush_gpu_tlb_pasid() Prike Liang <Prike.Liang(a)amd.com> drm/amdgpu: validate the flush_gpu_tlb_pasid() SeongJae Park <sj(a)kernel.org> mm/damon/core: disallow time-quota setting zero esz Amit Sunil Dhamne <amitsd(a)google.com> usb: typec: tcpm: reset internal port states on soft reset AMS SeongJae Park <sj(a)kernel.org> mm/damon/reclaim: detect and use fresh enabled and kdamond_pid values SeongJae Park <sj(a)kernel.org> mm/damon/lru_sort: detect and use fresh enabled and kdamond_pid values SeongJae Park <sj(a)kernel.org> mm/damon/core: implement damon_kdamond_pid() Xianglai Li <lixianglai(a)loongson.cn> LoongArch: KVM: Compile switch.S directly into the kernel Pavel Begunkov <asml.silence(a)gmail.com> io_uring/zcrx: warn on freelist violations Pavel Begunkov <asml.silence(a)gmail.com> io_uring/zcrx: use guards for locking Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: put backbone reference on failed claim hash insert Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: only purge non-released claims Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: prevent use-after-free when deleting claims Jiexun Wang <wangjiexun2025(a)gmail.com> batman-adv: stop caching unowned originator pointers in BAT IV Jiexun Wang <wangjiexun2025(a)gmail.com> batman-adv: stop tp_meter sessions during mesh teardown Jiexun Wang <wangjiexun2025(a)gmail.com> batman-adv: reject new tp_meter sessions during teardown Lyes Bourennani <lbourennani(a)fuzzinglabs.com> batman-adv: fix integer overflow on buff_pos Ben Morris <bmorris(a)anthropic.com> sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL Siddharth Vadapalli <s-vadapalli(a)ti.com> arm64: dts: ti: k3-am62a7-sk: Fix pin name in comment from M19 to N22 Viken Dadhaniya <viken.dadhaniya(a)oss.qualcomm.com> arm64: dts: qcom: lemans: Correct QUP interrupt numbers Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/pm: align Hawaii mclk workaround with radeon Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/pm: add missing revision check for CI John B. Moore <jbmoore61(a)gmail.com> drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission Felix Kuehling <felix.kuehling(a)amd.com> drm/amdkfd: Make all TLB-flushes heavy-weight Icenowy Zheng <zhengxingda(a)iscas.ac.cn> drm/panel: boe-tv101wum-nl6: restore MODE_LPM after sending disable cmds Kory Maincent (TI) <kory.maincent(a)bootlin.com> drm/bridge: tda998x: Use __be32 for audio port OF property pointer John B. Moore <jbmoore61(a)gmail.com> drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ Icenowy Zheng <zhengxingda(a)iscas.ac.cn> drm/panel: himax-hx83102: restore MODE_LPM after sending disable cmds Osama Abdelkader <osama.abdelkader(a)gmail.com> drm/exynos: remove bridge when component_add fails Philip Yang <Philip.Yang(a)amd.com> drm/amdgpu: zero-initialize GART table on allocation Alex Deucher <alexander.deucher(a)amd.com> drm/radeon: add missing revision check for CI Francis, David <David.Francis(a)amd.com> drm: Set old handle to NULL before prime swap in change_handle Jia Yao <jia.yao(a)intel.com> drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise Shuicheng Lin <shuicheng.lin(a)intel.com> drm/xe/bo: Fix bo leak on unaligned size validation in xe_bo_init_locked() Shuicheng Lin <shuicheng.lin(a)intel.com> drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() Shuicheng Lin <shuicheng.lin(a)intel.com> drm/xe/bo: Fix bo leak on GGTT flag validation in xe_bo_init_locked() Shuicheng Lin <shuicheng.lin(a)intel.com> drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure Shixiong Ou <oushixiong(a)kylinos.cn> drm/udl: Increase GET_URB_TIMEOUT Alysa Liu <Alysa.Liu(a)amd.com> drm/amdkfd: validate SVM ioctl nattr against buffer size Sasha Finkelstein <k(a)chaosmail.tech> drm/appletbdrm: Use kvzalloc for big allocations Ashutosh Desai <ashutoshdesai993(a)gmail.com> drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() Mario Kleiner <mario.kleiner.de(a)gmail.com> drm/amd/display: Change dither policy for 10 bpc output back to dithering Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vce: Prevent partial address patches Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vcn4: Prevent OOB reads when parsing IB Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu: Add bounds checking to ib_{get,set}_value Alysa Liu <Alysa.Liu(a)amd.com> drm/amdkfd: Add upper bound check for num_of_nodes Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: fix incorrect FeatureCtrlMask setting on smu v14.0.x Chenglei Xie <Chenglei.Xie(a)amd.com> drm/amdgpu: gate VM CPU HDP flush on reset lock Ramalingeswara Reddy, Kanala <Kanala.RamalingeswaraReddy(a)amd.com> drm/amdgpu: Use SMUIO 15.0.0 offsets for TSC upper and lower count. Amir Shetaia <Amir.Shetaia(a)amd.com> drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Init variable to avoid early exit from et alignment loop Anna Maniscalco <anna.maniscalco2000(a)gmail.com> drm/msm: always recover the gpu Marek Vasut <marex(a)nabladev.com> drm/imx: parallel-display: Prefer bus format set via legacy "interface-pix-fmt" DT property Yasuaki Torimaru <yasuakitorimaru(a)gmail.com> drm/msm/gem: fix error handling in msm_ioctl_gem_info_get_metadata() Johan Hovold <johan(a)kernel.org> spi: cadence: fix clock imbalance on probe failure Johan Hovold <johan(a)kernel.org> spi: cadence: fix unclocked access on unbind Johan Hovold <johan(a)kernel.org> spi: cadence: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: mpc52xx: fix use-after-free on unbind Johan Hovold <johan(a)kernel.org> spi: mpc52xx: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: mpc52xx: fix use-after-free on registration failure Johan Hovold <johan(a)kernel.org> spi: orion: fix clock imbalance on registration failure Johan Hovold <johan(a)kernel.org> spi: orion: fix runtime pm leak on unbind Johan Hovold <johan(a)kernel.org> spi: orion: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: mxic: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: imx: fix runtime pm leak on probe deferral Johan Hovold <johan(a)kernel.org> spi: mpfs: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: img-spfi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: slave-mt27xx: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sh-msiof: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: rspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sprd: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: pic32-sqi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: cavium-thunderx: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: npcm-pspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: coldfire-qspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: bcmbca-hsspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: fsl: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sh-hspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: ch341: fix devres lifetime Johan Hovold <johan(a)kernel.org> spi: pl022: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: mtk-nor: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: pic32: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: omap2-mcspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: fsl-espi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: s3c64xx: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: dln2: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: mt65xx: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: mxs: fix controller deregistration Wenmeng Liu <wenmeng.liu(a)oss.qualcomm.com> media: qcom: camss: Add missing clocks for VFE lite on sa8775p Thomas Fourier <fourier.thomas(a)gmail.com> media: iris: Fix dma_free_attrs() size in iris_hfi_queues_init() Arnd Bergmann <arnd(a)arndb.de> media: venus: fix QCOM_MDT_LOADER dependency Dmitry Baryshkov <dmitry.baryshkov(a)oss.qualcomm.com> media: qcom: iris: increase H265D_MAX_SLICE to fix H.265 decoding on SC7280 Wenmeng Liu <wenmeng.liu(a)oss.qualcomm.com> media: qcom: camss: Fix csid IRQ offset for sa8775p Wenmeng Liu <wenmeng.liu(a)oss.qualcomm.com> media: qcom: camss: Fix csid clock configuration for sa8775p Dikshita Agarwal <dikshita.agarwal(a)oss.qualcomm.com> media: iris: Fix use-after-free in iris_release_internal_buffers() Arnd Bergmann <arnd(a)arndb.de> media: iris: fix QCOM_MDT_LOADER dependency Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> media: omap3isp: drop the use count of v4l2 pipeline Matthias Fend <matthias.fend(a)emfend.at> media: i2c: ov08d10: fix runtime PM handling in probe Matthias Fend <matthias.fend(a)emfend.at> media: i2c: ov08d10: fix image vertical start setting Michael Tretter <m.tretter(a)pengutronix.de> media: staging: imx: request mbus_config in csi_start Wenmeng Liu <wenmeng.liu(a)oss.qualcomm.com> media: i2c: imx412: Assert reset GPIO during probe Sergey Shtylyov <s.shtylyov(a)auroraos.dev> media: dib8000: avoid division by 0 in dib8000_set_dds() Abdun Nihaal <nihaal(a)cse.iitm.ac.in> media: pci: zoran: fix potential memory leak in zoran_probe() Gregor Herburger <gregor.herburger(a)linutronix.de> arm64: dts: broadcom: bcm2712-d-rpi-5-b: update uart10 interrupt Gregor Herburger <gregor.herburger(a)linutronix.de> arm64: dts: broadcom: bcm2712-d-rpi-5-b: add fixes for pinctrl/pinctrl_aon Luigi Leonardi <leonardi(a)redhat.com> vsock/virtio: fix MSG_PEEK ignoring skb offset when calculating bytes to copy Krishna Chomal <krishna.chomal108(a)gmail.com> platform/x86: hp-wmi: Ignore backlight and FnLock events Johan Hovold <johan(a)kernel.org> spi: aspeed-smc: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: amlogic-spisg: fix controller deregistration Wang Jun <1742789905(a)qq.com> media: saa7164: add ioremap return checks and cleanups Johan Hovold <johan(a)kernel.org> spi: at91-usart: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: qup: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: meson-spicc: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: lantiq-ssc: fix controller deregistration Johan Hovold <johan(a)kernel.org> regulator: bd9571mwv: fix OF node reference imbalance Johan Hovold <johan(a)kernel.org> regulator: s2dos05: fix OF node reference imbalance Johan Hovold <johan(a)kernel.org> regulator: act8945a: fix OF node reference imbalance Jai Luthra <jai.luthra(a)ideasonboard.com> media: i2c: imx283: Fix hang when going from large to small resolution Ethan Tidmore <ethantidmore06(a)gmail.com> media: intel/ipu6: fix error pointer dereference Janne Grunau <j(a)jannau.net> media: videobuf2: Set vma_flags in vb2_dma_sg_mmap Johan Hovold <johan(a)kernel.org> regulator: rk808: fix OF node reference imbalance Johan Hovold <johan(a)kernel.org> regulator: bq257xx: fix OF node reference imbalance Jai Luthra <jai.luthra(a)ideasonboard.com> media: i2c: imx283: Enter full standby when stopping streaming Oliver Neukum <oneukum(a)suse.com> media: rc: streamzap: Error handling in probe Oliver Neukum <oneukum(a)suse.com> media: rc: xbox_remote: heed DMA restrictions Johan Hovold <johan(a)kernel.org> regulator: max77650: fix OF node reference imbalance Johan Hovold <johan(a)kernel.org> spi: st-ssc4: fix controller deregistration Johan Hovold <johan(a)kernel.org> regulator: mt6357: fix OF node reference imbalance Sakari Ailus <sakari.ailus(a)linux.intel.com> staging: media: atomisp: Disallow all private IOCTLs Josua Mayer <josua(a)solid-run.com> arm64: dts: lx2160a-cex7/lx2162a-sr-som: fix usd-cd & gpio pinmux Johan Hovold <johan(a)kernel.org> spi: atmel: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: bcm63xx: fix controller deregistration Matthew Brost <matthew.brost(a)intel.com> drm/gpusvm: Force unmapping on error in drm_gpusvm_get_pages Ziyi Guo <n7l8m4(a)u.northwestern.edu> media: chips-media: wave5: add missing spinlock protection for handle_dynamic_resolution_change() Ziyi Guo <n7l8m4(a)u.northwestern.edu> media: chips-media: wave5: add missing spinlock protection for send_eos_event() Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> media: chips-media: wave5: fix a potential memory leak in wave5_vdi_init() Cristian Ciocaltea <cristian.ciocaltea(a)collabora.com> media: dt-bindings: rockchip,vdec: Mark reg-names required for RK35{76,88} Cristian Ciocaltea <cristian.ciocaltea(a)collabora.com> media: dt-bindings: rockchip,vdec: Add alternative reg-names order for RK35{76,88} Alexander Koskovich <akoskovich(a)pm.me> media: i2c: ov8856: free control handler on error in ov8856_init_controls() Tomi Valkeinen <tomi.valkeinen+renesas(a)ideasonboard.com> media: renesas: vin: Fix RAW8 (again) Tomi Valkeinen <tomi.valkeinen+renesas(a)ideasonboard.com> media: renesas: vsp1: Fix NULL pointer deref on module unload Guoniu Zhou <guoniu.zhou(a)nxp.com> media: nxp: imx8-isi: Reduce minimum queued buffers from 2 to 0 Krzysztof Kozlowski <krzysztof.kozlowski(a)oss.qualcomm.com> drm/msm/hdmi: Fix wrong CTRL1 register used in writing info frames Ricardo Ribalda <ribalda(a)chromium.org> media: uvcvideo: Enable VB2_DMABUF for metadata stream Tomasz Pakuła <tomasz.pakula.oficjalny(a)gmail.com> HID: pidff: Fix integer overflow in pidff_rescale Benjamin Tissoires <bentiss(a)kernel.org> HID: core: introduce hid_safe_input_report() Benjamin Tissoires <bentiss(a)kernel.org> HID: pass the buffer size to hid_report_raw_event Sangyun Kim <sangyun.kim(a)snu.ac.kr> HID: appletb-kbd: run inactivity autodim from workqueues Sangyun Kim <sangyun.kim(a)snu.ac.kr> HID: appletb-kbd: fix UAF in inactivity-timer cleanup path T.J. Mercier <tjmercier(a)google.com> HID: playstation: Clamp num_touch_reports ------------- Diffstat: .../devicetree/bindings/media/rockchip,vdec.yaml | 22 +- Makefile | 4 +- arch/arm64/boot/dts/broadcom/bcm2712-d-rpi-5-b.dts | 14 + .../arm64/boot/dts/freescale/fsl-lx2160a-cex7.dtsi | 7 + .../dts/freescale/fsl-lx2160a-clearfog-itx.dtsi | 2 + arch/arm64/boot/dts/freescale/fsl-lx2160a.dtsi | 24 ++ .../boot/dts/freescale/fsl-lx2162a-clearfog.dts | 2 + .../boot/dts/freescale/fsl-lx2162a-sr-som.dtsi | 7 + arch/arm64/boot/dts/qcom/lemans.dtsi | 8 +- arch/arm64/boot/dts/ti/k3-am62a7-sk.dts | 2 +- arch/loongarch/Kbuild | 2 +- arch/loongarch/include/asm/asm-prototypes.h | 20 + arch/loongarch/include/asm/kvm_host.h | 3 - arch/loongarch/kvm/Makefile | 3 +- arch/loongarch/kvm/main.c | 35 +- arch/loongarch/kvm/switch.S | 20 +- arch/powerpc/platforms/pseries/papr-hvpipe.c | 59 +-- block/blk-zoned.c | 149 +++----- drivers/edac/versalnet_edac.c | 3 +- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 3 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c | 13 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c | 6 + drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h | 11 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c | 3 + drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 9 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h | 2 + drivers/gpu/drm/amd/amdgpu/amdgpu_vm_cpu.c | 12 +- drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 31 +- drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 3 - drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c | 4 +- drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c | 25 +- drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c | 46 ++- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 33 +- .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 6 +- drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 10 +- drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 4 +- drivers/gpu/drm/amd/amdkfd/kfd_topology.c | 11 + drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 2 +- .../gpu/drm/amd/pm/powerplay/smumgr/ci_smumgr.c | 13 +- .../gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c | 10 +- drivers/gpu/drm/bridge/tda998x_drv.c | 2 +- drivers/gpu/drm/drm_gem.c | 25 +- drivers/gpu/drm/drm_gem_framebuffer_helper.c | 4 +- drivers/gpu/drm/drm_gpusvm.c | 1 + drivers/gpu/drm/exynos/exynos_drm_mic.c | 8 +- drivers/gpu/drm/i915/display/intel_psr.c | 2 +- drivers/gpu/drm/imx/ipuv3/parallel-display.c | 15 +- drivers/gpu/drm/msm/hdmi/hdmi_bridge.c | 4 +- drivers/gpu/drm/msm/msm_drv.c | 7 +- drivers/gpu/drm/msm/msm_gpu.c | 42 +-- drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c | 2 + drivers/gpu/drm/panel/panel-himax-hx83102.c | 2 + drivers/gpu/drm/radeon/ci_dpm.c | 9 +- drivers/gpu/drm/tiny/appletbdrm.c | 4 +- drivers/gpu/drm/udl/udl_main.c | 3 +- drivers/gpu/drm/udl/udl_modeset.c | 5 +- drivers/gpu/drm/xe/xe_bo.c | 8 +- drivers/gpu/drm/xe/xe_dma_buf.c | 23 +- drivers/gpu/drm/xe/xe_vm_madvise.c | 47 +++ drivers/hid/bpf/hid_bpf_dispatch.c | 6 +- drivers/hid/hid-appletb-kbd.c | 58 +-- drivers/hid/hid-core.c | 67 +++- drivers/hid/hid-gfrm.c | 4 +- drivers/hid/hid-logitech-hidpp.c | 2 +- drivers/hid/hid-multitouch.c | 2 +- drivers/hid/hid-playstation.c | 6 +- drivers/hid/hid-primax.c | 2 +- drivers/hid/hid-vivaldi-common.c | 2 +- drivers/hid/i2c-hid/i2c-hid-core.c | 7 +- drivers/hid/usbhid/hid-core.c | 11 +- drivers/hid/usbhid/hid-pidff.c | 7 +- drivers/hid/wacom_sys.c | 6 +- drivers/media/common/videobuf2/videobuf2-dma-sg.c | 1 + drivers/media/dvb-frontends/dib8000.c | 4 +- drivers/media/i2c/imx283.c | 15 +- drivers/media/i2c/imx412.c | 2 +- drivers/media/i2c/ov08d10.c | 21 +- drivers/media/i2c/ov8856.c | 10 +- drivers/media/pci/intel/ipu6/ipu6.c | 2 +- drivers/media/pci/saa7164/saa7164-core.c | 47 ++- drivers/media/pci/zoran/zoran_card.c | 2 +- .../media/platform/chips-media/wave5/wave5-vdi.c | 1 + .../platform/chips-media/wave5/wave5-vpu-dec.c | 14 +- .../media/platform/nxp/imx8-isi/imx8-isi-video.c | 2 +- .../media/platform/qcom/camss/camss-csid-gen3.c | 6 +- drivers/media/platform/qcom/camss/camss.c | 80 ++-- drivers/media/platform/qcom/iris/Kconfig | 2 +- drivers/media/platform/qcom/iris/iris_buffer.c | 8 +- drivers/media/platform/qcom/iris/iris_hfi_queue.c | 2 +- drivers/media/platform/qcom/iris/iris_vpu_buffer.h | 2 +- drivers/media/platform/qcom/venus/Kconfig | 2 +- drivers/media/platform/renesas/rcar-vin/rcar-dma.c | 22 ++ .../media/platform/renesas/rcar-vin/rcar-v4l2.c | 12 + drivers/media/platform/renesas/vsp1/vsp1_drv.c | 8 +- drivers/media/platform/ti/omap3isp/ispvideo.c | 1 + drivers/media/rc/streamzap.c | 12 +- drivers/media/rc/xbox_remote.c | 9 +- drivers/media/usb/uvc/uvc_queue.c | 3 +- drivers/platform/x86/hp/hp-wmi.c | 5 + drivers/regulator/act8945a-regulator.c | 3 +- drivers/regulator/bd9571mwv-regulator.c | 3 +- drivers/regulator/bq257xx-regulator.c | 3 +- drivers/regulator/max77650-regulator.c | 2 +- drivers/regulator/mt6357-regulator.c | 2 +- drivers/regulator/rk808-regulator.c | 3 +- drivers/regulator/s2dos05-regulator.c | 2 +- drivers/spi/spi-amlogic-spisg.c | 4 +- drivers/spi/spi-aspeed-smc.c | 9 +- drivers/spi/spi-at91-usart.c | 8 +- drivers/spi/spi-atmel.c | 8 +- drivers/spi/spi-bcm63xx.c | 8 +- drivers/spi/spi-bcmbca-hsspi.c | 4 +- drivers/spi/spi-cadence.c | 21 +- drivers/spi/spi-cavium-thunderx.c | 8 +- drivers/spi/spi-ch341.c | 7 +- drivers/spi/spi-coldfire-qspi.c | 10 +- drivers/spi/spi-dln2.c | 8 +- drivers/spi/spi-fsl-espi.c | 10 +- drivers/spi/spi-fsl-spi.c | 14 +- drivers/spi/spi-img-spfi.c | 8 +- drivers/spi/spi-imx.c | 1 + drivers/spi/spi-lantiq-ssc.c | 8 +- drivers/spi/spi-meson-spicc.c | 8 +- drivers/spi/spi-mpc52xx.c | 9 +- drivers/spi/spi-mpfs.c | 4 +- drivers/spi/spi-mt65xx.c | 4 +- drivers/spi/spi-mtk-nor.c | 4 +- drivers/spi/spi-mxic.c | 3 +- drivers/spi/spi-mxs.c | 8 +- drivers/spi/spi-npcm-pspi.c | 8 +- drivers/spi/spi-omap2-mcspi.c | 8 +- drivers/spi/spi-orion.c | 16 +- drivers/spi/spi-pic32-sqi.c | 8 +- drivers/spi/spi-pic32.c | 11 +- drivers/spi/spi-pl022.c | 8 +- drivers/spi/spi-qup.c | 8 +- drivers/spi/spi-rspi.c | 10 +- drivers/spi/spi-s3c64xx.c | 4 +- drivers/spi/spi-sh-hspi.c | 10 +- drivers/spi/spi-sh-msiof.c | 10 +- drivers/spi/spi-slave-mt27xx.c | 10 +- drivers/spi/spi-sprd.c | 8 +- drivers/spi/spi-st-ssc4.c | 8 +- drivers/spi/spi-tegra114.c | 8 +- drivers/spi/spi-tegra20-sflash.c | 8 +- drivers/spi/spi-uniphier.c | 24 +- drivers/spi/spi-zynq-qspi.c | 55 +-- drivers/staging/greybus/hid.c | 2 +- drivers/staging/media/atomisp/pci/atomisp_ioctl.c | 4 + drivers/staging/media/imx/imx-media-csi.c | 40 +- drivers/usb/dwc3/core.c | 204 +++++----- drivers/usb/dwc3/core.h | 10 +- drivers/usb/dwc3/debugfs.c | 44 +-- drivers/usb/dwc3/drd.c | 76 ++-- drivers/usb/dwc3/ep0.c | 20 +- drivers/usb/dwc3/gadget.c | 162 ++++---- drivers/usb/dwc3/gadget.h | 4 +- drivers/usb/dwc3/io.h | 7 +- drivers/usb/dwc3/ulpi.c | 10 +- drivers/usb/typec/tcpm/tcpm.c | 2 + drivers/video/fbdev/core/bitblit.c | 120 +++--- drivers/video/fbdev/core/fbcon.c | 419 ++++++++++----------- drivers/video/fbdev/core/fbcon.h | 6 +- drivers/video/fbdev/core/fbcon_ccw.c | 146 +++---- drivers/video/fbdev/core/fbcon_cw.c | 146 +++---- drivers/video/fbdev/core/fbcon_rotate.c | 43 ++- drivers/video/fbdev/core/fbcon_rotate.h | 6 +- drivers/video/fbdev/core/fbcon_ud.c | 162 ++++---- drivers/video/fbdev/core/softcursor.c | 18 +- drivers/video/fbdev/core/tileblit.c | 28 +- fs/btrfs/ioctl.c | 5 +- fs/btrfs/space-info.c | 8 +- fs/btrfs/sysfs.c | 5 +- fs/btrfs/sysfs.h | 3 +- include/linux/damon.h | 1 + include/linux/fprobe.h | 3 +- include/linux/hid.h | 6 +- include/linux/hid_bpf.h | 14 +- include/linux/sched/ext.h | 1 + io_uring/zcrx.c | 17 +- kernel/sched/ext.c | 23 +- kernel/sched/ext_internal.h | 13 +- kernel/trace/fprobe.c | 380 +++++++++++++------ mm/damon/core.c | 25 +- mm/damon/lru_sort.c | 83 ++-- mm/damon/reclaim.c | 83 ++-- net/batman-adv/bat_iv_ogm.c | 85 +++-- net/batman-adv/bridge_loop_avoidance.c | 11 +- net/batman-adv/main.c | 1 + net/batman-adv/tp_meter.c | 116 +++++- net/batman-adv/tp_meter.h | 1 + net/batman-adv/types.h | 4 + net/bluetooth/hci_conn.c | 19 +- net/sctp/socket.c | 9 + net/vmw_vsock/af_vsock.c | 6 +- net/vmw_vsock/virtio_transport_common.c | 57 ++- 196 files changed, 2698 insertions(+), 1707 deletions(-)

1 day, 2 hours

7
6
0 0

[PATCH 6.12 000/143] 6.12.90-rc2 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.12.90 release. There are 143 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Mon, 18 May 2026 10:21:56 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.90-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.12.90-rc2 Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vcn4: Avoid overflow on msg bound check Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vcn3: Avoid overflow on msg bound check Dudu Lu <phx0fer(a)gmail.com> vsock/virtio: fix accept queue count leak on transport mismatch Eric Dumazet <edumazet(a)google.com> vsock/virtio: fix potential unbounded skb queue Stefano Garzarella <sgarzare(a)redhat.com> vsock/virtio: fix empty payload in tap skb for non-linear buffers Stefano Garzarella <sgarzare(a)redhat.com> vsock/virtio: fix length and offset in tap skb for split packets Norbert Szetei <norbert(a)doyensec.com> vsock: fix buffer size clamping order Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: fix tp_num leak on kmalloc failure Jiexun Wang <wangjiexun2025(a)gmail.com> batman-adv: stop tp_meter sessions during mesh teardown Steven Rostedt <rostedt(a)goodmis.org> tracing/probes: Limit size of event probe to 3K Yochai Eisenrich <yochaie(a)sweet.security> btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak Guangshuo Li <lgs201920130244(a)gmail.com> btrfs: fix double free in create_space_info_sub_group() error path Filipe Manana <fdmanana(a)suse.com> btrfs: remove fs_info argument from btrfs_sysfs_add_space_info_type() Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() Martin Michaelis <code(a)mgjm.de> io_uring/kbuf: support min length left for incremental buffers Nikolay Aleksandrov <razor(a)blackwall.org> bonding: fix use-after-free due to enslave fail after slave array update Miguel Ojeda <ojeda(a)kernel.org> rust: allow `clippy::collapsible_if` globally Miguel Ojeda <ojeda(a)kernel.org> rust: allow `clippy::collapsible_match` globally SeongJae Park <sj(a)kernel.org> mm/damon/reclaim: detect and use fresh enabled and kdamond_pid values SeongJae Park <sj(a)kernel.org> mm/damon/lru_sort: detect and use fresh enabled and kdamond_pid values SeongJae Park <sj(a)kernel.org> mm/damon/core: implement damon_kdamond_pid() SeongJae Park <sj(a)kernel.org> mm/damon/core: disallow time-quota setting zero esz Gary Guo <gary(a)garyguo.net> rust: pin-init: fix incorrect accessor reference lifetime Thomas Zimmermann <tzimmermann(a)suse.de> fbcon: Avoid OOB font access if console rotation fails David Carlier <devnexen(a)gmail.com> tracefs: Fix default permissions not being applied on initial mount Damien Le Moal <dlemoal(a)kernel.org> block: fix zone write plug removal Damien Le Moal <dlemoal(a)kernel.org> block: reorganize struct blk_zone_wplug Damien Le Moal <dlemoal(a)kernel.org> block: cleanup blkdev_report_zones() Sang-Heon Jeon <ekffu200098(a)gmail.com> mm/hugetlb_cma: round up per_node before logging it Johan Hovold <johan(a)kernel.org> spi: uniphier: fix controller deregistration Pei Xiao <xiaopei01(a)kylinos.cn> spi: uniphier: Simplify clock handling with devm_clk_get_enabled() Johan Hovold <johan(a)kernel.org> spi: tegra114: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: tegra20-sflash: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: zynq-qspi: fix controller deregistration Pei Xiao <xiaopei01(a)kylinos.cn> spi: zynq-qspi: Simplify clock handling with devm_clk_get_enabled() David Carlier <devnexen(a)gmail.com> Bluetooth: hci_conn: fix potential UAF in create_big_sync Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: seq: Fix UMP group 16 filtering Takashi Iwai <tiwai(a)suse.de> ALSA: seq: Notify client and port info changes Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: core: Serialize deferred fasync state checks Takashi Iwai <tiwai(a)suse.de> ALSA: misc: Use guard() for spin locks Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: hda: cs35l56: Propagate ASP TX source control errors Selvarasu Ganesan <selvarasu.g(a)samsung.com> usb: dwc3: Move GUID programming after PHY initialization Amit Sunil Dhamne <amitsd(a)google.com> usb: typec: tcpm: reset internal port states on soft reset AMS Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: put backbone reference on failed claim hash insert Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: only purge non-released claims Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: prevent use-after-free when deleting claims Jiexun Wang <wangjiexun2025(a)gmail.com> batman-adv: stop caching unowned originator pointers in BAT IV Jiexun Wang <wangjiexun2025(a)gmail.com> batman-adv: reject new tp_meter sessions during teardown Lyes Bourennani <lbourennani(a)fuzzinglabs.com> batman-adv: fix integer overflow on buff_pos Ben Morris <bmorris(a)anthropic.com> sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL Siddharth Vadapalli <s-vadapalli(a)ti.com> arm64: dts: ti: k3-am62a7-sk: Fix pin name in comment from M19 to N22 Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/pm: align Hawaii mclk workaround with radeon Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/pm: add missing revision check for CI John B. Moore <jbmoore61(a)gmail.com> drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission Felix Kuehling <felix.kuehling(a)amd.com> drm/amdkfd: Make all TLB-flushes heavy-weight Icenowy Zheng <zhengxingda(a)iscas.ac.cn> drm/panel: boe-tv101wum-nl6: restore MODE_LPM after sending disable cmds John B. Moore <jbmoore61(a)gmail.com> drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ Icenowy Zheng <zhengxingda(a)iscas.ac.cn> drm/panel: himax-hx83102: restore MODE_LPM after sending disable cmds Osama Abdelkader <osama.abdelkader(a)gmail.com> drm/exynos: remove bridge when component_add fails Philip Yang <Philip.Yang(a)amd.com> drm/amdgpu: zero-initialize GART table on allocation Alex Deucher <alexander.deucher(a)amd.com> drm/radeon: add missing revision check for CI Shuicheng Lin <shuicheng.lin(a)intel.com> drm/xe/bo: Fix bo leak on unaligned size validation in xe_bo_init_locked() Shuicheng Lin <shuicheng.lin(a)intel.com> drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() Shuicheng Lin <shuicheng.lin(a)intel.com> drm/xe/bo: Fix bo leak on GGTT flag validation in xe_bo_init_locked() Alysa Liu <Alysa.Liu(a)amd.com> drm/amdkfd: validate SVM ioctl nattr against buffer size Ashutosh Desai <ashutoshdesai993(a)gmail.com> drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() Mario Kleiner <mario.kleiner.de(a)gmail.com> drm/amd/display: Change dither policy for 10 bpc output back to dithering Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vce: Prevent partial address patches Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vcn4: Prevent OOB reads when parsing IB Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu: Add bounds checking to ib_{get,set}_value Alysa Liu <Alysa.Liu(a)amd.com> drm/amdkfd: Add upper bound check for num_of_nodes Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: fix incorrect FeatureCtrlMask setting on smu v14.0.x Chenglei Xie <Chenglei.Xie(a)amd.com> drm/amdgpu: gate VM CPU HDP flush on reset lock Ramalingeswara Reddy, Kanala <Kanala.RamalingeswaraReddy(a)amd.com> drm/amdgpu: Use SMUIO 15.0.0 offsets for TSC upper and lower count. Amir Shetaia <Amir.Shetaia(a)amd.com> drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Init variable to avoid early exit from et alignment loop Yasuaki Torimaru <yasuakitorimaru(a)gmail.com> drm/msm/gem: fix error handling in msm_ioctl_gem_info_get_metadata() Johan Hovold <johan(a)kernel.org> spi: cadence: fix unclocked access on unbind Johan Hovold <johan(a)kernel.org> spi: cadence: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: mpc52xx: fix use-after-free on unbind Johan Hovold <johan(a)kernel.org> spi: mpc52xx: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: mpc52xx: fix use-after-free on registration failure Johan Hovold <johan(a)kernel.org> spi: orion: fix clock imbalance on registration failure Johan Hovold <johan(a)kernel.org> spi: orion: fix runtime pm leak on unbind Johan Hovold <johan(a)kernel.org> spi: orion: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: mxic: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: imx: fix runtime pm leak on probe deferral Johan Hovold <johan(a)kernel.org> spi: img-spfi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: rspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sprd: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: pic32-sqi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: npcm-pspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: coldfire-qspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: bcmbca-hsspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: fsl: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sh-hspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: pl022: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: mtk-nor: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: pic32: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: omap2-mcspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: fsl-espi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: s3c64xx: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: dln2: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: mxs: fix controller deregistration Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> media: omap3isp: drop the use count of v4l2 pipeline Matthias Fend <matthias.fend(a)emfend.at> media: i2c: ov08d10: fix image vertical start setting Michael Tretter <m.tretter(a)pengutronix.de> media: staging: imx: request mbus_config in csi_start Wenmeng Liu <wenmeng.liu(a)oss.qualcomm.com> media: i2c: imx412: Assert reset GPIO during probe Sergey Shtylyov <s.shtylyov(a)auroraos.dev> media: dib8000: avoid division by 0 in dib8000_set_dds() Abdun Nihaal <nihaal(a)cse.iitm.ac.in> media: pci: zoran: fix potential memory leak in zoran_probe() Luigi Leonardi <leonardi(a)redhat.com> vsock/virtio: fix MSG_PEEK ignoring skb offset when calculating bytes to copy Krishna Chomal <krishna.chomal108(a)gmail.com> platform/x86: hp-wmi: Ignore backlight and FnLock events Johan Hovold <johan(a)kernel.org> spi: aspeed-smc: fix controller deregistration Wang Jun <1742789905(a)qq.com> media: saa7164: add ioremap return checks and cleanups Johan Hovold <johan(a)kernel.org> spi: at91-usart: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: qup: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: meson-spicc: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: lantiq-ssc: fix controller deregistration Johan Hovold <johan(a)kernel.org> regulator: bd9571mwv: fix OF node reference imbalance Johan Hovold <johan(a)kernel.org> regulator: act8945a: fix OF node reference imbalance Jai Luthra <jai.luthra(a)ideasonboard.com> media: i2c: imx283: Fix hang when going from large to small resolution Ethan Tidmore <ethantidmore06(a)gmail.com> media: intel/ipu6: fix error pointer dereference Janne Grunau <j(a)jannau.net> media: videobuf2: Set vma_flags in vb2_dma_sg_mmap Johan Hovold <johan(a)kernel.org> regulator: rk808: fix OF node reference imbalance Jai Luthra <jai.luthra(a)ideasonboard.com> media: i2c: imx283: Enter full standby when stopping streaming Oliver Neukum <oneukum(a)suse.com> media: rc: streamzap: Error handling in probe Oliver Neukum <oneukum(a)suse.com> media: rc: xbox_remote: heed DMA restrictions Johan Hovold <johan(a)kernel.org> regulator: max77650: fix OF node reference imbalance Johan Hovold <johan(a)kernel.org> spi: st-ssc4: fix controller deregistration Johan Hovold <johan(a)kernel.org> regulator: mt6357: fix OF node reference imbalance Sakari Ailus <sakari.ailus(a)linux.intel.com> staging: media: atomisp: Disallow all private IOCTLs Josua Mayer <josua(a)solid-run.com> arm64: dts: lx2160a-cex7/lx2162a-sr-som: fix usd-cd & gpio pinmux Johan Hovold <johan(a)kernel.org> spi: atmel: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: bcm63xx: fix controller deregistration Ziyi Guo <n7l8m4(a)u.northwestern.edu> media: chips-media: wave5: add missing spinlock protection for handle_dynamic_resolution_change() Ziyi Guo <n7l8m4(a)u.northwestern.edu> media: chips-media: wave5: add missing spinlock protection for send_eos_event() Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> media: chips-media: wave5: fix a potential memory leak in wave5_vdi_init() Alexander Koskovich <akoskovich(a)pm.me> media: i2c: ov8856: free control handler on error in ov8856_init_controls() Guoniu Zhou <guoniu.zhou(a)nxp.com> media: nxp: imx8-isi: Reduce minimum queued buffers from 2 to 0 Ricardo Ribalda <ribalda(a)chromium.org> media: uvcvideo: Enable VB2_DMABUF for metadata stream T.J. Mercier <tjmercier(a)google.com> HID: playstation: Clamp num_touch_reports ------------- Diffstat: Makefile | 6 +- .../arm64/boot/dts/freescale/fsl-lx2160a-cex7.dtsi | 7 + .../dts/freescale/fsl-lx2160a-clearfog-itx.dtsi | 2 + arch/arm64/boot/dts/freescale/fsl-lx2160a.dtsi | 24 +++ .../boot/dts/freescale/fsl-lx2162a-clearfog.dts | 2 + .../boot/dts/freescale/fsl-lx2162a-sr-som.dtsi | 7 + arch/arm64/boot/dts/ti/k3-am62a7-sk.dts | 2 +- block/blk-zoned.c | 170 +++++++++------------ drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 3 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c | 13 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h | 11 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c | 3 + drivers/gpu/drm/amd/amdgpu/amdgpu_vm_cpu.c | 12 +- drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 31 +++- drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 3 - drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c | 4 +- drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c | 25 ++- drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c | 46 ++++-- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 33 +++- .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 6 +- drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 10 +- drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 4 +- drivers/gpu/drm/amd/amdkfd/kfd_topology.c | 11 ++ drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 2 +- .../gpu/drm/amd/pm/powerplay/smumgr/ci_smumgr.c | 13 +- .../gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c | 10 +- drivers/gpu/drm/drm_gem_framebuffer_helper.c | 4 +- drivers/gpu/drm/exynos/exynos_drm_mic.c | 8 +- drivers/gpu/drm/i915/display/intel_psr.c | 2 +- drivers/gpu/drm/msm/msm_drv.c | 7 +- drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c | 2 + drivers/gpu/drm/panel/panel-himax-hx83102.c | 2 + drivers/gpu/drm/radeon/ci_dpm.c | 9 +- drivers/gpu/drm/xe/xe_bo.c | 8 +- drivers/gpu/drm/xe/xe_dma_buf.c | 11 +- drivers/hid/hid-playstation.c | 6 +- drivers/media/common/videobuf2/videobuf2-dma-sg.c | 1 + drivers/media/dvb-frontends/dib8000.c | 4 +- drivers/media/i2c/imx283.c | 15 +- drivers/media/i2c/imx412.c | 2 +- drivers/media/i2c/ov08d10.c | 10 +- drivers/media/i2c/ov8856.c | 10 +- drivers/media/pci/intel/ipu6/ipu6.c | 2 +- drivers/media/pci/saa7164/saa7164-core.c | 47 ++++-- drivers/media/pci/zoran/zoran_card.c | 2 +- .../media/platform/chips-media/wave5/wave5-vdi.c | 1 + .../platform/chips-media/wave5/wave5-vpu-dec.c | 14 +- .../media/platform/nxp/imx8-isi/imx8-isi-video.c | 2 +- drivers/media/platform/ti/omap3isp/ispvideo.c | 1 + drivers/media/rc/streamzap.c | 12 +- drivers/media/rc/xbox_remote.c | 9 +- drivers/media/usb/uvc/uvc_queue.c | 3 +- drivers/net/bonding/bond_main.c | 6 +- drivers/platform/x86/hp/hp-wmi.c | 5 + drivers/regulator/act8945a-regulator.c | 3 +- drivers/regulator/bd9571mwv-regulator.c | 3 +- drivers/regulator/max77650-regulator.c | 2 +- drivers/regulator/mt6357-regulator.c | 2 +- drivers/regulator/rk808-regulator.c | 3 +- drivers/spi/spi-aspeed-smc.c | 9 +- drivers/spi/spi-at91-usart.c | 8 +- drivers/spi/spi-atmel.c | 8 +- drivers/spi/spi-bcm63xx.c | 8 +- drivers/spi/spi-bcmbca-hsspi.c | 4 +- drivers/spi/spi-cadence.c | 15 +- drivers/spi/spi-coldfire-qspi.c | 10 +- drivers/spi/spi-dln2.c | 8 +- drivers/spi/spi-fsl-espi.c | 10 +- drivers/spi/spi-fsl-spi.c | 14 +- drivers/spi/spi-img-spfi.c | 8 +- drivers/spi/spi-imx.c | 1 + drivers/spi/spi-lantiq-ssc.c | 8 +- drivers/spi/spi-meson-spicc.c | 8 +- drivers/spi/spi-mpc52xx.c | 9 +- drivers/spi/spi-mtk-nor.c | 4 +- drivers/spi/spi-mxic.c | 3 +- drivers/spi/spi-mxs.c | 8 +- drivers/spi/spi-npcm-pspi.c | 8 +- drivers/spi/spi-omap2-mcspi.c | 8 +- drivers/spi/spi-orion.c | 16 +- drivers/spi/spi-pic32-sqi.c | 8 +- drivers/spi/spi-pic32.c | 11 +- drivers/spi/spi-pl022.c | 8 +- drivers/spi/spi-qup.c | 8 +- drivers/spi/spi-rspi.c | 10 +- drivers/spi/spi-s3c64xx.c | 4 +- drivers/spi/spi-sh-hspi.c | 10 +- drivers/spi/spi-sprd.c | 8 +- drivers/spi/spi-st-ssc4.c | 8 +- drivers/spi/spi-tegra114.c | 8 +- drivers/spi/spi-tegra20-sflash.c | 8 +- drivers/spi/spi-uniphier.c | 24 ++- drivers/spi/spi-zynq-qspi.c | 55 ++----- drivers/staging/media/atomisp/pci/atomisp_ioctl.c | 4 + drivers/staging/media/imx/imx-media-csi.c | 40 +++-- drivers/usb/dwc3/core.c | 12 +- drivers/usb/typec/tcpm/tcpm.c | 2 + drivers/video/fbdev/core/fbcon_rotate.c | 5 +- fs/btrfs/ioctl.c | 5 +- fs/btrfs/space-info.c | 8 +- fs/btrfs/sysfs.c | 5 +- fs/btrfs/sysfs.h | 3 +- fs/tracefs/inode.c | 1 + include/linux/damon.h | 2 + include/uapi/linux/io_uring.h | 3 +- io_uring/kbuf.c | 8 +- io_uring/kbuf.h | 7 + kernel/trace/trace_probe.c | 6 + kernel/trace/trace_probe.h | 4 +- mm/damon/core.c | 34 +++++ mm/damon/lru_sort.c | 88 +++++++---- mm/damon/reclaim.c | 88 +++++++---- mm/hugetlb.c | 1 + net/batman-adv/bat_iv_ogm.c | 85 ++++++++--- net/batman-adv/bridge_loop_avoidance.c | 11 +- net/batman-adv/main.c | 1 + net/batman-adv/tp_meter.c | 116 +++++++++++--- net/batman-adv/tp_meter.h | 1 + net/batman-adv/types.h | 4 + net/bluetooth/hci_conn.c | 19 ++- net/bluetooth/l2cap_sock.c | 3 + net/sctp/socket.c | 9 ++ net/vmw_vsock/af_vsock.c | 6 +- net/vmw_vsock/virtio_transport_common.c | 57 +++---- rust/kernel/init/__internal.rs | 28 ++-- rust/kernel/init/macros.rs | 91 ++++++----- sound/core/misc.c | 33 ++-- sound/core/seq/seq_clientmgr.c | 9 +- sound/core/seq/seq_clientmgr.h | 5 +- sound/core/seq/seq_ump_client.c | 4 +- sound/pci/hda/cs35l56_hda.c | 19 ++- 131 files changed, 1264 insertions(+), 586 deletions(-)

1 day, 3 hours

7
6
0 0

[PATCH 7.0 000/201] 7.0.9-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 7.0.9 release. There are 201 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sun, 17 May 2026 15:46:37 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.0.9-rc1.… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.0.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 7.0.9-rc1 Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vcn4: Avoid overflow on msg bound check Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vcn3: Avoid overflow on msg bound check Dudu Lu <phx0fer(a)gmail.com> vsock/virtio: fix accept queue count leak on transport mismatch Eric Dumazet <edumazet(a)google.com> vsock/virtio: fix potential unbounded skb queue Stefano Garzarella <sgarzare(a)redhat.com> vsock/virtio: fix empty payload in tap skb for non-linear buffers Stefano Garzarella <sgarzare(a)redhat.com> vsock/virtio: fix length and offset in tap skb for split packets Norbert Szetei <norbert(a)doyensec.com> vsock: fix buffer size clamping order Lorenzo Stoakes <ljs(a)kernel.org> mm/vma: do not try to unmap a VMA if mmap_prepare() invoked from mmap() Markus Mayer <mmayer(a)broadcom.com> perf build: fix "argument list too long" in second location Tejun Heo <tj(a)kernel.org> sched_ext: Skip tasks with stale task_rq in bypass_lb_cpu() Tejun Heo <tj(a)kernel.org> cgroup: Defer css percpu_ref kill on rmdir until cgroup is depopulated Petr Malat <oss(a)malat.biz> cgroup: Increment nr_dying_subsys_* from rmdir context Johan Hovold <johan(a)kernel.org> spi: uniphier: fix controller deregistration Pei Xiao <xiaopei01(a)kylinos.cn> spi: uniphier: Simplify clock handling with devm_clk_get_enabled() Prasanna Kumar T S M <ptsm(a)linux.microsoft.com> EDAC/versalnet: Fix device name memory leak Shubhrajyoti Datta <shubhrajyoti.datta(a)amd.com> EDAC/versalnet: Refactor memory controller initialization and cleanup Breno Leitao <leitao(a)debian.org> kho: fix error handling in kho_add_subtree() Pavel Begunkov <asml.silence(a)gmail.com> io_uring/zcrx: warn on freelist violations Pavel Begunkov <asml.silence(a)gmail.com> io_uring/zcrx: use guards for locking Amit Sunil Dhamne <amitsd(a)google.com> usb: typec: tcpm: reset internal port states on soft reset AMS Andrea Righi <arighi(a)nvidia.com> sched_ext: Use HK_TYPE_DOMAIN_BOOT to detect isolcpus= domain isolation Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: put backbone reference on failed claim hash insert Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: only purge non-released claims Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: prevent use-after-free when deleting claims Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: fix tp_num leak on kmalloc failure Jiexun Wang <wangjiexun2025(a)gmail.com> batman-adv: stop caching unowned originator pointers in BAT IV Jiexun Wang <wangjiexun2025(a)gmail.com> batman-adv: stop tp_meter sessions during mesh teardown Jiexun Wang <wangjiexun2025(a)gmail.com> batman-adv: reject new tp_meter sessions during teardown Lyes Bourennani <lbourennani(a)fuzzinglabs.com> batman-adv: fix integer overflow on buff_pos Ben Morris <bmorris(a)anthropic.com> sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL Franz Schnyder <franz.schnyder(a)toradex.com> arm64: dts: ti: k3-am69-aquila-dev: Fix DP regulator enable GPIO Siddharth Vadapalli <s-vadapalli(a)ti.com> arm64: dts: ti: k3-am62a7-sk: Fix pin name in comment from M19 to N22 Viken Dadhaniya <viken.dadhaniya(a)oss.qualcomm.com> arm64: dts: qcom: lemans: Correct QUP interrupt numbers Krishna Chaitanya Chundru <krishna.chundru(a)oss.qualcomm.com> arm64: dts: qcom: kodiak: Fix PCIe1 PHY ref clock voting Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/pm: align Hawaii mclk workaround with radeon Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/pm: add missing revision check for CI John B. Moore <jbmoore61(a)gmail.com> drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission Felix Kuehling <felix.kuehling(a)amd.com> drm/amdkfd: Make all TLB-flushes heavy-weight Icenowy Zheng <zhengxingda(a)iscas.ac.cn> drm/panel: boe-tv101wum-nl6: restore MODE_LPM after sending disable cmds Osama Abdelkader <osama.abdelkader(a)gmail.com> drm/sti: remove bridge when sti_hda component_add fails Kory Maincent (TI) <kory.maincent(a)bootlin.com> drm/bridge: tda998x: Use __be32 for audio port OF property pointer John B. Moore <jbmoore61(a)gmail.com> drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ Icenowy Zheng <zhengxingda(a)iscas.ac.cn> drm/panel: himax-hx83102: restore MODE_LPM after sending disable cmds Sunil Khatri <sunil.khatri(a)amd.com> drm/amdgpu/userq: fix access to stale wptr mapping Osama Abdelkader <osama.abdelkader(a)gmail.com> drm/exynos: remove bridge when component_add fails Philip Yang <Philip.Yang(a)amd.com> drm/amdgpu: zero-initialize GART table on allocation Alex Deucher <alexander.deucher(a)amd.com> drm/radeon: add missing revision check for CI Francis, David <David.Francis(a)amd.com> drm: Set old handle to NULL before prime swap in change_handle Jia Yao <jia.yao(a)intel.com> drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise Shuicheng Lin <shuicheng.lin(a)intel.com> drm/xe/bo: Fix bo leak on unaligned size validation in xe_bo_init_locked() Shuicheng Lin <shuicheng.lin(a)intel.com> drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() Shuicheng Lin <shuicheng.lin(a)intel.com> drm/xe/bo: Fix bo leak on GGTT flag validation in xe_bo_init_locked() Shuicheng Lin <shuicheng.lin(a)intel.com> drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure Shixiong Ou <oushixiong(a)kylinos.cn> drm/udl: Increase GET_URB_TIMEOUT Shubhankar Milind Sardeshpande <Shubhankar.MilindSardeshpande(a)amd.com> drm/amdgpu: Avoid reset in AMDGPU unload path for APUs with GFX V11 and higher. Alysa Liu <Alysa.Liu(a)amd.com> drm/amdkfd: validate SVM ioctl nattr against buffer size Sasha Finkelstein <k(a)chaosmail.tech> drm/appletbdrm: Use kvzalloc for big allocations Ashutosh Desai <ashutoshdesai993(a)gmail.com> drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() Mario Kleiner <mario.kleiner.de(a)gmail.com> drm/amd/display: Change dither policy for 10 bpc output back to dithering Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vce: Prevent partial address patches Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vcn4: Prevent OOB reads when parsing IB Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu: Add bounds checking to ib_{get,set}_value Alysa Liu <Alysa.Liu(a)amd.com> drm/amdkfd: Add upper bound check for num_of_nodes Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: fix incorrect FeatureCtrlMask setting on smu v14.0.x Chenglei Xie <Chenglei.Xie(a)amd.com> drm/amdgpu: gate VM CPU HDP flush on reset lock Ramalingeswara Reddy, Kanala <Kanala.RamalingeswaraReddy(a)amd.com> drm/amdgpu: Use SMUIO 15.0.0 offsets for TSC upper and lower count. Ramalingeswara Reddy, Kanala <Kanala.RamalingeswaraReddy(a)amd.com> drm/amdgpu: Use NBIF offset for register RCC_STRAP0_RCC_DEV0_EPF0_STRAP0 . Mario Limonciello <mario.limonciello(a)amd.com> drm/amd: Add missing firmware declaration for PSP v15.0.0 Wenjing Liu <wenjing.liu(a)amd.com> drm/amd/display: fix math_mod() using arg1 instead of arg2 Amir Shetaia <Amir.Shetaia(a)amd.com> drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Init variable to avoid early exit from et alignment loop Ashutosh Desai <ashutoshdesai993(a)gmail.com> drm/v3d: Reject empty multisync extension to prevent infinite loop Anna Maniscalco <anna.maniscalco2000(a)gmail.com> drm/msm: always recover the gpu Marek Vasut <marex(a)nabladev.com> drm/imx: parallel-display: Prefer bus format set via legacy "interface-pix-fmt" DT property Harry Wentland <harry.wentland(a)amd.com> drm/colorop: Fix blob property reference tracking in state lifecycle Yasuaki Torimaru <yasuakitorimaru(a)gmail.com> drm/msm/gem: fix error handling in msm_ioctl_gem_info_get_metadata() Johan Hovold <johan(a)kernel.org> spi: cadence-quadspi: fix unclocked access on unbind Johan Hovold <johan(a)kernel.org> spi: cadence-quadspi: fix runtime pm and clock imbalance on unbind Johan Hovold <johan(a)kernel.org> spi: cadence-quadspi: fix clock imbalance on probe failure Johan Hovold <johan(a)kernel.org> spi: cadence-quadspi: fix runtime pm disable imbalance on probe failure Johan Hovold <johan(a)kernel.org> spi: cadence: fix clock imbalance on probe failure Johan Hovold <johan(a)kernel.org> spi: cadence: fix unclocked access on unbind Johan Hovold <johan(a)kernel.org> spi: cadence-quadspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: cadence: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: mpc52xx: fix use-after-free on unbind Johan Hovold <johan(a)kernel.org> spi: mpc52xx: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: mpc52xx: fix use-after-free on registration failure Johan Hovold <johan(a)kernel.org> spi: orion: fix clock imbalance on registration failure Johan Hovold <johan(a)kernel.org> spi: orion: fix runtime pm leak on unbind Johan Hovold <johan(a)kernel.org> spi: orion: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: mxic: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: imx: fix runtime pm leak on probe deferral Johan Hovold <johan(a)kernel.org> spi: octeon: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: mpfs: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: img-spfi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: slave-mt27xx: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sh-msiof: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: rspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sprd: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: pic32-sqi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: cavium-thunderx: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: npcm-pspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: coldfire-qspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: bcmbca-hsspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: fsl: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sh-hspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: ch341: fix devres lifetime Johan Hovold <johan(a)kernel.org> spi: pl022: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: mtk-nor: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: ep93xx: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: pic32: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: omap2-mcspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: fsl-espi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: s3c64xx: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: dln2: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: mt65xx: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: mxs: fix controller deregistration Gustavo Sousa <gustavo.sousa(a)intel.com> drm/xe/hdcp: Add NULL check for media_gt in intel_hdcp_gsc_check_status() Wenmeng Liu <wenmeng.liu(a)oss.qualcomm.com> media: qcom: camss: Add missing clocks for VFE lite on sa8775p Vikash Garodia <vikash.garodia(a)oss.qualcomm.com> media: iris: switch to hardware mode after firmware boot Vishnu Reddy <busanna.reddy(a)oss.qualcomm.com> media: iris: fix use-after-free of fmt_src during MBPF check Thomas Fourier <fourier.thomas(a)gmail.com> media: iris: Fix dma_free_attrs() size in iris_hfi_queues_init() Arnd Bergmann <arnd(a)arndb.de> media: venus: fix QCOM_MDT_LOADER dependency Dmitry Baryshkov <dmitry.baryshkov(a)oss.qualcomm.com> media: qcom: iris: increase H265D_MAX_SLICE to fix H.265 decoding on SC7280 Wenmeng Liu <wenmeng.liu(a)oss.qualcomm.com> media: qcom: camss: Fix csid IRQ offset for sa8775p Wenmeng Liu <wenmeng.liu(a)oss.qualcomm.com> media: qcom: camss: Fix csid clock configuration for sa8775p Dikshita Agarwal <dikshita.agarwal(a)oss.qualcomm.com> media: iris: Fix use-after-free in iris_release_internal_buffers() Arnd Bergmann <arnd(a)arndb.de> media: iris: fix QCOM_MDT_LOADER dependency Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> media: omap3isp: drop the use count of v4l2 pipeline Matthias Fend <matthias.fend(a)emfend.at> media: i2c: ov08d10: fix runtime PM handling in probe Matthias Fend <matthias.fend(a)emfend.at> media: i2c: ov08d10: fix image vertical start setting Michael Tretter <m.tretter(a)pengutronix.de> media: staging: imx: request mbus_config in csi_start Wenmeng Liu <wenmeng.liu(a)oss.qualcomm.com> media: i2c: imx412: Assert reset GPIO during probe Sergey Shtylyov <s.shtylyov(a)auroraos.dev> media: dib8000: avoid division by 0 in dib8000_set_dds() Abdun Nihaal <nihaal(a)cse.iitm.ac.in> media: pci: zoran: fix potential memory leak in zoran_probe() Gregor Herburger <gregor.herburger(a)linutronix.de> arm64: dts: broadcom: bcm2712-d-rpi-5-b: update uart10 interrupt Gregor Herburger <gregor.herburger(a)linutronix.de> arm64: dts: broadcom: bcm2712-d-rpi-5-b: add fixes for pinctrl/pinctrl_aon Luigi Leonardi <leonardi(a)redhat.com> vsock/virtio: fix MSG_PEEK ignoring skb offset when calculating bytes to copy Krishna Chomal <krishna.chomal108(a)gmail.com> platform/x86: hp-wmi: Ignore backlight and FnLock events Chaitanya Kumar Borah <chaitanya.kumar.borah(a)intel.com> drm/atomic: Add affected colorops with affected planes Chaitanya Kumar Borah <chaitanya.kumar.borah(a)intel.com> drm/colorop: Preserve bypass value in duplicate_state() Johan Hovold <johan(a)kernel.org> spi: aspeed-smc: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: amlogic-spisg: fix controller deregistration Wang Jun <1742789905(a)qq.com> media: saa7164: add ioremap return checks and cleanups Hans de Goede <johannes.goede(a)oss.qualcomm.com> media: ipu-bridge: Add upside-down sensor DMI quirk for Dell XPS 13 9340 and XPS 14 9440 Johan Hovold <johan(a)kernel.org> spi: at91-usart: fix controller deregistration Franz Schnyder <franz.schnyder(a)toradex.com> arm64: dts: ti: k3-am69-aquila-clover: Fix DP regulator enable GPIO Johan Hovold <johan(a)kernel.org> spi: qup: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: meson-spicc: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: lantiq-ssc: fix controller deregistration Johan Hovold <johan(a)kernel.org> regulator: bd9571mwv: fix OF node reference imbalance Johan Hovold <johan(a)kernel.org> regulator: s2dos05: fix OF node reference imbalance Johan Hovold <johan(a)kernel.org> regulator: act8945a: fix OF node reference imbalance Jai Luthra <jai.luthra(a)ideasonboard.com> media: i2c: imx283: Fix hang when going from large to small resolution Ethan Tidmore <ethantidmore06(a)gmail.com> media: intel/ipu6: fix error pointer dereference Jacopo Mondi <jacopo.mondi(a)ideasonboard.com> media: mali-c55: Fully reset the ISP configuration Dang Huynh <dang.huynh(a)mainlining.org> media: rockchip: rkcif: Add missing MUST_CONNECT flag to pads Janne Grunau <j(a)jannau.net> media: videobuf2: Set vma_flags in vb2_dma_sg_mmap Johan Hovold <johan(a)kernel.org> regulator: rk808: fix OF node reference imbalance Johan Hovold <johan(a)kernel.org> regulator: bq257xx: fix OF node reference imbalance Jai Luthra <jai.luthra(a)ideasonboard.com> media: i2c: imx283: Enter full standby when stopping streaming Xiaolei Wang <xiaolei.wang(a)windriver.com> media: i2c: ov5647: Fix runtime PM refcount leak in s_ctrl Oliver Neukum <oneukum(a)suse.com> media: rc: streamzap: Error handling in probe Oliver Neukum <oneukum(a)suse.com> media: rc: xbox_remote: heed DMA restrictions Felix Gu <ustc.gu(a)gmail.com> media: ti: vpe: Add missing v4l2_device_unregister in vip_remove() Johan Hovold <johan(a)kernel.org> regulator: max77650: fix OF node reference imbalance Johan Hovold <johan(a)kernel.org> spi: st-ssc4: fix controller deregistration Johan Hovold <johan(a)kernel.org> regulator: mt6357: fix OF node reference imbalance Sakari Ailus <sakari.ailus(a)linux.intel.com> staging: media: atomisp: Disallow all private IOCTLs Josua Mayer <josua(a)solid-run.com> arm64: dts: lx2160a-cex7/lx2162a-sr-som: fix usd-cd & gpio pinmux Johan Hovold <johan(a)kernel.org> spi: atmel: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: bcm63xx: fix controller deregistration Matthew Brost <matthew.brost(a)intel.com> drm/gpusvm: Force unmapping on error in drm_gpusvm_get_pages Matthew Brost <matthew.brost(a)intel.com> drm/gpusvm: Allow device pages to be mapped in mixed mappings after system pages Emanuele Ghidoli <emanuele.ghidoli(a)toradex.com> arm64: dts: freescale: imx95-toradex-smarc: fix PMIC_SD2_VSEL label position Ziyi Guo <n7l8m4(a)u.northwestern.edu> media: chips-media: wave5: add missing spinlock protection for handle_dynamic_resolution_change() Ziyi Guo <n7l8m4(a)u.northwestern.edu> media: chips-media: wave5: add missing spinlock protection for send_eos_event() Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> media: chips-media: wave5: fix a potential memory leak in wave5_vdi_init() Cristian Ciocaltea <cristian.ciocaltea(a)collabora.com> media: dt-bindings: rockchip,vdec: Mark reg-names required for RK35{76,88} Cristian Ciocaltea <cristian.ciocaltea(a)collabora.com> media: dt-bindings: rockchip,vdec: Add alternative reg-names order for RK35{76,88} Alexander Koskovich <akoskovich(a)pm.me> media: i2c: ov8856: free control handler on error in ov8856_init_controls() Tomi Valkeinen <tomi.valkeinen+renesas(a)ideasonboard.com> media: renesas: vin: Fix RAW8 (again) Tomi Valkeinen <tomi.valkeinen+renesas(a)ideasonboard.com> media: renesas: vsp1: Fix NULL pointer deref on module unload Jacopo Mondi <jacopo.mondi(a)ideasonboard.com> media: mali-c55: Fix wrong comment of ISP block types Daniel Scally <dan.scally(a)ideasonboard.com> media: mali-c55: Fix Iridix bypass macros Jacopo Mondi <jacopo.mondi(a)ideasonboard.com> media: mali-c55: Initialize the ISP in enable_streams() Barnabás Pőcze <barnabas.pocze+renesas(a)ideasonboard.com> media: rzv2h-ivc: Fix concurrent buffer list access Barnabás Pőcze <barnabas.pocze+renesas(a)ideasonboard.com> media: rzv2h-ivc: Fix FM_STOP register write Barnabás Pőcze <barnabas.pocze+renesas(a)ideasonboard.com> media: rzv2h-ivc: Write AXIRX_PIXFMT once Guoniu Zhou <guoniu.zhou(a)nxp.com> media: nxp: imx8-isi: Reduce minimum queued buffers from 2 to 0 Jacopo Mondi <jacopo.mondi+renesas(a)ideasonboard.com> media: rzv2h-ivc: Avoid double job scheduling Krzysztof Kozlowski <krzysztof.kozlowski(a)oss.qualcomm.com> drm/msm/hdmi: Fix wrong CTRL1 register used in writing info frames Ricardo Ribalda <ribalda(a)chromium.org> media: uvcvideo: Enable VB2_DMABUF for metadata stream Tomasz Pakuła <tomasz.pakula.oficjalny(a)gmail.com> HID: pidff: Fix integer overflow in pidff_rescale Benjamin Tissoires <bentiss(a)kernel.org> HID: core: introduce hid_safe_input_report() Benjamin Tissoires <bentiss(a)kernel.org> HID: pass the buffer size to hid_report_raw_event Sangyun Kim <sangyun.kim(a)snu.ac.kr> HID: appletb-kbd: run inactivity autodim from workqueues Sangyun Kim <sangyun.kim(a)snu.ac.kr> HID: appletb-kbd: fix UAF in inactivity-timer cleanup path T.J. Mercier <tjmercier(a)google.com> HID: playstation: Clamp num_touch_reports ------------- Diffstat: .../devicetree/bindings/media/rockchip,vdec.yaml | 22 +- Makefile | 4 +- arch/arm64/boot/dts/broadcom/bcm2712-d-rpi-5-b.dts | 14 ++ .../arm64/boot/dts/freescale/fsl-lx2160a-cex7.dtsi | 7 + .../dts/freescale/fsl-lx2160a-clearfog-itx.dtsi | 2 + arch/arm64/boot/dts/freescale/fsl-lx2160a.dtsi | 24 ++ .../boot/dts/freescale/fsl-lx2162a-clearfog.dts | 2 + .../boot/dts/freescale/fsl-lx2162a-sr-som.dtsi | 7 + .../boot/dts/freescale/imx95-toradex-smarc.dtsi | 1 - arch/arm64/boot/dts/qcom/kodiak.dtsi | 2 +- arch/arm64/boot/dts/qcom/lemans.dtsi | 8 +- arch/arm64/boot/dts/ti/k3-am62a7-sk.dts | 2 +- arch/arm64/boot/dts/ti/k3-am69-aquila-clover.dts | 2 +- arch/arm64/boot/dts/ti/k3-am69-aquila-dev.dts | 2 +- drivers/edac/versalnet_edac.c | 182 ++++++++------- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 3 +- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 6 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c | 13 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h | 11 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c | 3 + drivers/gpu/drm/amd/amdgpu/amdgpu_vm_cpu.c | 12 +- drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 31 ++- drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 3 - drivers/gpu/drm/amd/amdgpu/mes_userqueue.c | 97 ++++---- drivers/gpu/drm/amd/amdgpu/nbif_v6_3_1.c | 9 +- drivers/gpu/drm/amd/amdgpu/psp_v15_0.c | 1 + drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c | 4 +- drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c | 25 ++- drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c | 46 ++-- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 33 ++- .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 6 +- drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 10 +- drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 4 +- drivers/gpu/drm/amd/amdkfd/kfd_topology.c | 11 + drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 2 +- .../src/dml2_standalone_libraries/lib_float_math.c | 2 +- .../gpu/drm/amd/pm/powerplay/smumgr/ci_smumgr.c | 13 +- .../gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c | 10 +- drivers/gpu/drm/bridge/tda998x_drv.c | 2 +- drivers/gpu/drm/drm_atomic.c | 7 + drivers/gpu/drm/drm_colorop.c | 28 ++- drivers/gpu/drm/drm_gem.c | 25 ++- drivers/gpu/drm/drm_gem_framebuffer_helper.c | 4 +- drivers/gpu/drm/drm_gpusvm.c | 3 +- drivers/gpu/drm/exynos/exynos_drm_mic.c | 8 +- drivers/gpu/drm/i915/display/intel_psr.c | 2 +- drivers/gpu/drm/imx/ipuv3/parallel-display.c | 15 +- drivers/gpu/drm/msm/hdmi/hdmi_bridge.c | 4 +- drivers/gpu/drm/msm/msm_drv.c | 7 +- drivers/gpu/drm/msm/msm_gpu.c | 42 ++-- drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c | 2 + drivers/gpu/drm/panel/panel-himax-hx83102.c | 2 + drivers/gpu/drm/radeon/ci_dpm.c | 9 +- drivers/gpu/drm/sti/sti_hda.c | 8 +- drivers/gpu/drm/tiny/appletbdrm.c | 4 +- drivers/gpu/drm/udl/udl_main.c | 3 +- drivers/gpu/drm/udl/udl_modeset.c | 5 +- drivers/gpu/drm/v3d/v3d_submit.c | 5 + drivers/gpu/drm/xe/display/xe_hdcp_gsc.c | 12 +- drivers/gpu/drm/xe/xe_bo.c | 8 +- drivers/gpu/drm/xe/xe_dma_buf.c | 23 +- drivers/gpu/drm/xe/xe_vm_madvise.c | 47 ++++ drivers/hid/bpf/hid_bpf_dispatch.c | 6 +- drivers/hid/hid-appletb-kbd.c | 58 +++-- drivers/hid/hid-core.c | 67 ++++-- drivers/hid/hid-gfrm.c | 4 +- drivers/hid/hid-logitech-hidpp.c | 2 +- drivers/hid/hid-multitouch.c | 2 +- drivers/hid/hid-playstation.c | 6 +- drivers/hid/hid-primax.c | 2 +- drivers/hid/hid-vivaldi-common.c | 2 +- drivers/hid/i2c-hid/i2c-hid-core.c | 7 +- drivers/hid/usbhid/hid-core.c | 11 +- drivers/hid/usbhid/hid-pidff.c | 7 +- drivers/hid/wacom_sys.c | 6 +- drivers/media/common/videobuf2/videobuf2-dma-sg.c | 1 + drivers/media/dvb-frontends/dib8000.c | 4 +- drivers/media/i2c/imx283.c | 15 +- drivers/media/i2c/imx412.c | 2 +- drivers/media/i2c/ov08d10.c | 21 +- drivers/media/i2c/ov5647.c | 12 +- drivers/media/i2c/ov8856.c | 10 +- drivers/media/pci/intel/ipu-bridge.c | 14 ++ drivers/media/pci/intel/ipu6/ipu6.c | 2 +- drivers/media/pci/saa7164/saa7164-core.c | 47 +++- drivers/media/pci/zoran/zoran_card.c | 2 +- .../media/platform/arm/mali-c55/mali-c55-common.h | 2 + .../media/platform/arm/mali-c55/mali-c55-core.c | 35 --- drivers/media/platform/arm/mali-c55/mali-c55-isp.c | 37 +-- .../media/platform/arm/mali-c55/mali-c55-params.c | 128 ++++++++++- .../platform/arm/mali-c55/mali-c55-registers.h | 4 +- .../media/platform/chips-media/wave5/wave5-vdi.c | 1 + .../platform/chips-media/wave5/wave5-vpu-dec.c | 14 +- .../media/platform/nxp/imx8-isi/imx8-isi-video.c | 2 +- .../media/platform/qcom/camss/camss-csid-gen3.c | 6 +- drivers/media/platform/qcom/camss/camss.c | 80 +++---- drivers/media/platform/qcom/iris/Kconfig | 2 +- drivers/media/platform/qcom/iris/iris_buffer.c | 8 +- drivers/media/platform/qcom/iris/iris_core.c | 4 + drivers/media/platform/qcom/iris/iris_hfi_common.c | 4 + drivers/media/platform/qcom/iris/iris_hfi_queue.c | 2 +- drivers/media/platform/qcom/iris/iris_vdec.c | 6 - drivers/media/platform/qcom/iris/iris_vdec.h | 1 - drivers/media/platform/qcom/iris/iris_venc.c | 6 - drivers/media/platform/qcom/iris/iris_venc.h | 1 - drivers/media/platform/qcom/iris/iris_vidc.c | 6 +- drivers/media/platform/qcom/iris/iris_vpu2.c | 1 + drivers/media/platform/qcom/iris/iris_vpu3x.c | 9 +- drivers/media/platform/qcom/iris/iris_vpu4x.c | 24 +- drivers/media/platform/qcom/iris/iris_vpu_buffer.h | 2 +- drivers/media/platform/qcom/iris/iris_vpu_common.c | 16 +- drivers/media/platform/qcom/iris/iris_vpu_common.h | 3 + drivers/media/platform/qcom/venus/Kconfig | 2 +- drivers/media/platform/renesas/rcar-vin/rcar-dma.c | 22 ++ .../media/platform/renesas/rcar-vin/rcar-v4l2.c | 12 + .../platform/renesas/rzv2h-ivc/rzv2h-ivc-video.c | 35 +-- .../media/platform/renesas/rzv2h-ivc/rzv2h-ivc.h | 8 +- drivers/media/platform/renesas/vsp1/vsp1_drv.c | 8 +- .../platform/rockchip/rkcif/rkcif-interface.c | 3 +- .../media/platform/rockchip/rkcif/rkcif-stream.c | 2 +- drivers/media/platform/ti/omap3isp/ispvideo.c | 1 + drivers/media/platform/ti/vpe/vip.c | 1 + drivers/media/rc/streamzap.c | 12 +- drivers/media/rc/xbox_remote.c | 9 +- drivers/media/usb/uvc/uvc_queue.c | 3 +- drivers/platform/x86/hp/hp-wmi.c | 5 + drivers/regulator/act8945a-regulator.c | 3 +- drivers/regulator/bd9571mwv-regulator.c | 3 +- drivers/regulator/bq257xx-regulator.c | 3 +- drivers/regulator/max77650-regulator.c | 2 +- drivers/regulator/mt6357-regulator.c | 2 +- drivers/regulator/rk808-regulator.c | 3 +- drivers/regulator/s2dos05-regulator.c | 2 +- drivers/spi/spi-amlogic-spisg.c | 4 +- drivers/spi/spi-aspeed-smc.c | 9 +- drivers/spi/spi-at91-usart.c | 8 +- drivers/spi/spi-atmel.c | 8 +- drivers/spi/spi-bcm63xx.c | 8 +- drivers/spi/spi-bcmbca-hsspi.c | 4 +- drivers/spi/spi-cadence-quadspi.c | 40 ++-- drivers/spi/spi-cadence.c | 21 +- drivers/spi/spi-cavium-octeon.c | 8 +- drivers/spi/spi-cavium-thunderx.c | 8 +- drivers/spi/spi-ch341.c | 7 +- drivers/spi/spi-coldfire-qspi.c | 10 +- drivers/spi/spi-dln2.c | 8 +- drivers/spi/spi-ep93xx.c | 8 +- drivers/spi/spi-fsl-espi.c | 10 +- drivers/spi/spi-fsl-spi.c | 14 +- drivers/spi/spi-img-spfi.c | 8 +- drivers/spi/spi-imx.c | 1 + drivers/spi/spi-lantiq-ssc.c | 8 +- drivers/spi/spi-meson-spicc.c | 8 +- drivers/spi/spi-mpc52xx.c | 9 +- drivers/spi/spi-mpfs.c | 4 +- drivers/spi/spi-mt65xx.c | 4 +- drivers/spi/spi-mtk-nor.c | 4 +- drivers/spi/spi-mxic.c | 3 +- drivers/spi/spi-mxs.c | 8 +- drivers/spi/spi-npcm-pspi.c | 8 +- drivers/spi/spi-omap2-mcspi.c | 8 +- drivers/spi/spi-orion.c | 16 +- drivers/spi/spi-pic32-sqi.c | 8 +- drivers/spi/spi-pic32.c | 11 +- drivers/spi/spi-pl022.c | 8 +- drivers/spi/spi-qup.c | 8 +- drivers/spi/spi-rspi.c | 10 +- drivers/spi/spi-s3c64xx.c | 4 +- drivers/spi/spi-sh-hspi.c | 10 +- drivers/spi/spi-sh-msiof.c | 10 +- drivers/spi/spi-slave-mt27xx.c | 10 +- drivers/spi/spi-sprd.c | 8 +- drivers/spi/spi-st-ssc4.c | 8 +- drivers/spi/spi-uniphier.c | 24 +- drivers/staging/greybus/hid.c | 2 +- drivers/staging/media/atomisp/pci/atomisp_ioctl.c | 4 + drivers/staging/media/imx/imx-media-csi.c | 40 ++-- drivers/usb/typec/tcpm/tcpm.c | 2 + include/linux/cgroup-defs.h | 4 +- include/linux/hid.h | 6 +- include/linux/hid_bpf.h | 14 +- include/linux/mm.h | 2 +- io_uring/zcrx.c | 17 +- kernel/cgroup/cgroup.c | 248 ++++++++++----------- kernel/liveupdate/kexec_handover.c | 13 +- kernel/sched/ext.c | 12 +- mm/util.c | 51 +++-- mm/vma.c | 3 +- net/batman-adv/bat_iv_ogm.c | 85 ++++--- net/batman-adv/bridge_loop_avoidance.c | 11 +- net/batman-adv/main.c | 1 + net/batman-adv/tp_meter.c | 116 ++++++++-- net/batman-adv/tp_meter.h | 1 + net/batman-adv/types.h | 4 + net/sctp/socket.c | 9 + net/vmw_vsock/af_vsock.c | 6 +- net/vmw_vsock/virtio_transport_common.c | 57 ++--- tools/perf/pmu-events/Build | 4 +- tools/testing/vma/include/dup.h | 41 ++-- tools/testing/vma/include/stubs.h | 3 +- 200 files changed, 1917 insertions(+), 988 deletions(-)

1 day, 13 hours

14
13
0 0

[PATCH 6.6 000/474] 6.6.140-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.6.140 release. There are 474 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sun, 17 May 2026 15:46:37 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.140-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.6.140-rc1 Bjoern Doebel <doebel(a)amazon.de> smb: client: use kzalloc to zero-initialize security descriptor buffer Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete Thorsten Blum <thorsten.blum(a)linux.dev> crypto: nx - fix context leak in nx842_crypto_free_ctx Jianpeng Chang <jianpeng.chang.cn(a)windriver.com> Bluetooth: MGMT: Fix memory leak in set_ssp_complete Amit Kumar Mahapatra <amit.kumar-mahapatra(a)amd.com> mtd: spi-nor: sst: Fix SST write failure Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vcn4: Avoid overflow on msg bound check Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vcn3: Avoid overflow on msg bound check Eric Dumazet <edumazet(a)google.com> vsock/virtio: fix potential unbounded skb queue Stefano Garzarella <sgarzare(a)redhat.com> vsock/virtio: fix length and offset in tap skb for split packets Dudu Lu <phx0fer(a)gmail.com> vsock/virtio: fix accept queue count leak on transport mismatch Norbert Szetei <norbert(a)doyensec.com> vsock: fix buffer size clamping order Marc Zyngier <maz(a)kernel.org> KVM: arm64: Wake-up from WFI when iqrchip is in userspace Max Kellermann <max.kellermann(a)ionos.com> ceph: only d_add() negative dentries when they are unhashed Selvarasu Ganesan <selvarasu.g(a)samsung.com> usb: dwc3: Move GUID programming after PHY initialization Steven Rostedt <rostedt(a)goodmis.org> tracing/probes: Limit size of event probe to 3K Yochai Eisenrich <yochaie(a)sweet.security> btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: fix tp_num leak on kmalloc failure Jiexun Wang <wangjiexun2025(a)gmail.com> batman-adv: stop tp_meter sessions during mesh teardown Viorel Suman (OSS) <viorel.suman(a)oss.nxp.com> pwm: imx-tpm: Count the number of enabled channels in probe Sanjaikumar V S <sanjaikumar.vs(a)dicortech.com> mtd: spi-nor: sst: Fix write enable before AAI sequence Bence Csókás <csokas.bence(a)prolan.hu> mtd: spi-nor: sst: Factor out common write operation to `sst_nor_write_data()` Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger SeongJae Park <sj(a)kernel.org> mm/damon/reclaim: detect and use fresh enabled and kdamond_pid values Amit Sunil Dhamne <amitsd(a)google.com> usb: typec: tcpm: reset internal port states on soft reset AMS SeongJae Park <sj(a)kernel.org> mm/damon/lru_sort: detect and use fresh enabled and kdamond_pid values SeongJae Park <sj(a)kernel.org> mm/damon/core: implement damon_kdamond_pid() Hyunwoo Kim <imv4bel(a)gmail.com> rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present SeongJae Park <sj(a)kernel.org> mm/damon/core: disallow time-quota setting zero esz Nikolay Aleksandrov <razor(a)blackwall.org> bonding: fix use-after-free due to enslave fail after slave array update Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() David Howells <dhowells(a)redhat.com> rxrpc: Fix conn-level packet handling to unshare RESPONSE packets Thomas Zimmermann <tzimmermann(a)suse.de> fbcon: Avoid OOB font access if console rotation fails Johan Hovold <johan(a)kernel.org> spi: microchip-core-qspi: fix controller deregistration Li Zetao <lizetao1(a)huawei.com> spi: microchip-core-qspi: Use helper function devm_clk_get_enabled() Sang-Heon Jeon <ekffu200098(a)gmail.com> mm/hugetlb_cma: round up per_node before logging it Johan Hovold <johan(a)kernel.org> spi: uniphier: fix controller deregistration Pei Xiao <xiaopei01(a)kylinos.cn> spi: uniphier: Simplify clock handling with devm_clk_get_enabled() Yang Yingliang <yangyingliang(a)huawei.com> spi: uniphier: switch to use modern name Johan Hovold <johan(a)kernel.org> spi: tegra20-sflash: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: tegra114: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sun6i: fix controller deregistration Yang Yingliang <yangyingliang(a)huawei.com> spi: sun6i: switch to use modern name Johan Hovold <johan(a)kernel.org> spi: zynq-qspi: fix controller deregistration Pei Xiao <xiaopei01(a)kylinos.cn> spi: zynq-qspi: Simplify clock handling with devm_clk_get_enabled() Yang Yingliang <yangyingliang(a)huawei.com> spi: zynq-qspi: switch to use modern name Johan Hovold <johan(a)kernel.org> spi: ti-qspi: fix controller deregistration Yang Yingliang <yangyingliang(a)huawei.com> spi: spi-ti-qspi: switch to use modern name Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> spi: spi-ti-qspi: Convert to platform remove callback returning void Johan Hovold <johan(a)kernel.org> spi: sun4i: fix controller deregistration Yang Yingliang <yangyingliang(a)huawei.com> spi: sun4i: switch to use modern name Johan Hovold <johan(a)kernel.org> spi: syncuacer: fix controller deregistration Yang Yingliang <yangyingliang(a)huawei.com> spi: synquacer: switch to use modern name David Carlier <devnexen(a)gmail.com> Bluetooth: hci_conn: fix potential UAF in create_big_sync Michal Kosiorek <mkosiorek121(a)gmail.com> xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete Michael Bommarito <michael.bommarito(a)gmail.com> xfrm: ah: account for ESN high bits in async callbacks Eric Biggers <ebiggers(a)google.com> net: ipv6: stop checking crypto_ahash_alignmask Eric Biggers <ebiggers(a)google.com> net: ipv4: stop checking crypto_ahash_alignmask Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: seq: Fix UMP group 16 filtering Takashi Iwai <tiwai(a)suse.de> ALSA: seq: Notify client and port info changes Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: core: Serialize deferred fasync state checks Takashi Iwai <tiwai(a)suse.de> ALSA: misc: Use guard() for spin locks Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: hda: cs35l56: Propagate ASP TX source control errors David Carlier <devnexen(a)gmail.com> tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() Sam Edwards <cfsworks(a)gmail.com> net: stmmac: Prevent NULL deref when RX memory exhausted Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY() Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> net: stmmac: avoid shadowing global buf_sz Thorsten Blum <thorsten.blum(a)linux.dev> crypto: caam - guard HMAC key hex dumps in hash_digest_key Thorsten Blum <thorsten.blum(a)linux.dev> printk: add print_hex_dump_devel() Junrui Luo <moonafterrain(a)outlook.com> erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap() Thorsten Blum <thorsten.blum(a)linux.dev> crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx Ard Biesheuvel <ardb(a)kernel.org> crypto: nx - Migrate to scomp API Gustavo A. R. Silva <gustavoars(a)kernel.org> crypto: nx - Avoid -Wflex-array-member-not-at-end warning DaeMyung Kang <charsyam(a)gmail.com> ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id() Yi Cong <yicong(a)kylinos.cn> wifi: rtl8xxxu: fix potential use of uninitialized value Zilin Guan <zilin(a)seu.edu.cn> hfsplus: fix held lock freed on hfsplus_fill_super() Deepanshu Kartikey <kartikey406(a)gmail.com> hfsplus: fix uninit-value by validating catalog record size Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> xfs: fix a resource leak in xfs_alloc_buftarg() Luke Wang <ziniu.wang_1(a)nxp.com> mmc: core: Optimize time for secure erase/trim for some Kingston eMMCs Seohyeon Maeng <bioloidgp(a)gmail.com> udf: fix partition descriptor append bookkeeping Thomas Zimmermann <tzimmermann(a)suse.de> firmware: google: framebuffer: Do not unregister platform device Thomas Zimmermann <tzimmermann(a)suse.de> fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info Johan Hovold <johan(a)kernel.org> spi: fix resource leaks on device setup failure Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Limit the total number of nodes Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Limit the maximum number of lookups Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Limit the maximum server registration per node Zhengchuan Liang <zcliangcn(a)gmail.com> net: bridge: use a stable FDB dst snapshot in RCU readers Yuan Zhaoming <yuanzm2(a)lenovo.com> net: mctp: fix don't require received header reserved bits to be zero Long Li <longli(a)microsoft.com> RDMA/mana_ib: Disable RX steering on RSS QP destroy Joseph Salisbury <joseph.salisbury(a)oracle.com> sched: Use u64 for bandwidth ratio calculations Naman Jain <namjain(a)linux.microsoft.com> block: relax pgmap check in bio_add_page for compatible zone device pages Oliver Neukum <oneukum(a)suse.com> media: rc: igorplugusb: heed coherency rules Thorsten Blum <thorsten.blum(a)linux.dev> ALSA: aoa: Skip devices with no codecs in i2sbus_resume() Oliver Neukum <oneukum(a)suse.com> media: rc: ttusbir: respect DMA coherency rules Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: aoa: i2sbus: clear stale prepared state Takashi Iwai <tiwai(a)suse.de> ALSA: aoa: Use guard() for mutex locks Corey Minyard <corey(a)minyard.net> ipmi:ssif: Clean up kthread on errors Corey Minyard <corey(a)minyard.net> ipmi:ssif: Fix a shutdown race Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> thermal: core: Fix thermal zone governor cleanup issues Daniel Hodges <git(a)danielhodges.dev> PCI: epf-mhi: Return 0, not remaining timeout, when eDMA ops complete Sean Wang <sean.wang(a)mediatek.com> wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling Sean Wang <sean.wang(a)mediatek.com> wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor Deren Wu <deren.wu(a)mediatek.com> wifi: mt76: connac: introduce helper for mt7925 chipset Anshuman Khandual <anshuman.khandual(a)arm.com> arm64/mm: Enable batched TLB flush in unmap_hotplug_range() Alistair Popple <apopple(a)nvidia.com> lib: test_hmm: evict device pages on file close to avoid use-after-free Daniel Hodges <git(a)danielhodges.dev> wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() Chao Yu <chao(a)kernel.org> f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: replace connection list with hash table Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: use msleep instaed of schedule_timeout_interruptible() Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io() Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: validate the whole DACL before rewriting it in cifsacl Michael Bommarito <michael.bommarito(a)gmail.com> ksmbd: require minimum ACE size in smb_check_perm_dacl() Namjae Jeon <linkinjeon(a)kernel.org> smb: common: change the data type of num_aces to le16 ChenXiaoSong <chenxiaosong(a)kylinos.cn> smb: move some duplicate definitions to common/smbacl.h Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: put backbone reference on failed claim hash insert Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: only purge non-released claims Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: prevent use-after-free when deleting claims Jiexun Wang <wangjiexun2025(a)gmail.com> batman-adv: stop caching unowned originator pointers in BAT IV Jiexun Wang <wangjiexun2025(a)gmail.com> batman-adv: reject new tp_meter sessions during teardown Lyes Bourennani <lbourennani(a)fuzzinglabs.com> batman-adv: fix integer overflow on buff_pos Ben Morris <bmorris(a)anthropic.com> sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/pm: align Hawaii mclk workaround with radeon Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/pm: add missing revision check for CI John B. Moore <jbmoore61(a)gmail.com> drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission John B. Moore <jbmoore61(a)gmail.com> drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ Philip Yang <Philip.Yang(a)amd.com> drm/amdgpu: zero-initialize GART table on allocation Alex Deucher <alexander.deucher(a)amd.com> drm/radeon: add missing revision check for CI Alysa Liu <Alysa.Liu(a)amd.com> drm/amdkfd: validate SVM ioctl nattr against buffer size Ashutosh Desai <ashutoshdesai993(a)gmail.com> drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vce: Prevent partial address patches Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vcn4: Prevent OOB reads when parsing IB Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu: Add bounds checking to ib_{get,set}_value Alysa Liu <Alysa.Liu(a)amd.com> drm/amdkfd: Add upper bound check for num_of_nodes Amir Shetaia <Amir.Shetaia(a)amd.com> drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure Johan Hovold <johan(a)kernel.org> spi: cadence: fix unclocked access on unbind Johan Hovold <johan(a)kernel.org> spi: cadence: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: mpc52xx: fix use-after-free on unbind Johan Hovold <johan(a)kernel.org> spi: orion: fix clock imbalance on registration failure Johan Hovold <johan(a)kernel.org> spi: orion: fix runtime pm leak on unbind Johan Hovold <johan(a)kernel.org> spi: imx: fix runtime pm leak on probe deferral Johan Hovold <johan(a)kernel.org> spi: img-spfi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: rspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sprd: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: coldfire-qspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: bcmbca-hsspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: fsl: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sh-hspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: mtk-nor: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: omap2-mcspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: fsl-espi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: s3c64xx: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: dln2: fix controller deregistration Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> media: omap3isp: drop the use count of v4l2 pipeline Matthias Fend <matthias.fend(a)emfend.at> media: i2c: ov08d10: fix image vertical start setting Michael Tretter <m.tretter(a)pengutronix.de> media: staging: imx: request mbus_config in csi_start Wenmeng Liu <wenmeng.liu(a)oss.qualcomm.com> media: i2c: imx412: Assert reset GPIO during probe Sergey Shtylyov <s.shtylyov(a)auroraos.dev> media: dib8000: avoid division by 0 in dib8000_set_dds() Abdun Nihaal <nihaal(a)cse.iitm.ac.in> media: pci: zoran: fix potential memory leak in zoran_probe() Krishna Chomal <krishna.chomal108(a)gmail.com> platform/x86: hp-wmi: Ignore backlight and FnLock events Wang Jun <1742789905(a)qq.com> media: saa7164: add ioremap return checks and cleanups Johan Hovold <johan(a)kernel.org> spi: at91-usart: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: qup: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: lantiq-ssc: fix controller deregistration Johan Hovold <johan(a)kernel.org> regulator: bd9571mwv: fix OF node reference imbalance Johan Hovold <johan(a)kernel.org> regulator: act8945a: fix OF node reference imbalance Janne Grunau <j(a)jannau.net> media: videobuf2: Set vma_flags in vb2_dma_sg_mmap Johan Hovold <johan(a)kernel.org> regulator: rk808: fix OF node reference imbalance Oliver Neukum <oneukum(a)suse.com> media: rc: streamzap: Error handling in probe Oliver Neukum <oneukum(a)suse.com> media: rc: xbox_remote: heed DMA restrictions Johan Hovold <johan(a)kernel.org> regulator: max77650: fix OF node reference imbalance Johan Hovold <johan(a)kernel.org> regulator: mt6357: fix OF node reference imbalance Sakari Ailus <sakari.ailus(a)linux.intel.com> staging: media: atomisp: Disallow all private IOCTLs Johan Hovold <johan(a)kernel.org> spi: atmel: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: bcm63xx: fix controller deregistration Alexander Koskovich <akoskovich(a)pm.me> media: i2c: ov8856: free control handler on error in ov8856_init_controls() Ricardo Ribalda <ribalda(a)chromium.org> media: uvcvideo: Enable VB2_DMABUF for metadata stream T.J. Mercier <tjmercier(a)google.com> HID: playstation: Clamp num_touch_reports Paul E. McKenney <paulmck(a)kernel.org> exit: Sleep at TASK_IDLE when waiting for application core dump Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Use per-root-bridge PCIH flag to skip mem resource fixup Wentao Guan <guanwentao(a)uniontech.com> LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang() Quentin Perret <qperret(a)google.com> KVM: arm64: Fix initialisation order in __pkvm_init_finalise() David Woodhouse <dwmw(a)amazon.co.uk> KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix node_cnt race between extent node destroy and writeback Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix incorrect multidevice info in trace_f2fs_map_blocks() Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix fiemap boundary handling when read extent cache is incomplete Cen Zhang <zzzccc427(a)gmail.com> f2fs: add READ_ONCE() for i_blocks in f2fs_update_inode() Gang Yan <yangang(a)kylinos.cn> mptcp: fix scheduling with atomic in timestamp sockopt Gang Yan <yangang(a)kylinos.cn> mptcp: sockopt: set timestamp flags on subflow socket, not msk Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: fastclose msk when linger time is 0 Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/rxe: Reject unknown opcodes before ICRC processing Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() Junrui Luo <moonafterrain(a)outlook.com> RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() André Draszik <andre.draszik(a)linaro.org> power: supply: max17042: avoid overflow when determining health Lukas Wunner <lukas(a)wunner.de> PCI/AER: Stop ruling out unbound devices as error source Shuai Xue <xueshuai(a)linux.alibaba.com> PCI/AER: Clear only error bits in PCIe Device Status SeongJae Park <sj(a)kernel.org> mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock Paolo Bonzini <pbonzini(a)redhat.com> KVM: x86: check for nEPT/nNPT in slow flush hypercalls Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: validate dacloffset before building DACL pointers Zisen Ye <zisenye(a)stu.xidian.edu.cn> smb/client: fix out-of-bounds read in symlink_data() Zisen Ye <zisenye(a)stu.xidian.edu.cn> smb/client: fix out-of-bounds read in smb2_compound_op() Vasily Gorbik <gor(a)linux.ibm.com> s390/debug: Reject zero-length input in debug_input_flush_fn() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/hns: Fix unlocked call to hns_roce_qp_remove() Ilya Maximets <i.maximets(a)ovn.org> openvswitch: vport: fix self-deadlock on release of tunnel ports Chaitanya Kulkarni <kch(a)nvidia.com> nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free Fedor Pchelkin <pchelkin(a)ispras.ru> nvme-apple: drop invalid put of admin queue reference count Junrui Luo <moonafterrain(a)outlook.com> md/raid10: fix divide-by-zero in setup_geo() with zero far_copies Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Fix slab-out-of-bounds access in auth message processing Christian A. Ehrhardt <lk(a)c--e.de> lib/scatterlist: fix temp buffer in extract_user_to_sg() Christian A. Ehrhardt <lk(a)c--e.de> lib/scatterlist: fix length calculations in extract_kvec_to_sg Lukas Wunner <lukas(a)wunner.de> lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() Michael Bommarito <michael.bommarito(a)gmail.com> isofs: validate block number from NFS file handle in isofs_export_iget Michael Bommarito <michael.bommarito(a)gmail.com> isofs: validate Rock Ridge CE continuation extent against volume size Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: correctly reject too-small hash devices Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: correctly reject too-small FEC devices David Carlier <devnexen(a)gmail.com> eventfs: Hold eventfs_mutex and SRCU when remount walks events Mikulas Patocka <mpatocka(a)redhat.com> dm: fix a buffer overflow in ioctl processing Mikulas Patocka <mpatocka(a)redhat.com> dm: don't report warning when doing deferred remove Mikulas Patocka <mpatocka(a)redhat.com> dm-thin: fix metadata refcount underflow Guangshuo Li <lgs201920130244(a)gmail.com> btrfs: fix double free in create_space_info() error path Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm: remove child devices when apm is removed Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error Joseph Salisbury <joseph.salisbury(a)oracle.com> ASoC: fsl_easrc: fix comment typo Tommaso Soncin <soncintommaso(a)gmail.com> ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table Shrikanth Hegde <sshegde(a)linux.ibm.com> cpuidle: powerpc: avoid double clear when breaking snooze Conor Dooley <conor.dooley(a)microchip.com> clk: microchip: mpfs-ccc: fix out of bounds access during output registration Stefan Eichenberger <stefan.eichenberger(a)toradex.com> clk: imx: imx8-acm: fix flags for acm clocks Johan Hovold <johan(a)kernel.org> spi: topcliff-pch: fix use-after-free on unbind Thorsten Blum <thorsten.blum(a)linux.dev> thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp Thorsten Blum <thorsten.blum(a)linux.dev> thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata Michael Bommarito <michael.bommarito(a)gmail.com> udf: reject descriptors with oversized CRC length Mingming Cao <mmc(a)linux.ibm.com> ibmveth: Disable GSO for packets with small MSS Hamza Mahfooz <hamzamahfooz(a)linux.microsoft.com> hv_sock: fix ARM64 support Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> gpio: of: clear OF_POPULATED on hog nodes in remove path Xu Yang <xu.yang_2(a)nxp.com> extcon: ptn5150: handle pending IRQ events during system resume Shyam Prasad N <sprasad(a)microsoft.com> cifs: change_conf needs to be called for session setup Shyam Prasad N <sprasad(a)microsoft.com> cifs: abort open_cached_dir if we don't request leases Naman Jain <namjain(a)linux.microsoft.com> block: add pgmap check to biovec_phys_mergeable Jiexun Wang <wangjiexun2025(a)gmail.com> af_unix: Reject SIOCATMARK on non-stream sockets Myeonghun Pak <mhun512(a)gmail.com> hwmon: (corsair-psu) Close HID device on probe errors Johan Hovold <johan(a)kernel.org> clk: rk808: fix OF node reference imbalance Sanman Pradhan <psanman(a)juniper.net> hwmon: (ltc2992) Fix u32 overflow in power read path Sanman Pradhan <psanman(a)juniper.net> hwmon: (ltc2992) Clamp threshold writes to hardware range Hongling Zeng <zenghongling(a)kylinos.cn> parisc: Fix IRQ leak in LASI driver Pavitra Jha <jhapavitra98(a)gmail.com> net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler Nan Li <tonanli66(a)gmail.com> net/rds: handle zerocopy send cleanup before the message is queued Maoyi Xie <maoyixie.tju(a)gmail.com> ip6_gre: Use cached t->net in ip6erspan_changelink(). Jiawen Wu <jiawenwu(a)trustnetic.com> net: libwx: fix VF illegal register access SeungJu Cheon <suunj1331(a)gmail.com> sound: ua101: fix division by zero at probe Kai Zen <kai.aizen.dev(a)gmail.com> net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo Tudor Ambarus <tudor.ambarus(a)linaro.org> mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show() Miklos Szeredi <mszeredi(a)redhat.com> fanotify: fix false positive on permission events Johan Hovold <johan(a)kernel.org> staging: vme_user: fix root device leak on init failure Johan Hovold <johan(a)kernel.org> spi: s3c64xx: fix NULL-deref on driver unbind Johan Hovold <johan(a)kernel.org> spi: zynqmp-gqspi: fix controller deregistration Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: virtio_bt: validate rx pkt_type header length Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: virtio_bt: clamp rx length before skb_put Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: prune /sys/fs/selinux/disable Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: shrink critical section in sel_write_load() David Windsor <dwindsor(a)gmail.com> selinux: don't reserve xattr slot when we won't fill it Yilin Zhu <zylzyl2333(a)gmail.com> ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() Ruijie Li <ruijieli51(a)gmail.com> xfrm: provide message size for XFRM_MSG_MAPPING Sourabh Jain <sourabhjain(a)linux.ibm.com> powerpc/kdump: fix KASAN sanitization flag for core_$(BITS).o Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: firewire-tascam: Do not drop unread control events Felix Gu <ustc.gu(a)gmail.com> usb: ulpi: fix memory leak on ulpi_register() error paths Fabio Porcedda <fabio.porcedda(a)gmail.com> USB: serial: option: add Telit Cinterion LE910Cx compositions Aaro Koskinen <aaro.koskinen(a)iki.fi> USB: omap_udc: DMA: Don't enable burst 4 mode Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Fix UAC3 cluster descriptor size check Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: midi2: Restart output URBs on resume Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: usblp: fix heap leak in IEEE 1284 device ID via short response Marek Szyprowski <m.szyprowski(a)samsung.com> wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task Tristan Madani <tristan(a)talencesecurity.com> wifi: b43: enforce bounds check on firmware key index in b43_rx() Johannes Berg <johannes.berg(a)intel.com> wifi: mac80211: remove station if connection prep fails Jiri Slaby (SUSE) <jirislaby(a)kernel.org> wifi: ath5k: do not access array OOB Jeongjun Park <aha310510(a)gmail.com> wifi: rsi: fix kthread lifetime race between self-exit and external-stop Catherine <enderaoelyther(a)gmail.com> wifi: mac80211: drop stray 'static' from fast-RX rx_result Tristan Madani <tristan(a)talencesecurity.com> wifi: b43legacy: enforce bounds check on firmware key index in RX path Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work Leon Yen <leon.yen(a)mediatek.com> wifi: mt76: mt7921: fix a potential clc buffer length underflow Jann Horn <jannh(a)google.com> exit: prevent preemption of oopsing TASK_DEAD task Kumar Kartikeya Dwivedi <memxor(a)gmail.com> bpf: Don't mark STACK_INVALID as STACK_MISC in mark_stack_slot_misc Andrii Nakryiko <andrii(a)kernel.org> selftests/bpf: validate fake register spill/fill precision backtracking logic Andrii Nakryiko <andrii(a)kernel.org> bpf: handle fake register spill to stack with BPF_ST_MEM instruction Andrii Nakryiko <andrii(a)kernel.org> selftests/bpf: validate precision logic in partial_stack_load_preserves_zeros Andrii Nakryiko <andrii(a)kernel.org> bpf: track aligned STACK_ZERO cases as imprecise spilled registers Andrii Nakryiko <andrii(a)kernel.org> selftests/bpf: validate zero preservation for sub-slot loads Andrii Nakryiko <andrii(a)kernel.org> bpf: preserve constant zero when doing partial register restore Andrii Nakryiko <andrii(a)kernel.org> selftests/bpf: validate STACK_ZERO is preserved on subreg spill Andrii Nakryiko <andrii(a)kernel.org> bpf: preserve STACK_ZERO slots on partial reg spills Andrii Nakryiko <andrii(a)kernel.org> selftests/bpf: add stack access precision test Andrii Nakryiko <andrii(a)kernel.org> bpf: support non-r10 register spill/fill to/from stack in precision tracking Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked Paolo Bonzini <pbonzini(a)redhat.com> KVM: SVM: check validity of VMCB controls when returning from SMM Vinicius Costa Gomes <vinicius.gomes(a)intel.com> dmaengine: idxd: Fix leaking event log memory Vinicius Costa Gomes <vinicius.gomes(a)intel.com> dmaengine: idxd: Fix crash when the event log is disabled Jiawen Wu <jiawenwu(a)trustnetic.com> net: txgbe: fix RTNL assertion warning when remove module Qingfang Deng <qingfang.deng(a)linux.dev> flow_dissector: do not dissect PPPoE PFC frames Dong Chenchen <dongchenchen2(a)huawei.com> net: Fix icmp host relookup triggering ip_rt_bug Ankit Soni <Ankit.Soni(a)amd.com> iommu/amd: serialize sequence allocation under concurrent TLB invalidations Uros Bizjak <ubizjak(a)gmail.com> iommu/amd: Use atomic64_inc_return() in iommu.c Sean Christopherson <seanjc(a)google.com> KVM: x86: Fix shadow paging use-after-free due to unexpected GFN David Howells <dhowells(a)redhat.com> rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets Tejas Bharambe <tejas.bharambe(a)outlook.com> ext4: validate p_idx bounds in ext4_ext_correct_indexes David Howells <dhowells(a)redhat.com> rxrpc: Fix potential UAF after skb_unshare() failure Felix Gu <ustc.gu(a)gmail.com> spi: meson-spicc: Fix double-put in remove path Rick Edgecombe <rick.p.edgecombe(a)intel.com> x86/shstk: Prevent deadlock during shstk sigreturn Yussuf Khalil <dev(a)pp3345.net> drm/amd/display: Do not skip unrelated mode changes in DSC validation Linus Torvalds <torvalds(a)linux-foundation.org> x86: shadow stacks: proper error handling for mmap lock Johan Hovold <johan(a)kernel.org> spi: rockchip: fix controller deregistration Mark Brown <broonie(a)kernel.org> ASoC: SOF: Don't allow pointer operations on unconfigured streams Sina Hassani <sina(a)openai.com> iommufd: Fix a race with concurrent allocation and unmap Shivam Kalra <shivamkalra98(a)zohomail.in> ACPI: video: force native backlight on HP OMEN 16 (8A44) Jinjie Ruan <ruanjinjie(a)huawei.com> ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug Guangshuo Li <lgs201920130244(a)gmail.com> ACPI: scan: Use acpi_dev_put() in object add error paths Rajat Gupta <rajgupt(a)qti.qualcomm.com> fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free Corey Minyard <corey(a)minyard.net> ipmi:si: Return state to normal if message allocation fails Corey Minyard <corey(a)minyard.net> ipmi: Check event message buffer response for bad data Corey Minyard <corey(a)minyard.net> ipmi: Add limits to event and receive message requests Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() Kai Ma <k4729.23098(a)gmail.com> netfilter: reject zero shift in nft_bitwise Andrea Mayer <andrea.mayer(a)uniroma2.it> net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels Deepanshu Kartikey <kartikey406(a)gmail.com> ALSA: caiaq: fix usb_dev refcount leak on probe failure Arjan van de Ven <arjan(a)linux.intel.com> drm/amdgpu: fix zero-size GDS range init on RDNA4 Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> ipv6: rpl: reserve mac_len headroom when recompressed SRH grows Takashi Iwai <tiwai(a)suse.de> ALSA: caiaq: Don't abort when no input device is available Takashi Iwai <tiwai(a)suse.de> ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path Douglas Anderson <dianders(a)chromium.org> driver core: Add kernel-doc for DEV_FLAG_COUNT enum value Yucheng Lu <kanolyc(a)gmail.com> crypto: authencesn - reject short ahash digests during instance creation Andrea Mayer <andrea.mayer(a)uniroma2.it> seg6: fix seg6 lwtunnel output redirect for L2 reduced encap mode Yang Xiuwei <yangxiuwei(a)kylinos.cn> scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails Keenan Dong <keenanat2000(a)gmail.com> rtmutex: Use waiter::task instead of current in remove_waiter() Tobias Gaertner <tob.gaertner(a)me.com> ntfs3: fix integer overflow in run_unpack() volume boundary check Tobias Gaertner <tob.gaertner(a)me.com> ntfs3: add buffer boundary checks to run_unpack() Steven Rostedt <rostedt(a)goodmis.org> ktest: Fix the month in the name of the failure directory Chen Zhao <chezhao(a)nvidia.com> IB/core: Fix zero dmac race in neighbor resolution Junrui Luo <moonafterrain(a)outlook.com> dm mirror: fix integer overflow in create_dirty_log() Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-tdes - fix DMA sync direction Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> crypto: ccree - fix a memory leak in cc_mac_digest() Thomas Fourier <fourier.thomas(a)gmail.com> crypto: hisilicon - Fix dma_unmap_single() direction Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-ecc - Release client on allocation failure Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup Eric Biggers <ebiggers(a)kernel.org> crypto: arm64/aes - Fix 32-bit aes_mac_update() arg treated as 64-bit Johan Hovold <johan(a)kernel.org> can: ucan: fix devres lifetime Shuvam Pandey <shuvampandey1(a)gmail.com> Bluetooth: hci_event: fix potential UAF in SSP passkey handlers Yiyang Chen <cyyzero16(a)gmail.com> taskstats: set version in TGID exit notifications Zhenzhong Wu <jt26wzz(a)gmail.com> tcp: call sk_data_ready() after listener migration Chia-Ming Chang <chiamingc(a)synology.com> inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails Junrui Luo <moonafterrain(a)outlook.com> md/raid5: validate payload size before accessing journal metadata Chia-Ming Chang <chiamingc(a)synology.com> md/raid5: fix soft lockup in retry_aligned_read() Sohei Koyama <skoyama(a)ddn.com> ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() Deepanshu Kartikey <kartikey406(a)gmail.com> ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access Jens Axboe <axboe(a)kernel.dk> io_uring/poll: fix multishot recv missing EOF on wakeup race James Kim <james010kim(a)gmail.com> mtd: docg3: fix use-after-free in docg3_release() Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> mtd: docg3: Convert to platform remove callback returning void Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Add missing consistency check for nCR3 validity Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Add missing consistency check for EFER, CR0, CR4, and CS Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Clear tracking of L1->L2 NMI and soft IRQ on nested #VMEXIT Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Clear EVENTINJ fields in vmcb12 on nested #VMEXIT Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID) Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Always inject a #GP if mapping VMCB12 fails on nested VMRUN Yosry Ahmed <yosry.ahmed(a)linux.dev> KVM: nSVM: Use vcpu->arch.cr2 when updating vmcb12 on nested #VMEXIT Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode Sean Christopherson <seanjc(a)google.com> KVM: SVM: Explicitly mark vmcb01 dirty after modifying VMCB intercepts Kevin Cheng <chengkev(a)google.com> KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Sync NextRIP to cached vmcb12 after VMRUN of L2 Yosry Ahmed <yosry.ahmed(a)linux.dev> KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state Sean Christopherson <seanjc(a)google.com> KVM: x86: Defer non-architectural deliver of exception payload to userspace read Denis M. Karpov <komlomal(a)gmail.com> userfaultfd: allow registration of ranges below mmap_min_addr SeongJae Park <sj(a)kernel.org> mm/damon/core: use time_in_range_open() for damos quota window start Johan Hovold <johan(a)kernel.org> rtc: ntxec: fix OF node reference imbalance Jacqueline Wong <jacqwong(a)google.com> tpm: tpm_tis: stop transmit if retries are exhausted Jacqueline Wong <jacqwong(a)google.com> tpm: tpm_tis: add error logging for data transfer Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos - rename first/last to first_desc/last_desc Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos - fix SEC1 32k ahash request limitation Francesco Dolcini <francesco.dolcini(a)toradex.com> arm64: dts: ti: am62-verdin: Enable pullup for eMMC data pins Shawn Lin <shawn.lin(a)rock-chips.com> mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration Bin Liu <b-liu(a)ti.com> mmc: block: use single block write in retry Ryan Roberts <ryan.roberts(a)arm.com> randomize_kstack: Maintain kstack_offset per task Krzysztof Kozlowski <krzysztof.kozlowski(a)oss.qualcomm.com> power: supply: axp288_charger: Do not cancel work before initializing it Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Show CPU vulnerabilites correctly Arnd Bergmann <arnd(a)arndb.de> tpm: avoid -Wunused-but-set-variable Nathan Chancellor <nathan(a)kernel.org> extract-cert: Wrap key_pass with '#ifdef USE_PKCS11_ENGINE' Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() Ruide Cao <caoruide123(a)gmail.com> ipv4: icmp: validate reply type before using icmp_pointers hkbinbin <hkbinbinbin(a)gmail.com> RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv Luca Ceresoli <luca.ceresoli(a)bootlin.com> drm/arcpgu: fix device node leak Marek Vasut <marex(a)nabladev.com> net: ks8851: Avoid excess softirq scheduling Marek Vasut <marex(a)nabladev.com> net: ks8851: Reinstate disabling of BHs around IRQ handler Ruijie Li <ruijieli51(a)gmail.com> net/smc: avoid early lgr access in smc_clc_wait_msg Jiawen Wu <jiawenwu(a)trustnetic.com> net: txgbe: fix firmware version check Ao Zhou <draw51280(a)163.com> net: rds: fix MR cleanup on copy error Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Free the node during ctrl_cmd_bye() Yiyang Chen <cyyzero16(a)gmail.com> tools/accounting: handle truncated taskstats netlink messages David Howells <dhowells(a)redhat.com> rxrpc: Fix re-decryption of RESPONSE packets David Howells <dhowells(a)redhat.com> rxrpc: Fix rxkad crypto unalignment handling David Howells <dhowells(a)redhat.com> rxrpc: Fix memory leaks in rxkad_verify_response() Jonathan Santos <Jonathan.Santos(a)analog.com> iio: adc: ad7768-1: fix one-shot mode data acquisition Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: pcmtest: Fix resource leaks in module init error paths Guangshuo Li <lgs201920130244(a)gmail.com> ALSA: pcmtest: fix reference leak on failed device registration Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: 6fire: Fix input volume change detection Takashi Iwai <tiwai(a)suse.de> ALSA: caiaq: Handle probe errors properly Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: caiaq: Fix control_put() result and cache rollback Takashi Iwai <tiwai(a)suse.de> ALSA: core: Fix potential data race at fasync handling Jens Axboe <axboe(a)kernel.dk> io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE Longxuan Yu <ylong030(a)ucr.edu> io_uring/poll: fix signed comparison in io_poll_get_ownership() David Lechner <dlechner(a)baylibre.com> iio: adc: ti-ads7950: use iio_push_to_buffers_with_ts_unaligned() Pavel Begunkov <asml.silence(a)gmail.com> io_uring/timeout: check unused sqe fields Dawei Feng <dawei.feng(a)seu.edu.cn> rbd: fix null-ptr-deref when device_add_disk() fails Simon Liebold <simonlie(a)amazon.de> selftests/mqueue: Fix incorrectly named file Ben Levinsky <ben.levinsky(a)amd.com> remoteproc: xlnx: Only access buffer information if IPI is buffered Helge Deller <deller(a)gmx.de> parisc: _llseek syscall is only available for 32-bit userspace Robert Beckett <bob.beckett(a)collabora.com> nvme: respect NVME_QUIRK_DISABLE_WRITE_ZEROES when wzsl is set Robert Beckett <bob.beckett(a)collabora.com> nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4 Marek Vasut <marex(a)nabladev.com> mfd: stpmic1: Attempt system shutdown twice in case PMIC is confused Josh Hunt <johunt(a)akamai.com> md/raid10: fix deadlock with check operation and nowait requests Gao Xiang <xiang(a)kernel.org> erofs: fix the out-of-bounds nameoff handling for trailing dirents Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes Harin Lee <me(a)harin.net> ALSA: ctxfi: Add fallback to default RSR for S/PDIF Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: aoa: i2sbus: fix OF node lifetime handling Vasiliy Kovalev <kovalev(a)altlinux.org> ext2: reject inodes with zero i_nlink and valid mode in ext2_iget() Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Fix use-after-free in driver remove() Chen Ni <nichen(a)iscas.ac.cn> media: i2c: imx219: Check return value of devm_gpiod_get_optional() in imx219_probe() Josh Law <objecting(a)objecting.org> lib/ts_kmp: fix integer overflow in pattern length calculation Rong Zhang <i(a)rong.moe> Revert "ALSA: usb: Increase volume range that triggers a warning" Koichiro Den <den(a)valinux.co.jp> PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown Fan Wu <fanwu01(a)zju.edu.cn> media: mtk-jpeg: fix use-after-free in release path due to uncancelled work Luxiao Xu <rakukuip(a)gmail.com> net: strparser: fix skb_head leak in strp_abort_strp() Zhengchuan Liang <zcliangcn(a)gmail.com> net: caif: clear client service pointer on teardown Ziqing Chen <chenziqing(a)xiaomi.com> ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() Ming Qian <ming.qian(a)oss.nxp.com> media: amphion: Fix race between m2m job_abort and device_run Wentao Liang <vulab(a)iscas.ac.cn> of: unittest: fix use-after-free in testdrv_probe() Herbert Xu <herbert(a)gondor.apana.org.au> crypto: pcrypt - Fix handling of MAY_BACKLOG requests Chao Yu <chao(a)kernel.org> f2fs: fix to detect potential corrupted nid in free_nid_list Johan Hovold <johan(a)kernel.org> spi: imx: fix use-after-free on unbind Michael Bommarito <michael.bommarito(a)gmail.com> um: drivers: call kernel_strrchr() explicitly in cow_user.c Fedor Pchelkin <pchelkin(a)ispras.ru> wifi: rtw88: check for PCI upstream bridge existence Sergey Senozhatsky <senozhatsky(a)chromium.org> zram: do not forget to endio for partial discard requests Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> LoongArch: Add spectre boundry for syscall dispatch table Douglas Anderson <dianders(a)chromium.org> driver core: Don't let a device probe until it's ready Heming Zhao <heming.zhao(a)suse.com> ocfs2: split transactions in dio completion to avoid credit exhaustion Douglas Anderson <dianders(a)chromium.org> device property: Make modifications of fwnode "flags" thread safe Douglas Anderson <dianders(a)chromium.org> regset: use kvzalloc() for regset_get_alloc() Jesse.Zhang <Jesse.Zhang(a)amd.com> drm/amdgpu: Limit BO list entry count to prevent resource exhaustion Tvrtko Ursulin <tvrtko.ursulin(a)igalia.com> drm/amdgpu: Use vmemdup_array_user in amdgpu_bo_create_list_entry_array Herbert Xu <herbert(a)gondor.apana.org.au> padata: Remove comment for reorder_work Herbert Xu <herbert(a)gondor.apana.org.au> padata: Fix pd UAF once and for all Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: MGMT: Fix possible UAFs Thomas Zimmermann <tzimmermann(a)suse.de> firmware: google: framebuffer: Do not mark framebuffer as busy Tyllis Xu <livelycarpet87(a)gmail.com> ibmasm: fix heap over-read in ibmasm_send_i2o_message() Tyllis Xu <livelycarpet87(a)gmail.com> ibmasm: fix OOB reads in command_file_write due to missing size checks Tyllis Xu <livelycarpet87(a)gmail.com> misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> leds: qcom-lpg: Check for array overflow when selecting the high resolution Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> drm/nouveau: fix u32 overflow in pushbuf reloc bounds check Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Evaluate packsize caps at the right place Xu Yang <xu.yang_2(a)nxp.com> usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change Xu Yang <xu.yang_2(a)nxp.com> usb: chipidea: otg: not wait vbus drop if use role_switch Michal Pecio <michal.pecio(a)gmail.com> usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Avoid false E-MU sample-rate notifications Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES ------------- Diffstat: Makefile | 4 +- arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi | 20 +- arch/arm64/crypto/aes-modes.S | 4 +- arch/arm64/kvm/arm.c | 5 + arch/arm64/kvm/hyp/nvhe/setup.c | 8 +- arch/arm64/kvm/vgic/vgic-mmio-v2.c | 2 +- arch/arm64/kvm/vgic/vgic-mmio-v3.c | 2 +- arch/arm64/mm/mmu.c | 36 ++- arch/loongarch/kernel/cpu-probe.c | 7 + arch/loongarch/kernel/syscall.c | 3 +- arch/loongarch/pci/acpi.c | 5 + arch/loongarch/pci/pci.c | 3 + arch/parisc/kernel/syscalls/syscall.tbl | 2 +- arch/powerpc/kexec/Makefile | 2 +- arch/s390/kernel/debug.c | 5 + arch/um/drivers/cow_user.c | 8 +- arch/x86/kernel/shstk.c | 45 ++- arch/x86/kvm/hyperv.c | 2 +- arch/x86/kvm/mmu/mmu.c | 35 +-- arch/x86/kvm/svm/nested.c | 56 +++- arch/x86/kvm/svm/svm.c | 17 ++ arch/x86/kvm/svm/svm.h | 2 + arch/x86/kvm/x86.c | 62 ++-- block/bio-integrity.c | 2 + block/bio.c | 14 +- block/blk.h | 21 ++ certs/extract-cert.c | 6 +- crypto/authencesn.c | 5 + crypto/pcrypt.c | 7 +- drivers/acpi/cppc_acpi.c | 6 +- drivers/acpi/power.c | 2 +- drivers/acpi/scan.c | 2 +- drivers/acpi/video_detect.c | 8 + drivers/base/core.c | 39 ++- drivers/base/dd.c | 20 ++ drivers/block/rbd.c | 6 +- drivers/block/zram/zram_drv.c | 3 +- drivers/bluetooth/virtio_bt.c | 39 ++- drivers/bus/imx-weim.c | 2 +- drivers/char/ipmi/ipmi_si_intf.c | 70 ++++- drivers/char/ipmi/ipmi_ssif.c | 36 ++- drivers/char/tpm/tpm_tis_core.c | 11 +- drivers/clk/clk-rk808.c | 2 +- drivers/clk/imx/clk-imx8-acm.c | 3 +- drivers/clk/microchip/clk-mpfs-ccc.c | 6 +- drivers/cpuidle/cpuidle-powernv.c | 5 +- drivers/cpuidle/cpuidle-pseries.c | 5 +- drivers/crypto/atmel-aes.c | 2 +- drivers/crypto/atmel-ecc.c | 1 + drivers/crypto/atmel-sha204a.c | 6 +- drivers/crypto/atmel-tdes.c | 8 +- drivers/crypto/caam/caamalg_qi2.c | 4 +- drivers/crypto/caam/caamhash.c | 4 +- drivers/crypto/ccree/cc_hash.c | 1 + drivers/crypto/hisilicon/sec/sec_algs.c | 2 +- drivers/crypto/nx/nx-842.c | 47 +-- drivers/crypto/nx/nx-842.h | 25 +- drivers/crypto/nx/nx-common-powernv.c | 31 +- drivers/crypto/nx/nx-common-pseries.c | 33 +- drivers/crypto/talitos.c | 340 +++++++++++++-------- drivers/dma/idxd/device.c | 3 +- drivers/extcon/extcon-ptn5150.c | 14 + drivers/firmware/google/framebuffer-coreboot.c | 12 +- drivers/gpio/gpiolib-of.c | 9 +- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 3 +- drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c | 43 ++- drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c | 13 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h | 11 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 3 + drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c | 3 + drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 3 - drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c | 4 +- drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c | 25 +- drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c | 46 ++- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 29 +- drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 4 + drivers/gpu/drm/amd/amdkfd/kfd_topology.c | 11 + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 5 + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h | 1 + .../amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 7 +- .../gpu/drm/amd/pm/powerplay/smumgr/ci_smumgr.c | 13 +- drivers/gpu/drm/drm_gem_framebuffer_helper.c | 4 +- drivers/gpu/drm/nouveau/nouveau_gem.c | 2 +- drivers/gpu/drm/radeon/ci_dpm.c | 9 +- drivers/gpu/drm/tiny/arcpgu.c | 3 +- drivers/hid/hid-playstation.c | 6 +- drivers/hwmon/corsair-psu.c | 4 +- drivers/hwmon/ltc2992.c | 41 ++- drivers/i2c/i2c-core-of.c | 2 +- drivers/iio/adc/ad7768-1.c | 9 +- drivers/iio/adc/ti-ads7950.c | 11 +- drivers/infiniband/core/addr.c | 3 + drivers/infiniband/hw/hns/hns_roce_qp.c | 7 + drivers/infiniband/hw/mana/qp.c | 15 + drivers/infiniband/hw/mlx4/srq.c | 4 +- drivers/infiniband/hw/mlx5/main.c | 1 + drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 4 +- drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c | 2 +- drivers/infiniband/sw/rxe/rxe_recv.c | 14 +- drivers/infiniband/sw/rxe/rxe_resp.c | 14 +- drivers/iommu/amd/amd_iommu_types.h | 2 +- drivers/iommu/amd/init.c | 2 +- drivers/iommu/amd/iommu.c | 18 +- drivers/iommu/iommufd/io_pagetable.c | 10 + drivers/leds/rgb/leds-qcom-lpg.c | 7 +- drivers/md/dm-ioctl.c | 6 +- drivers/md/dm-raid1.c | 6 +- drivers/md/dm-verity-fec.c | 8 +- drivers/md/persistent-data/dm-btree-remove.c | 8 + drivers/md/raid10.c | 6 +- drivers/md/raid5-cache.c | 48 ++- drivers/md/raid5.c | 8 +- drivers/media/common/videobuf2/videobuf2-dma-sg.c | 1 + drivers/media/dvb-frontends/dib8000.c | 4 +- drivers/media/i2c/imx219.c | 3 + drivers/media/i2c/imx412.c | 2 +- drivers/media/i2c/ov08d10.c | 10 +- drivers/media/i2c/ov8856.c | 10 +- drivers/media/pci/saa7164/saa7164-core.c | 47 ++- drivers/media/pci/zoran/zoran_card.c | 2 +- drivers/media/platform/amphion/vpu_v4l2.c | 9 +- .../media/platform/mediatek/jpeg/mtk_jpeg_core.c | 1 + drivers/media/platform/ti/omap3isp/ispvideo.c | 1 + drivers/media/rc/igorplugusb.c | 16 +- drivers/media/rc/streamzap.c | 12 +- drivers/media/rc/ttusbir.c | 13 +- drivers/media/rc/xbox_remote.c | 9 +- drivers/media/usb/uvc/uvc_queue.c | 3 +- drivers/mfd/stpmic1.c | 20 +- drivers/misc/ibmasm/ibmasmfs.c | 7 + drivers/misc/ibmasm/lowlevel.c | 12 +- drivers/misc/ibmasm/remote.c | 5 + drivers/mmc/core/block.c | 12 +- drivers/mmc/core/card.h | 5 + drivers/mmc/core/queue.c | 8 +- drivers/mmc/core/queue.h | 3 + drivers/mmc/core/quirks.h | 9 + drivers/mmc/host/sdhci-of-dwcmshc.c | 19 +- drivers/mtd/devices/docg3.c | 8 +- drivers/mtd/spi-nor/debugfs.c | 4 +- drivers/mtd/spi-nor/sst.c | 50 +-- drivers/net/bonding/bond_main.c | 6 +- drivers/net/can/usb/ucan.c | 2 +- drivers/net/ethernet/ibm/ibmveth.c | 22 ++ drivers/net/ethernet/ibm/ibmveth.h | 1 + drivers/net/ethernet/micrel/ks8851.h | 6 +- drivers/net/ethernet/micrel/ks8851_common.c | 69 ++--- drivers/net/ethernet/micrel/ks8851_par.c | 15 +- drivers/net/ethernet/micrel/ks8851_spi.c | 11 +- drivers/net/ethernet/microsoft/mana/mana_en.c | 11 +- drivers/net/ethernet/stmicro/stmmac/chain_mode.c | 2 +- drivers/net/ethernet/stmicro/stmmac/common.h | 2 +- drivers/net/ethernet/stmicro/stmmac/ring_mode.c | 2 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 47 +-- drivers/net/ethernet/wangxun/libwx/wx_hw.c | 7 +- drivers/net/ethernet/wangxun/txgbe/txgbe_main.c | 3 +- drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c | 2 + drivers/net/phy/mdio_bus.c | 4 +- drivers/net/wireless/ath/ath5k/base.c | 3 +- drivers/net/wireless/broadcom/b43/xmit.c | 3 +- drivers/net/wireless/broadcom/b43legacy/xmit.c | 3 +- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 6 +- drivers/net/wireless/marvell/mwifiex/init.c | 2 +- drivers/net/wireless/mediatek/mt76/mt76_connac.h | 6 + .../net/wireless/mediatek/mt76/mt76_connac_mac.c | 4 +- .../net/wireless/mediatek/mt76/mt76_connac_mcu.c | 3 +- .../net/wireless/mediatek/mt76/mt76_connac_mcu.h | 2 +- drivers/net/wireless/mediatek/mt76/mt7921/main.c | 7 +- drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | 3 + drivers/net/wireless/mediatek/mt76/mt792x_regs.h | 4 + drivers/net/wireless/mediatek/mt76/mt792x_usb.c | 51 +++- .../net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 28 +- drivers/net/wireless/realtek/rtw88/pci.c | 3 +- drivers/net/wireless/rsi/rsi_common.h | 5 +- drivers/net/wwan/t7xx/t7xx_modem_ops.c | 20 +- drivers/net/wwan/t7xx/t7xx_port_ctrl_msg.c | 18 +- drivers/net/wwan/t7xx/t7xx_port_proxy.h | 2 +- drivers/nvme/host/apple.c | 6 +- drivers/nvme/host/core.c | 2 +- drivers/nvme/host/pci.c | 2 + drivers/nvme/target/core.c | 2 +- drivers/of/base.c | 2 +- drivers/of/dynamic.c | 2 +- drivers/of/platform.c | 2 +- drivers/of/unittest.c | 1 - drivers/parisc/lasi.c | 12 +- drivers/pci/endpoint/functions/pci-epf-mhi.c | 4 + drivers/pci/endpoint/functions/pci-epf-ntb.c | 56 +--- drivers/pci/pci.c | 7 +- drivers/pci/pcie/aer.c | 2 - drivers/platform/x86/hp/hp-wmi.c | 5 + drivers/power/supply/axp288_charger.c | 19 +- drivers/power/supply/max17042_battery.c | 2 +- drivers/pwm/pwm-imx-tpm.c | 8 + drivers/regulator/act8945a-regulator.c | 3 +- drivers/regulator/bd9571mwv-regulator.c | 3 +- drivers/regulator/max77650-regulator.c | 2 +- drivers/regulator/mt6357-regulator.c | 2 +- drivers/regulator/rk808-regulator.c | 3 +- drivers/remoteproc/xlnx_r5_remoteproc.c | 20 +- drivers/rtc/rtc-ntxec.c | 2 +- drivers/scsi/sd.c | 1 + drivers/spi/spi-at91-usart.c | 8 +- drivers/spi/spi-atmel.c | 8 +- drivers/spi/spi-bcm63xx.c | 8 +- drivers/spi/spi-bcmbca-hsspi.c | 4 +- drivers/spi/spi-cadence.c | 15 +- drivers/spi/spi-coldfire-qspi.c | 10 +- drivers/spi/spi-dln2.c | 8 +- drivers/spi/spi-fsl-espi.c | 10 +- drivers/spi/spi-fsl-spi.c | 14 +- drivers/spi/spi-img-spfi.c | 8 +- drivers/spi/spi-imx.c | 5 + drivers/spi/spi-lantiq-ssc.c | 8 +- drivers/spi/spi-meson-spicc.c | 2 - drivers/spi/spi-microchip-core-qspi.c | 41 +-- drivers/spi/spi-mpc52xx.c | 3 +- drivers/spi/spi-mtk-nor.c | 4 +- drivers/spi/spi-omap2-mcspi.c | 8 +- drivers/spi/spi-orion.c | 9 + drivers/spi/spi-qup.c | 8 +- drivers/spi/spi-rockchip.c | 4 +- drivers/spi/spi-rspi.c | 10 +- drivers/spi/spi-s3c64xx.c | 9 +- drivers/spi/spi-sh-hspi.c | 10 +- drivers/spi/spi-sprd.c | 8 +- drivers/spi/spi-sun4i.c | 80 ++--- drivers/spi/spi-sun6i.c | 154 +++++----- drivers/spi/spi-synquacer.c | 88 +++--- drivers/spi/spi-tegra114.c | 8 +- drivers/spi/spi-tegra20-sflash.c | 8 +- drivers/spi/spi-ti-qspi.c | 97 +++--- drivers/spi/spi-topcliff-pch.c | 6 +- drivers/spi/spi-uniphier.c | 212 +++++++------ drivers/spi/spi-zynq-qspi.c | 79 ++--- drivers/spi/spi-zynqmp-gqspi.c | 4 +- drivers/spi/spi.c | 63 ++-- drivers/staging/media/atomisp/pci/atomisp_ioctl.c | 4 + drivers/staging/media/imx/imx-media-csi.c | 40 ++- drivers/staging/vme_user/vme_fake.c | 2 + drivers/target/target_core_configfs.c | 2 +- drivers/thermal/sprd_thermal.c | 4 +- drivers/thermal/thermal_core.c | 7 +- drivers/usb/chipidea/core.c | 45 +-- drivers/usb/chipidea/otg.c | 7 +- drivers/usb/class/usblp.c | 3 +- drivers/usb/common/ulpi.c | 5 +- drivers/usb/dwc3/core.c | 12 +- drivers/usb/gadget/udc/omap_udc.c | 4 - drivers/usb/host/xhci.c | 1 - drivers/usb/serial/option.c | 4 + drivers/usb/typec/tcpm/tcpm.c | 2 + drivers/video/fbdev/core/fb_defio.c | 179 ++++++++--- drivers/video/fbdev/core/fbcon_rotate.c | 5 +- drivers/video/fbdev/udlfb.c | 31 +- fs/binfmt_elf.c | 2 +- fs/btrfs/ioctl.c | 5 +- fs/btrfs/space-info.c | 2 +- fs/ceph/dir.c | 6 +- fs/erofs/decompressor.c | 1 + fs/erofs/dir.c | 28 +- fs/ext2/inode.c | 14 +- fs/ext4/extents.c | 15 + fs/ext4/xattr.c | 6 +- fs/f2fs/data.c | 32 +- fs/f2fs/extent_cache.c | 17 +- fs/f2fs/f2fs.h | 2 +- fs/f2fs/inode.c | 2 +- fs/f2fs/node.c | 17 +- fs/f2fs/segment.c | 6 +- fs/f2fs/super.c | 11 +- fs/hfsplus/bfind.c | 51 ++++ fs/hfsplus/catalog.c | 4 +- fs/hfsplus/dir.c | 2 +- fs/hfsplus/hfsplus_fs.h | 9 + fs/hfsplus/super.c | 6 +- fs/isofs/export.c | 2 +- fs/isofs/rock.c | 9 + fs/notify/fsnotify.c | 2 +- fs/notify/inotify/inotify_user.c | 1 + fs/notify/mark.c | 18 +- fs/ntfs3/run.c | 18 +- fs/ocfs2/aops.c | 74 +++-- fs/smb/client/cached_dir.c | 8 + fs/smb/client/cifsacl.c | 177 ++++++++--- fs/smb/client/cifsacl.h | 91 +----- fs/smb/client/smb2inode.c | 12 +- fs/smb/client/smb2misc.c | 3 +- fs/smb/client/smb2ops.c | 11 + fs/smb/common/smbacl.h | 122 ++++++++ fs/smb/server/connection.c | 28 +- fs/smb/server/connection.h | 6 +- fs/smb/server/smb2pdu.c | 4 +- fs/smb/server/smbacl.c | 48 +-- fs/smb/server/smbacl.h | 113 +------ fs/smb/server/transport_rdma.c | 5 + fs/smb/server/transport_tcp.c | 25 +- fs/smb/server/vfs_cache.c | 40 ++- fs/tracefs/event_inode.c | 14 + fs/tracefs/inode.c | 5 +- fs/tracefs/internal.h | 3 + fs/udf/misc.c | 8 +- fs/udf/super.c | 4 +- fs/userfaultfd.c | 2 - fs/xfs/xfs_buf.c | 1 + include/linux/bpf_verifier.h | 31 +- include/linux/damon.h | 2 + include/linux/device.h | 45 +++ include/linux/f2fs_fs.h | 1 + include/linux/fb.h | 4 +- include/linux/fsnotify_backend.h | 1 + include/linux/fwnode.h | 44 ++- include/linux/mmap_lock.h | 6 +- include/linux/mmc/card.h | 1 + include/linux/padata.h | 4 - include/linux/printk.h | 13 + include/linux/randomize_kstack.h | 26 +- include/linux/sched.h | 4 + include/linux/tpm_eventlog.h | 9 +- include/linux/usb.h | 3 +- include/net/mana/mana.h | 1 + include/net/mctp.h | 3 + include/trace/events/rxrpc.h | 6 +- include/video/udlfb.h | 1 + init/main.c | 1 - io_uring/poll.c | 14 +- io_uring/timeout.c | 4 + kernel/bpf/verifier.c | 236 +++++++++----- kernel/exit.c | 3 +- kernel/fork.c | 2 + kernel/locking/rtmutex.c | 13 +- kernel/padata.c | 136 +++------ kernel/regset.c | 6 +- kernel/sched/core.c | 2 +- kernel/sched/rt.c | 2 +- kernel/sched/sched.h | 2 +- kernel/taskstats.c | 1 + kernel/trace/trace_probe.c | 6 + kernel/trace/trace_probe.h | 4 +- kernel/tracepoint.c | 2 + lib/crypto/mpi/mpicoder.c | 2 +- lib/scatterlist.c | 8 +- lib/test_hmm.c | 86 +++--- lib/ts_kmp.c | 18 +- mm/damon/core.c | 37 ++- mm/damon/lru_sort.c | 88 ++++-- mm/damon/reclaim.c | 88 ++++-- mm/damon/sysfs-schemes.c | 12 +- mm/hugetlb.c | 1 + net/batman-adv/bat_iv_ogm.c | 85 ++++-- net/batman-adv/bridge_loop_avoidance.c | 11 +- net/batman-adv/main.c | 1 + net/batman-adv/tp_meter.c | 116 +++++-- net/batman-adv/tp_meter.h | 1 + net/batman-adv/types.h | 4 + net/bluetooth/hci_conn.c | 19 +- net/bluetooth/hci_event.c | 47 ++- net/bluetooth/l2cap_sock.c | 9 + net/bluetooth/mgmt.c | 262 +++++++++++----- net/bluetooth/mgmt_util.c | 46 +++ net/bluetooth/mgmt_util.h | 3 + net/bridge/br_arp_nd_proxy.c | 8 +- net/bridge/br_fdb.c | 28 +- net/caif/cfsrvl.c | 14 +- net/ceph/auth.c | 4 +- net/ceph/mon_client.c | 2 + net/core/flow_dissector.c | 13 +- net/core/rtnetlink.c | 1 + net/ipv4/ah4.c | 29 +- net/ipv4/icmp.c | 8 +- net/ipv4/inet_connection_sock.c | 3 + net/ipv6/ah6.c | 27 +- net/ipv6/exthdrs.c | 9 +- net/ipv6/ip6_gre.c | 5 +- net/ipv6/rpl_iptunnel.c | 9 + net/ipv6/seg6_iptunnel.c | 12 +- net/ipv6/xfrm6_protocol.c | 4 +- net/mac80211/mlme.c | 9 +- net/mac80211/rx.c | 2 +- net/mctp/route.c | 8 +- net/mptcp/protocol.c | 3 +- net/mptcp/sockopt.c | 12 +- net/mptcp/subflow.c | 4 +- net/netfilter/nft_bitwise.c | 3 +- net/openvswitch/vport-netdev.c | 6 +- net/qrtr/ns.c | 86 +++++- net/rds/message.c | 20 +- net/rds/rdma.c | 4 - net/rxrpc/ar-internal.h | 1 - net/rxrpc/call_event.c | 27 +- net/rxrpc/conn_event.c | 44 ++- net/rxrpc/io_thread.c | 24 +- net/rxrpc/rxkad.c | 112 +++---- net/rxrpc/skbuff.c | 9 - net/sched/sch_red.c | 2 +- net/sctp/socket.c | 9 + net/smc/smc_clc.c | 4 +- net/strparser/strparser.c | 8 + net/unix/af_unix.c | 3 + net/vmw_vsock/af_vsock.c | 6 +- net/vmw_vsock/hyperv_transport.c | 4 +- net/vmw_vsock/virtio_transport_common.c | 15 +- net/xfrm/xfrm_state.c | 12 +- net/xfrm/xfrm_user.c | 1 + security/selinux/hooks.c | 3 +- security/selinux/selinuxfs.c | 54 +--- sound/aoa/codecs/onyx.c | 104 ++----- sound/aoa/codecs/tas.c | 113 +++---- sound/aoa/core/gpio-feature.c | 20 +- sound/aoa/core/gpio-pmf.c | 26 +- sound/aoa/soundbus/i2sbus/core.c | 12 +- sound/aoa/soundbus/i2sbus/pcm.c | 143 ++++----- sound/core/control.c | 4 + sound/core/misc.c | 44 +-- sound/core/seq/oss/seq_oss_rw.c | 6 +- sound/core/seq/seq_clientmgr.c | 9 +- sound/core/seq/seq_clientmgr.h | 5 +- sound/core/seq/seq_ump_client.c | 4 +- sound/drivers/pcmtest.c | 19 +- sound/firewire/tascam/tascam-hwdep.c | 1 + sound/pci/ctxfi/ctatc.c | 3 +- sound/pci/hda/cs35l56_hda.c | 19 +- sound/soc/amd/yc/acp6x-mach.c | 14 + sound/soc/fsl/fsl_easrc.c | 2 +- sound/soc/intel/boards/bytcr_wm5102.c | 1 + sound/soc/qcom/qdsp6/q6apm-dai.c | 1 + sound/soc/qcom/qdsp6/q6apm-lpass-dais.c | 2 +- sound/soc/qcom/qdsp6/q6apm.c | 3 + sound/soc/sof/compress.c | 3 + sound/usb/6fire/control.c | 10 +- sound/usb/caiaq/control.c | 52 +++- sound/usb/caiaq/device.c | 35 ++- sound/usb/caiaq/input.c | 2 +- sound/usb/endpoint.c | 6 +- sound/usb/format.c | 2 +- sound/usb/midi2.c | 9 +- sound/usb/misc/ua101.c | 7 + sound/usb/mixer.c | 7 +- sound/usb/mixer_quirks.c | 12 +- sound/usb/stream.c | 4 +- tools/accounting/getdelays.c | 41 ++- tools/accounting/procacct.c | 40 ++- tools/testing/ktest/ktest.pl | 2 +- .../selftests/bpf/progs/verifier_spill_fill.c | 281 +++++++++++++++++ .../bpf/progs/verifier_subprog_precision.c | 87 +++++- tools/testing/selftests/bpf/verifier/precise.c | 38 ++- .../testing/selftests/mqueue/{setting => settings} | 0 447 files changed, 5555 insertions(+), 2927 deletions(-)

2 days, 6 hours

11
10
0 0

[PATCH 6.12 000/144] 6.12.90-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.12.90 release. There are 144 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sun, 17 May 2026 15:46:37 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.90-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.12.90-rc1 Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vcn4: Avoid overflow on msg bound check Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vcn3: Avoid overflow on msg bound check Dudu Lu <phx0fer(a)gmail.com> vsock/virtio: fix accept queue count leak on transport mismatch Eric Dumazet <edumazet(a)google.com> vsock/virtio: fix potential unbounded skb queue Stefano Garzarella <sgarzare(a)redhat.com> vsock/virtio: fix empty payload in tap skb for non-linear buffers Stefano Garzarella <sgarzare(a)redhat.com> vsock/virtio: fix length and offset in tap skb for split packets Norbert Szetei <norbert(a)doyensec.com> vsock: fix buffer size clamping order Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: fix tp_num leak on kmalloc failure Jiexun Wang <wangjiexun2025(a)gmail.com> batman-adv: stop tp_meter sessions during mesh teardown Steven Rostedt <rostedt(a)goodmis.org> tracing/probes: Limit size of event probe to 3K Yochai Eisenrich <yochaie(a)sweet.security> btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak Guangshuo Li <lgs201920130244(a)gmail.com> btrfs: fix double free in create_space_info_sub_group() error path Filipe Manana <fdmanana(a)suse.com> btrfs: remove fs_info argument from btrfs_sysfs_add_space_info_type() Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() Martin Michaelis <code(a)mgjm.de> io_uring/kbuf: support min length left for incremental buffers Nikolay Aleksandrov <razor(a)blackwall.org> bonding: fix use-after-free due to enslave fail after slave array update Miguel Ojeda <ojeda(a)kernel.org> rust: allow `clippy::collapsible_if` globally Miguel Ojeda <ojeda(a)kernel.org> rust: allow `clippy::collapsible_match` globally SeongJae Park <sj(a)kernel.org> mm/damon/reclaim: detect and use fresh enabled and kdamond_pid values SeongJae Park <sj(a)kernel.org> mm/damon/lru_sort: detect and use fresh enabled and kdamond_pid values SeongJae Park <sj(a)kernel.org> mm/damon/core: implement damon_kdamond_pid() SeongJae Park <sj(a)kernel.org> mm/damon/core: disallow time-quota setting zero esz Gary Guo <gary(a)garyguo.net> rust: pin-init: fix incorrect accessor reference lifetime Thomas Zimmermann <tzimmermann(a)suse.de> fbcon: Avoid OOB font access if console rotation fails David Carlier <devnexen(a)gmail.com> tracefs: Fix default permissions not being applied on initial mount Damien Le Moal <dlemoal(a)kernel.org> block: fix zone write plug removal Damien Le Moal <dlemoal(a)kernel.org> block: reorganize struct blk_zone_wplug Damien Le Moal <dlemoal(a)kernel.org> block: cleanup blkdev_report_zones() Sang-Heon Jeon <ekffu200098(a)gmail.com> mm/hugetlb_cma: round up per_node before logging it Johan Hovold <johan(a)kernel.org> spi: uniphier: fix controller deregistration Pei Xiao <xiaopei01(a)kylinos.cn> spi: uniphier: Simplify clock handling with devm_clk_get_enabled() Johan Hovold <johan(a)kernel.org> spi: tegra114: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: tegra20-sflash: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: zynq-qspi: fix controller deregistration Pei Xiao <xiaopei01(a)kylinos.cn> spi: zynq-qspi: Simplify clock handling with devm_clk_get_enabled() David Carlier <devnexen(a)gmail.com> Bluetooth: hci_conn: fix potential UAF in create_big_sync Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: seq: Fix UMP group 16 filtering Takashi Iwai <tiwai(a)suse.de> ALSA: seq: Notify client and port info changes Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: core: Serialize deferred fasync state checks Takashi Iwai <tiwai(a)suse.de> ALSA: misc: Use guard() for spin locks Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: hda: cs35l56: Propagate ASP TX source control errors Selvarasu Ganesan <selvarasu.g(a)samsung.com> usb: dwc3: Move GUID programming after PHY initialization Amit Sunil Dhamne <amitsd(a)google.com> usb: typec: tcpm: reset internal port states on soft reset AMS Andrea Righi <arighi(a)nvidia.com> sched_ext: Use HK_TYPE_DOMAIN_BOOT to detect isolcpus= domain isolation Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: put backbone reference on failed claim hash insert Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: only purge non-released claims Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: prevent use-after-free when deleting claims Jiexun Wang <wangjiexun2025(a)gmail.com> batman-adv: stop caching unowned originator pointers in BAT IV Jiexun Wang <wangjiexun2025(a)gmail.com> batman-adv: reject new tp_meter sessions during teardown Lyes Bourennani <lbourennani(a)fuzzinglabs.com> batman-adv: fix integer overflow on buff_pos Ben Morris <bmorris(a)anthropic.com> sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL Siddharth Vadapalli <s-vadapalli(a)ti.com> arm64: dts: ti: k3-am62a7-sk: Fix pin name in comment from M19 to N22 Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/pm: align Hawaii mclk workaround with radeon Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/pm: add missing revision check for CI John B. Moore <jbmoore61(a)gmail.com> drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission Felix Kuehling <felix.kuehling(a)amd.com> drm/amdkfd: Make all TLB-flushes heavy-weight Icenowy Zheng <zhengxingda(a)iscas.ac.cn> drm/panel: boe-tv101wum-nl6: restore MODE_LPM after sending disable cmds John B. Moore <jbmoore61(a)gmail.com> drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ Icenowy Zheng <zhengxingda(a)iscas.ac.cn> drm/panel: himax-hx83102: restore MODE_LPM after sending disable cmds Osama Abdelkader <osama.abdelkader(a)gmail.com> drm/exynos: remove bridge when component_add fails Philip Yang <Philip.Yang(a)amd.com> drm/amdgpu: zero-initialize GART table on allocation Alex Deucher <alexander.deucher(a)amd.com> drm/radeon: add missing revision check for CI Shuicheng Lin <shuicheng.lin(a)intel.com> drm/xe/bo: Fix bo leak on unaligned size validation in xe_bo_init_locked() Shuicheng Lin <shuicheng.lin(a)intel.com> drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() Shuicheng Lin <shuicheng.lin(a)intel.com> drm/xe/bo: Fix bo leak on GGTT flag validation in xe_bo_init_locked() Alysa Liu <Alysa.Liu(a)amd.com> drm/amdkfd: validate SVM ioctl nattr against buffer size Ashutosh Desai <ashutoshdesai993(a)gmail.com> drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() Mario Kleiner <mario.kleiner.de(a)gmail.com> drm/amd/display: Change dither policy for 10 bpc output back to dithering Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vce: Prevent partial address patches Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu/vcn4: Prevent OOB reads when parsing IB Benjamin Cheng <benjamin.cheng(a)amd.com> drm/amdgpu: Add bounds checking to ib_{get,set}_value Alysa Liu <Alysa.Liu(a)amd.com> drm/amdkfd: Add upper bound check for num_of_nodes Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: fix incorrect FeatureCtrlMask setting on smu v14.0.x Chenglei Xie <Chenglei.Xie(a)amd.com> drm/amdgpu: gate VM CPU HDP flush on reset lock Ramalingeswara Reddy, Kanala <Kanala.RamalingeswaraReddy(a)amd.com> drm/amdgpu: Use SMUIO 15.0.0 offsets for TSC upper and lower count. Amir Shetaia <Amir.Shetaia(a)amd.com> drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Init variable to avoid early exit from et alignment loop Yasuaki Torimaru <yasuakitorimaru(a)gmail.com> drm/msm/gem: fix error handling in msm_ioctl_gem_info_get_metadata() Johan Hovold <johan(a)kernel.org> spi: cadence: fix unclocked access on unbind Johan Hovold <johan(a)kernel.org> spi: cadence: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: mpc52xx: fix use-after-free on unbind Johan Hovold <johan(a)kernel.org> spi: mpc52xx: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: mpc52xx: fix use-after-free on registration failure Johan Hovold <johan(a)kernel.org> spi: orion: fix clock imbalance on registration failure Johan Hovold <johan(a)kernel.org> spi: orion: fix runtime pm leak on unbind Johan Hovold <johan(a)kernel.org> spi: orion: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: mxic: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: imx: fix runtime pm leak on probe deferral Johan Hovold <johan(a)kernel.org> spi: img-spfi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: rspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sprd: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: pic32-sqi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: npcm-pspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: coldfire-qspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: bcmbca-hsspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: fsl: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sh-hspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: pl022: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: mtk-nor: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: pic32: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: omap2-mcspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: fsl-espi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: s3c64xx: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: dln2: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: mxs: fix controller deregistration Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> media: omap3isp: drop the use count of v4l2 pipeline Matthias Fend <matthias.fend(a)emfend.at> media: i2c: ov08d10: fix image vertical start setting Michael Tretter <m.tretter(a)pengutronix.de> media: staging: imx: request mbus_config in csi_start Wenmeng Liu <wenmeng.liu(a)oss.qualcomm.com> media: i2c: imx412: Assert reset GPIO during probe Sergey Shtylyov <s.shtylyov(a)auroraos.dev> media: dib8000: avoid division by 0 in dib8000_set_dds() Abdun Nihaal <nihaal(a)cse.iitm.ac.in> media: pci: zoran: fix potential memory leak in zoran_probe() Luigi Leonardi <leonardi(a)redhat.com> vsock/virtio: fix MSG_PEEK ignoring skb offset when calculating bytes to copy Krishna Chomal <krishna.chomal108(a)gmail.com> platform/x86: hp-wmi: Ignore backlight and FnLock events Johan Hovold <johan(a)kernel.org> spi: aspeed-smc: fix controller deregistration Wang Jun <1742789905(a)qq.com> media: saa7164: add ioremap return checks and cleanups Johan Hovold <johan(a)kernel.org> spi: at91-usart: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: qup: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: meson-spicc: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: lantiq-ssc: fix controller deregistration Johan Hovold <johan(a)kernel.org> regulator: bd9571mwv: fix OF node reference imbalance Johan Hovold <johan(a)kernel.org> regulator: act8945a: fix OF node reference imbalance Jai Luthra <jai.luthra(a)ideasonboard.com> media: i2c: imx283: Fix hang when going from large to small resolution Ethan Tidmore <ethantidmore06(a)gmail.com> media: intel/ipu6: fix error pointer dereference Janne Grunau <j(a)jannau.net> media: videobuf2: Set vma_flags in vb2_dma_sg_mmap Johan Hovold <johan(a)kernel.org> regulator: rk808: fix OF node reference imbalance Jai Luthra <jai.luthra(a)ideasonboard.com> media: i2c: imx283: Enter full standby when stopping streaming Oliver Neukum <oneukum(a)suse.com> media: rc: streamzap: Error handling in probe Oliver Neukum <oneukum(a)suse.com> media: rc: xbox_remote: heed DMA restrictions Johan Hovold <johan(a)kernel.org> regulator: max77650: fix OF node reference imbalance Johan Hovold <johan(a)kernel.org> spi: st-ssc4: fix controller deregistration Johan Hovold <johan(a)kernel.org> regulator: mt6357: fix OF node reference imbalance Sakari Ailus <sakari.ailus(a)linux.intel.com> staging: media: atomisp: Disallow all private IOCTLs Josua Mayer <josua(a)solid-run.com> arm64: dts: lx2160a-cex7/lx2162a-sr-som: fix usd-cd & gpio pinmux Johan Hovold <johan(a)kernel.org> spi: atmel: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: bcm63xx: fix controller deregistration Ziyi Guo <n7l8m4(a)u.northwestern.edu> media: chips-media: wave5: add missing spinlock protection for handle_dynamic_resolution_change() Ziyi Guo <n7l8m4(a)u.northwestern.edu> media: chips-media: wave5: add missing spinlock protection for send_eos_event() Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> media: chips-media: wave5: fix a potential memory leak in wave5_vdi_init() Alexander Koskovich <akoskovich(a)pm.me> media: i2c: ov8856: free control handler on error in ov8856_init_controls() Guoniu Zhou <guoniu.zhou(a)nxp.com> media: nxp: imx8-isi: Reduce minimum queued buffers from 2 to 0 Ricardo Ribalda <ribalda(a)chromium.org> media: uvcvideo: Enable VB2_DMABUF for metadata stream T.J. Mercier <tjmercier(a)google.com> HID: playstation: Clamp num_touch_reports ------------- Diffstat: Makefile | 6 +- .../arm64/boot/dts/freescale/fsl-lx2160a-cex7.dtsi | 7 + .../dts/freescale/fsl-lx2160a-clearfog-itx.dtsi | 2 + arch/arm64/boot/dts/freescale/fsl-lx2160a.dtsi | 24 +++ .../boot/dts/freescale/fsl-lx2162a-clearfog.dts | 2 + .../boot/dts/freescale/fsl-lx2162a-sr-som.dtsi | 7 + arch/arm64/boot/dts/ti/k3-am62a7-sk.dts | 2 +- block/blk-zoned.c | 170 +++++++++------------ drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 3 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c | 13 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h | 11 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c | 3 + drivers/gpu/drm/amd/amdgpu/amdgpu_vm_cpu.c | 12 +- drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 31 +++- drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 3 - drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c | 4 +- drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c | 25 ++- drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c | 46 ++++-- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 33 +++- .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 6 +- drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 10 +- drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 4 +- drivers/gpu/drm/amd/amdkfd/kfd_topology.c | 11 ++ drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 2 +- .../gpu/drm/amd/pm/powerplay/smumgr/ci_smumgr.c | 13 +- .../gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c | 10 +- drivers/gpu/drm/drm_gem_framebuffer_helper.c | 4 +- drivers/gpu/drm/exynos/exynos_drm_mic.c | 8 +- drivers/gpu/drm/i915/display/intel_psr.c | 2 +- drivers/gpu/drm/msm/msm_drv.c | 7 +- drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c | 2 + drivers/gpu/drm/panel/panel-himax-hx83102.c | 2 + drivers/gpu/drm/radeon/ci_dpm.c | 9 +- drivers/gpu/drm/xe/xe_bo.c | 8 +- drivers/gpu/drm/xe/xe_dma_buf.c | 11 +- drivers/hid/hid-playstation.c | 6 +- drivers/media/common/videobuf2/videobuf2-dma-sg.c | 1 + drivers/media/dvb-frontends/dib8000.c | 4 +- drivers/media/i2c/imx283.c | 15 +- drivers/media/i2c/imx412.c | 2 +- drivers/media/i2c/ov08d10.c | 10 +- drivers/media/i2c/ov8856.c | 10 +- drivers/media/pci/intel/ipu6/ipu6.c | 2 +- drivers/media/pci/saa7164/saa7164-core.c | 47 ++++-- drivers/media/pci/zoran/zoran_card.c | 2 +- .../media/platform/chips-media/wave5/wave5-vdi.c | 1 + .../platform/chips-media/wave5/wave5-vpu-dec.c | 14 +- .../media/platform/nxp/imx8-isi/imx8-isi-video.c | 2 +- drivers/media/platform/ti/omap3isp/ispvideo.c | 1 + drivers/media/rc/streamzap.c | 12 +- drivers/media/rc/xbox_remote.c | 9 +- drivers/media/usb/uvc/uvc_queue.c | 3 +- drivers/net/bonding/bond_main.c | 6 +- drivers/platform/x86/hp/hp-wmi.c | 5 + drivers/regulator/act8945a-regulator.c | 3 +- drivers/regulator/bd9571mwv-regulator.c | 3 +- drivers/regulator/max77650-regulator.c | 2 +- drivers/regulator/mt6357-regulator.c | 2 +- drivers/regulator/rk808-regulator.c | 3 +- drivers/spi/spi-aspeed-smc.c | 9 +- drivers/spi/spi-at91-usart.c | 8 +- drivers/spi/spi-atmel.c | 8 +- drivers/spi/spi-bcm63xx.c | 8 +- drivers/spi/spi-bcmbca-hsspi.c | 4 +- drivers/spi/spi-cadence.c | 15 +- drivers/spi/spi-coldfire-qspi.c | 10 +- drivers/spi/spi-dln2.c | 8 +- drivers/spi/spi-fsl-espi.c | 10 +- drivers/spi/spi-fsl-spi.c | 14 +- drivers/spi/spi-img-spfi.c | 8 +- drivers/spi/spi-imx.c | 1 + drivers/spi/spi-lantiq-ssc.c | 8 +- drivers/spi/spi-meson-spicc.c | 8 +- drivers/spi/spi-mpc52xx.c | 9 +- drivers/spi/spi-mtk-nor.c | 4 +- drivers/spi/spi-mxic.c | 3 +- drivers/spi/spi-mxs.c | 8 +- drivers/spi/spi-npcm-pspi.c | 8 +- drivers/spi/spi-omap2-mcspi.c | 8 +- drivers/spi/spi-orion.c | 16 +- drivers/spi/spi-pic32-sqi.c | 8 +- drivers/spi/spi-pic32.c | 11 +- drivers/spi/spi-pl022.c | 8 +- drivers/spi/spi-qup.c | 8 +- drivers/spi/spi-rspi.c | 10 +- drivers/spi/spi-s3c64xx.c | 4 +- drivers/spi/spi-sh-hspi.c | 10 +- drivers/spi/spi-sprd.c | 8 +- drivers/spi/spi-st-ssc4.c | 8 +- drivers/spi/spi-tegra114.c | 8 +- drivers/spi/spi-tegra20-sflash.c | 8 +- drivers/spi/spi-uniphier.c | 24 ++- drivers/spi/spi-zynq-qspi.c | 55 ++----- drivers/staging/media/atomisp/pci/atomisp_ioctl.c | 4 + drivers/staging/media/imx/imx-media-csi.c | 40 +++-- drivers/usb/dwc3/core.c | 12 +- drivers/usb/typec/tcpm/tcpm.c | 2 + drivers/video/fbdev/core/fbcon_rotate.c | 5 +- fs/btrfs/ioctl.c | 5 +- fs/btrfs/space-info.c | 8 +- fs/btrfs/sysfs.c | 5 +- fs/btrfs/sysfs.h | 3 +- fs/tracefs/inode.c | 1 + include/linux/damon.h | 2 + include/uapi/linux/io_uring.h | 3 +- io_uring/kbuf.c | 8 +- io_uring/kbuf.h | 7 + kernel/sched/ext.c | 3 +- kernel/trace/trace_probe.c | 6 + kernel/trace/trace_probe.h | 4 +- mm/damon/core.c | 34 +++++ mm/damon/lru_sort.c | 88 +++++++---- mm/damon/reclaim.c | 88 +++++++---- mm/hugetlb.c | 1 + net/batman-adv/bat_iv_ogm.c | 85 ++++++++--- net/batman-adv/bridge_loop_avoidance.c | 11 +- net/batman-adv/main.c | 1 + net/batman-adv/tp_meter.c | 116 +++++++++++--- net/batman-adv/tp_meter.h | 1 + net/batman-adv/types.h | 4 + net/bluetooth/hci_conn.c | 19 ++- net/bluetooth/l2cap_sock.c | 3 + net/sctp/socket.c | 9 ++ net/vmw_vsock/af_vsock.c | 6 +- net/vmw_vsock/virtio_transport_common.c | 57 +++---- rust/kernel/init/__internal.rs | 28 ++-- rust/kernel/init/macros.rs | 91 ++++++----- sound/core/misc.c | 33 ++-- sound/core/seq/seq_clientmgr.c | 9 +- sound/core/seq/seq_clientmgr.h | 5 +- sound/core/seq/seq_ump_client.c | 4 +- sound/pci/hda/cs35l56_hda.c | 19 ++- 132 files changed, 1265 insertions(+), 588 deletions(-)

3 days

10
12
0 0

Mise à jour de sécurité de vos cartes clés personnelles

by unknown＠example.com

● Vous avez reçu une information Merci d'en prendre connaissance dans les meilleurs délais. Une prise d’initiative de votre part pourrait être nécessaire. Cliquez ci-dessous pour y accéder : Accéder à mon compte Mentions Légales Vous recevez ce message parce que vous nous avez communiqué votre adresse e-mail. Nous recueillons des statistiques d'ouverture des emails grâce à l'affichage des images incluses dans le message. Lorsque votre application email le permet, vous pouvez à tout moment les accepter ou les refuser en paramétrant leur affichage. Le CIC garantit l'utilisation de vos données personnelles dans le respect de la législation. Si vous ne souhaitez plus recevoir de communication commerciale de notre part, cliquez ici. Ce message et toutes les pièces jointes sont confidentiels et établis à l'intention exclusive de son ou ses destinataires. Si vous avez reçu ce message par erreur, merci d'en avertir immédiatement l'émetteur et de détruire le message. Une banque qui appartient à ses clients, ça change tout.  

4 days, 6 hours

1
0
0 0

2026年上海MWC——参会者名录

by Pamela Kelly

您好，我们目前正提供 MWC 上海 2026 参会者名单的访问权限，该名单包含了 44,753 位经过验证且已明确同意接收信息的参会联系人。该数据库涵盖了姓名、职位、公司名称、电话号码及官方电子邮箱等信息，助您高效触达关键决策者，并有力支持您的销售线索挖掘工作。如果您对此感兴趣，请告知我，我很乐意为您提供详细的报价信息。诚挚地， Pamela Kelly 高级需求生成专员附注：如不希望继续接收此类信息，请回复“No Thanks”。

4 days, 18 hours

1
0
0 0

[PATCH 6.18 000/268] 6.18.30-rc2 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.18.30 release. There are 268 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Fri, 15 May 2026 15:37:20 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.30-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.18.30-rc2 Prathyushi Nangia <prathyushi.nangia(a)amd.com> x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache Gary Guo <gary(a)garyguo.net> rust: pin-init: fix incorrect accessor reference lifetime Sam Edwards <cfsworks(a)gmail.com> net: stmmac: Prevent NULL deref when RX memory exhausted Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY() Thorsten Blum <thorsten.blum(a)linux.dev> crypto: caam - guard HMAC key hex dumps in hash_digest_key Thorsten Blum <thorsten.blum(a)linux.dev> printk: add print_hex_dump_devel() Junrui Luo <moonafterrain(a)outlook.com> erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap() Gao Xiang <xiang(a)kernel.org> erofs: tidy up z_erofs_lz4_handle_overlap() Zilin Guan <zilin(a)seu.edu.cn> hfsplus: fix held lock freed on hfsplus_fill_super() Deepanshu Kartikey <kartikey406(a)gmail.com> hfsplus: fix uninit-value by validating catalog record size Krzysztof Kozlowski <krzysztof.kozlowski(a)oss.qualcomm.com> firmware: exynos-acpm: Drop fake 'const' on handle pointer Kairui Song <kasong(a)tencent.com> mm, swap: speed up hibernation allocation and writeout Suman Kumar Chakraborty <suman.kumar.chakraborty(a)intel.com> crypto: qat - fix firmware loading failure for GEN6 devices Suman Kumar Chakraborty <suman.kumar.chakraborty(a)intel.com> crypto: qat - fix indentation of macros in qat_hal.c Luke Wang <ziniu.wang_1(a)nxp.com> mmc: core: Optimize time for secure erase/trim for some Kingston eMMCs Avri Altman <avri.altman(a)sandisk.com> mmc: core: Add quirk for incorrect manufacturing date Avri Altman <avri.altman(a)sandisk.com> mmc: core: Adjust MDT beyond 2025 David Carlier <devnexen(a)gmail.com> octeon_ep_vf: add NULL check for napi_build_skb() Thomas Weißschuh <linux(a)weissschuh.net> hwmon: (powerz) Avoid cacheline sharing for DMA buffer Michael S. Tsirkin <mst(a)redhat.com> dma-mapping: add __dma_from_device_group_begin()/end() Thomas Zimmermann <tzimmermann(a)suse.de> fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info SeongJae Park <sj(a)kernel.org> mm/damon/core: disallow non-power of two min_region_sz on damon_start() Alexei Starovoitov <ast(a)kernel.org> bpf: Fix use-after-free in arena_vm_close on fork Jens Axboe <axboe(a)kernel.dk> io_uring/tw: serialize ctx->retry_llist with ->uring_lock Martin Michaelis <code(a)mgjm.de> io_uring/kbuf: support min length left for incremental buffers Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Use per-root-bridge PCIH flag to skip mem resource fixup Tao Cui <cuitao(a)kylinos.cn> LoongArch: KVM: Use kvm_set_pte() in kvm_flush_pte() Bibo Mao <maobibo(a)loongson.cn> LoongArch: KVM: Move unconditional delay into timer clear scenery Bibo Mao <maobibo(a)loongson.cn> LoongArch: KVM: Fix HW timer interrupt lost when inject interrupt by software Xianglai Li <lixianglai(a)loongson.cn> LoongArch: KVM: Fix "unreliable stack" for kvm_exc_entry Qiang Ma <maqianga(a)uniontech.com> LoongArch: KVM: Cap KVM_CAP_NR_VCPUS by KVM_CAP_MAX_VCPUS Wentao Guan <guanwentao(a)uniontech.com> LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang() Fuad Tabba <tabba(a)google.com> KVM: arm64: Fix pin leak and publication ordering in __pkvm_init_vcpu() Fuad Tabba <tabba(a)google.com> KVM: arm64: Fix FEAT_Debugv8p9 to check DebugVer, not PMUVer Fuad Tabba <tabba(a)google.com> KVM: arm64: Fix FEAT_SPE_FnE to use PMSIDR_EL1.FnE, not PMSVer Quentin Perret <qperret(a)google.com> KVM: arm64: Fix initialisation order in __pkvm_init_finalise() David Woodhouse <dwmw(a)amazon.co.uk> KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value Marc Zyngier <maz(a)kernel.org> KVM: arm64: Wake-up from WFI when iqrchip is in userspace Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix fsck inconsistency caused by FGGC of node block Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix inline data not being written to disk in writeback path Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: refactor f2fs_move_node_folio function Guangshuo Li <lgs201920130244(a)gmail.com> f2fs: fix uninitialized kobject put in f2fs_init_sysfs() Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix node_cnt race between extent node destroy and writeback Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix incorrect multidevice info in trace_f2fs_map_blocks() Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix incorrect file address mapping when inline inode is unwritten Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix fsck inconsistency caused by incorrect nat_entry flag usage Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix fiemap boundary handling when read extent cache is incomplete Cen Zhang <zzzccc427(a)gmail.com> f2fs: add READ_ONCE() for i_blocks in f2fs_update_inode() Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: return early if no retrans Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: free sk if last Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: always decrease sk refcount Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: fix potential data-race Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: allow ID 0 Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: kernel: correctly retransmit ADD_ADDR ID 0 Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: prio: skip closed subflows Gang Yan <yangang(a)kylinos.cn> mptcp: fix scheduling with atomic in timestamp sockopt Paolo Abeni <pabeni(a)redhat.com> mptcp: fix rx timestamp corruption on fastopen Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: sockopt: increase seq in mptcp_setsockopt_all_sf Gang Yan <yangang(a)kylinos.cn> mptcp: sockopt: set timestamp flags on subflow socket, not msk Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: fastclose msk when linger time is 0 Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: mptcp: pm: restrict 'unknown' check to pm_nl_ctl Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: mptcp: check output: catch cmd errors David Carlier <devnexen(a)gmail.com> sched_ext: idle: Recheck prev_cpu after narrowing allowed mask Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/rxe: Reject unknown opcodes before ICRC processing Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() Junrui Luo <moonafterrain(a)outlook.com> RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Validate rx_hash_key_len Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/ionic: Fix typo in format string Kai Zen <kai.aizen.dev(a)gmail.com> RDMA/ionic: bound node_desc sysfs read with %.64s Dapeng Mi <dapeng1.mi(a)linux.intel.com> perf/x86/intel: Always reprogram ACR events to prevent stale masks Nilay Shroff <nilay(a)linux.ibm.com> powerpc/xive: fix kmemleak caused by incorrect chip_data lookup André Draszik <andre.draszik(a)linaro.org> power: supply: max17042: avoid overflow when determining health Lukas Wunner <lukas(a)wunner.de> PCI/ASPM: Fix pci_clear_and_set_config_dword() usage Lukas Wunner <lukas(a)wunner.de> PCI/AER: Stop ruling out unbound devices as error source Shuai Xue <xueshuai(a)linux.alibaba.com> PCI/AER: Clear only error bits in PCIe Device Status Lukas Wunner <lukas(a)wunner.de> PCI: Update saved_config_space upon resource assignment SeongJae Park <sj(a)kernel.org> mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock SeongJae Park <sj(a)kernel.org> mm/damon/stat: detect and use fresh enabled value Paolo Bonzini <pbonzini(a)redhat.com> KVM: x86: Do IRR scan in __kvm_apic_update_irr even if PIR is empty Paolo Bonzini <pbonzini(a)redhat.com> KVM: x86: check for nEPT/nNPT in slow flush hypercalls Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: validate dacloffset before building DACL pointers Bjoern Doebel <doebel(a)amazon.de> smb: client: use kzalloc to zero-initialize security descriptor buffer Zisen Ye <zisenye(a)stu.xidian.edu.cn> smb/client: fix out-of-bounds read in symlink_data() Zisen Ye <zisenye(a)stu.xidian.edu.cn> smb/client: fix out-of-bounds read in smb2_compound_op() Ranjan Kumar <ranjan.kumar(a)broadcom.com> scsi: mpt3sas: Limit NVMe request size to 2 MiB Pengpeng Hou <pengpeng(a)iscas.ac.cn> s390/debug: Reject zero-length input before trimming a newline Vasily Gorbik <gor(a)linux.ibm.com> s390/debug: Reject zero-length input in debug_input_flush_fn() Osama Abdelkader <osama.abdelkader(a)gmail.com> riscv: kvm: fix vector context allocation leak Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/hns: Fix unlocked call to hns_roce_qp_remove() David Carlier <devnexen(a)gmail.com> psp: strip variable-length PSP header in psp_dev_rcv() Ulf Hansson <ulf.hansson(a)linaro.org> pmdomain: core: Fix detach procedure for virtual devices in genpd Ilya Maximets <i.maximets(a)ovn.org> openvswitch: vport: fix self-deadlock on release of tunnel ports Chaitanya Kulkarni <kch(a)nvidia.com> nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free Chaitanya Kulkarni <kch(a)nvidia.com> nvmet-tcp: fix race between ICReq handling and queue teardown Fedor Pchelkin <pchelkin(a)ispras.ru> nvme-apple: drop invalid put of admin queue reference count Junrui Luo <moonafterrain(a)outlook.com> md/raid10: fix divide-by-zero in setup_geo() with zero far_copies Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Fix slab-out-of-bounds access in auth message processing Christian A. Ehrhardt <lk(a)c--e.de> lib/scatterlist: fix temp buffer in extract_user_to_sg() Christian A. Ehrhardt <lk(a)c--e.de> lib/scatterlist: fix length calculations in extract_kvec_to_sg Lukas Wunner <lukas(a)wunner.de> lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() Nicolin Chen <nicolinc(a)nvidia.com> iommu/arm-smmu-v3: Add a missing dma_wmb() for hitless STE update Zhenzhong Duan <zhenzhong.duan(a)intel.com> iommu/vt-d: Block PASID attachment to nested domain with dirty tracking Zhenzhong Duan <zhenzhong.duan(a)intel.com> iommufd: Fix return value of iommufd_fault_fops_write() Michael Bommarito <michael.bommarito(a)gmail.com> isofs: validate block number from NFS file handle in isofs_export_iget Michael Bommarito <michael.bommarito(a)gmail.com> isofs: validate Rock Ridge CE continuation extent against volume size Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: correctly reject too-small hash devices Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: correctly reject too-small FEC devices David Carlier <devnexen(a)gmail.com> eventfs: Hold eventfs_mutex and SRCU when remount walks events Mikulas Patocka <mpatocka(a)redhat.com> dm: fix a buffer overflow in ioctl processing Mikulas Patocka <mpatocka(a)redhat.com> dm: don't report warning when doing deferred remove Mikulas Patocka <mpatocka(a)redhat.com> dm-thin: fix metadata refcount underflow Filipe Manana <fdmanana(a)suse.com> btrfs: fix missing last_unlink_trans update when removing a directory Guangshuo Li <lgs201920130244(a)gmail.com> btrfs: fix double free in create_space_info() error path Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm: remove child devices when apm is removed Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error Joseph Salisbury <joseph.salisbury(a)oracle.com> ASoC: fsl_easrc: fix comment typo Li Jian <lazycat-xiao(a)foxmail.com> ASoC: ES8389: convert to devm_clk_get_optional() to get clock Tommaso Soncin <soncintommaso(a)gmail.com> ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table Shrikanth Hegde <sshegde(a)linux.ibm.com> cpuidle: powerpc: avoid double clear when breaking snooze Conor Dooley <conor.dooley(a)microchip.com> clk: microchip: mpfs-ccc: fix out of bounds access during output registration Stefan Eichenberger <stefan.eichenberger(a)toradex.com> clk: imx: imx8-acm: fix flags for acm clocks Steven Rostedt <rostedt(a)goodmis.org> tracing/probes: Limit size of event probe to 3K Johan Hovold <johan(a)kernel.org> spi: topcliff-pch: fix use-after-free on unbind Johan Hovold <johan(a)kernel.org> spi: topcliff-pch: fix controller deregistration Thorsten Blum <thorsten.blum(a)linux.dev> thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp Thorsten Blum <thorsten.blum(a)linux.dev> thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> thermal: core: Free thermal zone ID later during removal Michael Bommarito <michael.bommarito(a)gmail.com> udf: reject descriptors with oversized CRC length David Carlier <devnexen(a)gmail.com> tracefs: Fix default permissions not being applied on initial mount Conor Dooley <conor.dooley(a)microchip.com> spi: microchip-core-qspi: control built-in cs manually Conor Dooley <conor.dooley(a)microchip.com> spi: microchip-core-qspi: don't attempt to transmit during emulated read-only dual/quad operations Johan Hovold <johan(a)kernel.org> spi: microchip-core-qspi: fix controller deregistration Guangshuo Li <lgs201920130244(a)gmail.com> ice: fix double free in ice_sf_eth_activate() error path Mingming Cao <mmc(a)linux.ibm.com> ibmveth: Disable GSO for packets with small MSS Dexuan Cui <decui(a)microsoft.com> hv_sock: Return -EIO for malformed/short packets Dexuan Cui <decui(a)microsoft.com> hv_sock: Report EOF instead of -EIO for FIN Hamza Mahfooz <hamzamahfooz(a)linux.microsoft.com> hv_sock: fix ARM64 support Thomas Zimmermann <tzimmermann(a)suse.de> hv: Select CONFIG_SYSFB only for CONFIG_HYPERV_VMBUS Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> gpio: of: clear OF_POPULATED on hog nodes in remove path Xu Yang <xu.yang_2(a)nxp.com> extcon: ptn5150: handle pending IRQ events during system resume Shyam Prasad N <sprasad(a)microsoft.com> cifs: change_conf needs to be called for session setup Shyam Prasad N <sprasad(a)microsoft.com> cifs: abort open_cached_dir if we don't request leases Jens Axboe <axboe(a)kernel.dk> block: only read from sqe on initial invocation of blkdev_uring_cmd() Naman Jain <namjain(a)linux.microsoft.com> block: add pgmap check to biovec_phys_mergeable Wentao Liang <vulab(a)iscas.ac.cn> pmdomain: mediatek: fix use-after-free in scpsys_get_bus_protection_legacy() Breno Leitao <leitao(a)debian.org> arm64/fpsimd: ptrace: zero target's fpsimd_state, not the tracer's Jiexun Wang <wangjiexun2025(a)gmail.com> af_unix: Reject SIOCATMARK on non-stream sockets Myeonghun Pak <mhun512(a)gmail.com> hwmon: (corsair-psu) Close HID device on probe errors Johan Hovold <johan(a)kernel.org> clk: rk808: fix OF node reference imbalance Sanman Pradhan <psanman(a)juniper.net> hwmon: (ltc2992) Fix u32 overflow in power read path Sanman Pradhan <psanman(a)juniper.net> hwmon: (ltc2992) Clamp threshold writes to hardware range Ivan Hu <ivan.hu(a)canonical.com> x86/efi: Fix graceful fault handling after FPU softirq changes Hongling Zeng <zenghongling(a)kylinos.cn> parisc: Fix IRQ leak in LASI driver Tzung-Bi Shih <tzungbi(a)kernel.org> platform/chrome: cros_ec_typec: Init mutex in Thunderbolt registration Pavitra Jha <jhapavitra98(a)gmail.com> net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler Nan Li <tonanli66(a)gmail.com> net/rds: handle zerocopy send cleanup before the message is queued Breno Leitao <leitao(a)debian.org> netpoll: pass buffer size to egress_dev() to avoid MAC truncation Jiawen Wu <jiawenwu(a)trustnetic.com> net: libwx: use request_irq for VF misc interrupt Maoyi Xie <maoyixie.tju(a)gmail.com> ip6_gre: Use cached t->net in ip6erspan_changelink(). Jiawen Wu <jiawenwu(a)trustnetic.com> net: libwx: fix VF illegal register access Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> pseries/papr-hvpipe: Fix the usage of copy_to_user() Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> pseries/papr-hvpipe: Fix & simplify error handling in papr_hvpipe_init() Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> pseries/papr-hvpipe: Prevent kernel stack memory leak to userspace SeungJu Cheon <suunj1331(a)gmail.com> sound: ua101: fix division by zero at probe Dapeng Mi <dapeng1.mi(a)linux.intel.com> perf/x86/intel: Improve validation and configuration of ACR masks Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: skip inactive subflows Kai Zen <kai.aizen.dev(a)gmail.com> net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Fix SYM_SIGFUNC_START definition for 32BIT Sang-Heon Jeon <ekffu200098(a)gmail.com> mm/hugetlb_cma: round up per_node before logging it Kevin Brodsky <kevin.brodsky(a)arm.com> arm64: signal: Preserve POR_EL0 if poe_context is missing Tudor Ambarus <tudor.ambarus(a)linaro.org> mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show() Fuad Tabba <tabba(a)google.com> KVM: arm64: Fix kvm_vcpu_initialized() macro parameter Miklos Szeredi <mszeredi(a)redhat.com> fanotify: fix false positive on permission events Johan Hovold <johan(a)kernel.org> staging: vme_user: fix root device leak on init failure Johan Hovold <johan(a)kernel.org> spi: s3c64xx: fix NULL-deref on driver unbind Johan Hovold <johan(a)kernel.org> spi: zynqmp-gqspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sun6i: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: ti-qspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sun4i: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: syncuacer: fix controller deregistration Miguel Ojeda <ojeda(a)kernel.org> rust: allow `clippy::collapsible_if` globally Miguel Ojeda <ojeda(a)kernel.org> rust: allow `clippy::collapsible_match` globally Eliot Courtney <ecourtney(a)nvidia.com> rust: drm: gem: clean up GEM state in init failure case Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt Tristan Madani <tristan(a)talencesecurity.com> Bluetooth: btmtk: validate WMT event SKB length before struct access Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: virtio_bt: validate rx pkt_type header length Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: virtio_bt: clamp rx length before skb_put Tao Cui <cuitao(a)kylinos.cn> LoongArch: KVM: Fix missing EMULATE_FAIL in kvm_emu_mmio_read() Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: prune /sys/fs/selinux/user Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: prune /sys/fs/selinux/disable Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: prune /sys/fs/selinux/checkreqprot Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: shrink critical section in sel_write_load() David Windsor <dwindsor(a)gmail.com> selinux: don't reserve xattr slot when we won't fill it Zongyao Chen <ZongYao.Chen(a)linux.alibaba.com> selinux: use sk blob accessor in socket permission helpers Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: fix avdcache auditing Michael Bommarito <michael.bommarito(a)gmail.com> xfrm: ah: account for ESN high bits in async callbacks Yilin Zhu <zylzyl2333(a)gmail.com> ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() Michal Kosiorek <mkosiorek121(a)gmail.com> xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete Ruijie Li <ruijieli51(a)gmail.com> xfrm: provide message size for XFRM_MSG_MAPPING Ard Biesheuvel <ardb(a)kernel.org> x86/efi: Restore IRQ state in EFI page fault handler Sourabh Jain <sourabhjain(a)linux.ibm.com> powerpc/kdump: fix KASAN sanitization flag for core_$(BITS).o Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: seq: Fix UMP group 16 filtering Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: core: Serialize deferred fasync state checks Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: firewire-tascam: Do not drop unread control events Yuriy Padlyak <yuriypadlyak(a)gmail.com> ALSA: hda/realtek: Fix speaker silence after S3 resume on Xiaomi Mi Laptop Pro 15 Takashi Iwai <tiwai(a)suse.de> ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: hda: cs35l56: Propagate ASP TX source control errors Xu Yang <xu.yang_2(a)nxp.com> usb: typec: tcpm: fix debug accessory mode detection for sink ports Felix Gu <ustc.gu(a)gmail.com> usb: ulpi: fix memory leak on ulpi_register() error paths Fabio Porcedda <fabio.porcedda(a)gmail.com> USB: serial: option: add Telit Cinterion LE910Cx compositions Aaro Koskinen <aaro.koskinen(a)iki.fi> USB: omap_udc: DMA: Don't enable burst 4 mode Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Fix UAC3 cluster descriptor size check Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: midi2: Restart output URBs on resume Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: usblp: fix heap leak in IEEE 1284 device ID via short response Marek Szyprowski <m.szyprowski(a)samsung.com> wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task Tristan Madani <tristan(a)talencesecurity.com> wifi: b43: enforce bounds check on firmware key index in b43_rx() Johannes Berg <johannes.berg(a)intel.com> wifi: mac80211: remove station if connection prep fails Jiri Slaby (SUSE) <jirislaby(a)kernel.org> wifi: ath5k: do not access array OOB Benjamin Berg <benjamin.berg(a)intel.com> wifi: mac80211: use safe list iteration in radar detect work Jeongjun Park <aha310510(a)gmail.com> wifi: rsi: fix kthread lifetime race between self-exit and external-stop Catherine <enderaoelyther(a)gmail.com> wifi: mac80211: drop stray 'static' from fast-RX rx_result Tristan Madani <tristan(a)talencesecurity.com> wifi: b43legacy: enforce bounds check on firmware key index in RX path Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work Leon Yen <leon.yen(a)mediatek.com> wifi: mt76: mt7921: fix a potential clc buffer length underflow Ming Yen Hsieh <mingyen.hsieh(a)mediatek.com> wifi: mt76: mt7925: fix incorrect length field in txpower command Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7925: fix AMPDU state handling in mt7925_tx_check_aggr Jann Horn <jannh(a)google.com> exit: prevent preemption of oopsing TASK_DEAD task Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked Ovidiu Panait <ovidiu.panait.rb(a)renesas.com> net: stmmac: Disable EEE RX clock stop when VLAN is enabled Paolo Bonzini <pbonzini(a)redhat.com> KVM: SVM: check validity of VMCB controls when returning from SMM Zhengchuan Liang <zcliangcn(a)gmail.com> net: af_key: zero aligned sockaddr tail in PF_KEY exports Yi Kuo <yi(a)yikuo.dev> smb: client/smbdirect: fix MR registration for coalesced SG lists Gang Yan <yangang(a)kylinos.cn> mptcp: sync the msk->sndbuf at accept() time Qingfang Deng <qingfang.deng(a)linux.dev> flow_dissector: do not dissect PPPoE PFC frames Sam Edwards <cfsworks(a)gmail.com> ceph: fix num_ops off-by-one when crypto allocation fails Sean Christopherson <seanjc(a)google.com> KVM: x86: Fix shadow paging use-after-free due to unexpected GFN DaeMyung Kang <charsyam(a)gmail.com> ksmbd: rewrite stop_sessions() with restartable iteration Johan Hovold <johan(a)kernel.org> spi: rockchip: fix controller deregistration Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7925: fix incorrect TLV length in CLC command Mark Brown <broonie(a)kernel.org> ASoC: SOF: Don't allow pointer operations on unconfigured streams Sina Hassani <sina(a)openai.com> iommufd: Fix a race with concurrent allocation and unmap David Carlier <devnexen(a)gmail.com> tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() Shivam Kalra <shivamkalra98(a)zohomail.in> ACPI: video: force native backlight on HP OMEN 16 (8A44) Jinjie Ruan <ruanjinjie(a)huawei.com> ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug Jan Schär <jan(a)jschaer.ch> ACPI: video: Add backlight=native quirk for Dell OptiPlex 7770 AIO Guangshuo Li <lgs201920130244(a)gmail.com> ACPI: scan: Use acpi_dev_put() in object add error paths Rajat Gupta <rajgupt(a)qti.qualcomm.com> fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free Corey Minyard <corey(a)minyard.net> ipmi:si: Return state to normal if message allocation fails Corey Minyard <corey(a)minyard.net> ipmi: Check event message buffer response for bad data Corey Minyard <corey(a)minyard.net> ipmi: Add limits to event and receive message requests Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() ------------- Diffstat: .../ABI/{obsolete => removed}/sysfs-selinux-user | 0 Makefile | 6 +- arch/arm64/include/asm/kvm_host.h | 2 +- arch/arm64/kernel/ptrace.c | 4 +- arch/arm64/kernel/signal.c | 54 +++++-- arch/arm64/kvm/arm.c | 4 + arch/arm64/kvm/config.c | 17 +- arch/arm64/kvm/hyp/nvhe/pkvm.c | 38 +++-- arch/arm64/kvm/hyp/nvhe/setup.c | 8 +- arch/arm64/kvm/vgic/vgic-mmio-v2.c | 2 +- arch/arm64/kvm/vgic/vgic-mmio-v3.c | 2 +- arch/loongarch/include/asm/linkage.h | 2 +- arch/loongarch/kvm/exit.c | 1 + arch/loongarch/kvm/interrupt.c | 14 ++ arch/loongarch/kvm/mmu.c | 2 +- arch/loongarch/kvm/switch.S | 2 +- arch/loongarch/kvm/timer.c | 10 +- arch/loongarch/kvm/vm.c | 2 +- arch/loongarch/pci/acpi.c | 5 + arch/loongarch/pci/pci.c | 3 + arch/powerpc/kexec/Makefile | 2 +- arch/powerpc/platforms/pseries/papr-hvpipe.c | 53 +++--- arch/powerpc/sysdev/xive/common.c | 16 +- arch/riscv/kvm/vcpu_vector.c | 5 +- arch/s390/kernel/debug.c | 8 + arch/x86/events/core.c | 13 +- arch/x86/events/intel/core.c | 32 +++- arch/x86/include/asm/efi.h | 3 +- arch/x86/include/asm/msr-index.h | 3 +- arch/x86/kernel/cpu/amd.c | 3 + arch/x86/kvm/hyperv.c | 2 +- arch/x86/kvm/lapic.c | 8 +- arch/x86/kvm/mmu/mmu.c | 35 ++-- arch/x86/kvm/svm/nested.c | 12 +- arch/x86/kvm/svm/svm.c | 4 + arch/x86/kvm/svm/svm.h | 1 + arch/x86/mm/fault.c | 2 +- arch/x86/platform/efi/quirks.c | 13 +- block/blk.h | 2 + block/ioctl.c | 24 +-- drivers/acpi/cppc_acpi.c | 6 +- drivers/acpi/power.c | 2 +- drivers/acpi/scan.c | 2 +- drivers/acpi/video_detect.c | 16 ++ drivers/android/binder/range_alloc/array.rs | 1 - drivers/bluetooth/btmtk.c | 15 +- drivers/bluetooth/virtio_bt.c | 39 ++++- drivers/char/ipmi/ipmi_si_intf.c | 70 ++++++-- drivers/char/ipmi/ipmi_ssif.c | 23 ++- drivers/clk/clk-rk808.c | 2 +- drivers/clk/imx/clk-imx8-acm.c | 3 +- drivers/clk/microchip/clk-mpfs-ccc.c | 6 +- drivers/cpuidle/cpuidle-powernv.c | 5 +- drivers/cpuidle/cpuidle-pseries.c | 5 +- drivers/crypto/caam/caamalg_qi2.c | 4 +- drivers/crypto/caam/caamhash.c | 4 +- .../crypto/intel/qat/qat_common/adf_accel_engine.c | 7 + .../qat/qat_common/icp_qat_fw_loader_handle.h | 1 + drivers/crypto/intel/qat/qat_common/qat_hal.c | 27 ++-- drivers/extcon/extcon-ptn5150.c | 14 ++ drivers/firmware/samsung/exynos-acpm-pmic.c | 10 +- drivers/firmware/samsung/exynos-acpm-pmic.h | 10 +- drivers/firmware/samsung/exynos-acpm.c | 16 +- drivers/firmware/samsung/exynos-acpm.h | 2 +- drivers/gpio/gpiolib-of.c | 9 +- drivers/hv/Kconfig | 2 +- drivers/hwmon/corsair-psu.c | 4 +- drivers/hwmon/ltc2992.c | 41 +++-- drivers/hwmon/powerz.c | 5 +- drivers/infiniband/hw/hns/hns_roce_qp.c | 7 + drivers/infiniband/hw/ionic/ionic_ibdev.c | 2 +- drivers/infiniband/hw/mana/cq.c | 5 +- drivers/infiniband/hw/mana/qp.c | 16 +- drivers/infiniband/hw/mlx4/srq.c | 4 +- drivers/infiniband/hw/mlx5/main.c | 1 + drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 4 +- drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c | 2 +- drivers/infiniband/sw/rxe/rxe_recv.c | 11 ++ drivers/infiniband/sw/rxe/rxe_resp.c | 14 +- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 7 + drivers/iommu/intel/nested.c | 6 +- drivers/iommu/iommufd/eventq.c | 5 +- drivers/iommu/iommufd/io_pagetable.c | 10 ++ drivers/md/dm-ioctl.c | 6 +- drivers/md/dm-verity-fec.c | 8 +- drivers/md/persistent-data/dm-btree-remove.c | 8 + drivers/md/raid10.c | 2 + drivers/mfd/sec-acpm.c | 10 +- drivers/mmc/core/card.h | 11 ++ drivers/mmc/core/mmc.c | 12 ++ drivers/mmc/core/queue.c | 9 +- drivers/mmc/core/quirks.h | 12 ++ drivers/mtd/spi-nor/debugfs.c | 4 +- drivers/net/ethernet/ibm/ibmveth.c | 22 +++ drivers/net/ethernet/ibm/ibmveth.h | 1 + drivers/net/ethernet/intel/ice/ice_sf_eth.c | 2 + .../ethernet/marvell/octeon_ep_vf/octep_vf_rx.c | 36 ++++- drivers/net/ethernet/mellanox/mlx4/srq.c | 13 +- drivers/net/ethernet/stmicro/stmmac/chain_mode.c | 2 +- drivers/net/ethernet/stmicro/stmmac/common.h | 2 +- drivers/net/ethernet/stmicro/stmmac/ring_mode.c | 2 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 47 +++--- drivers/net/ethernet/wangxun/libwx/wx_hw.c | 7 +- drivers/net/ethernet/wangxun/libwx/wx_vf_common.c | 4 +- drivers/net/wireless/ath/ath5k/base.c | 3 +- drivers/net/wireless/broadcom/b43/xmit.c | 3 +- drivers/net/wireless/broadcom/b43legacy/xmit.c | 3 +- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 6 +- drivers/net/wireless/mediatek/mt76/mt7921/main.c | 7 +- drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | 3 + drivers/net/wireless/mediatek/mt76/mt7925/mac.c | 6 +- drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 4 +- drivers/net/wireless/rsi/rsi_common.h | 5 +- drivers/net/wwan/t7xx/t7xx_modem_ops.c | 20 ++- drivers/net/wwan/t7xx/t7xx_port_ctrl_msg.c | 18 ++- drivers/net/wwan/t7xx/t7xx_port_proxy.h | 2 +- drivers/nvme/host/apple.c | 6 +- drivers/nvme/target/core.c | 2 +- drivers/nvme/target/tcp.c | 26 +++ drivers/parisc/lasi.c | 12 +- drivers/pci/pci.c | 7 +- drivers/pci/pcie/aer.c | 2 - drivers/pci/pcie/aspm.c | 17 +- drivers/pci/setup-res.c | 2 + drivers/platform/chrome/cros_typec_altmode.c | 1 + drivers/pmdomain/core.c | 10 +- drivers/pmdomain/mediatek/mtk-pm-domains.c | 10 +- drivers/power/supply/max17042_battery.c | 2 +- drivers/scsi/mpt3sas/mpt3sas_scsih.c | 14 +- drivers/spi/spi-microchip-core-qspi.c | 103 +++++++++--- drivers/spi/spi-rockchip.c | 4 +- drivers/spi/spi-s3c64xx.c | 5 - drivers/spi/spi-sun4i.c | 10 +- drivers/spi/spi-sun6i.c | 8 +- drivers/spi/spi-synquacer.c | 8 +- drivers/spi/spi-ti-qspi.c | 14 +- drivers/spi/spi-topcliff-pch.c | 11 +- drivers/spi/spi-zynqmp-gqspi.c | 4 +- drivers/staging/vme_user/vme_fake.c | 2 + drivers/target/target_core_configfs.c | 2 +- drivers/thermal/sprd_thermal.c | 4 +- drivers/thermal/thermal_core.c | 6 +- drivers/usb/class/usblp.c | 3 +- drivers/usb/common/ulpi.c | 5 +- drivers/usb/gadget/udc/omap_udc.c | 4 - drivers/usb/serial/option.c | 4 + drivers/usb/typec/tcpm/tcpm.c | 25 +-- drivers/video/fbdev/core/fb_defio.c | 178 ++++++++++++++++----- drivers/video/fbdev/udlfb.c | 31 +++- fs/btrfs/inode.c | 2 + fs/btrfs/space-info.c | 2 +- fs/ceph/addr.c | 4 + fs/erofs/decompressor.c | 86 +++++----- fs/f2fs/data.c | 28 +++- fs/f2fs/extent_cache.c | 17 +- fs/f2fs/f2fs.h | 2 + fs/f2fs/inline.c | 22 ++- fs/f2fs/inode.c | 2 +- fs/f2fs/node.c | 95 +++++------ fs/f2fs/sysfs.c | 10 +- fs/hfsplus/bfind.c | 51 ++++++ fs/hfsplus/catalog.c | 4 +- fs/hfsplus/dir.c | 2 +- fs/hfsplus/hfsplus_fs.h | 9 ++ fs/hfsplus/super.c | 6 +- fs/isofs/export.c | 2 +- fs/isofs/rock.c | 9 ++ fs/notify/fsnotify.c | 2 +- fs/notify/mark.c | 18 ++- fs/smb/client/cached_dir.c | 8 + fs/smb/client/cifsacl.c | 37 ++++- fs/smb/client/smb2inode.c | 12 +- fs/smb/client/smb2misc.c | 3 +- fs/smb/client/smb2ops.c | 11 ++ fs/smb/client/smbdirect.c | 21 +-- fs/smb/server/connection.c | 48 ++++-- fs/smb/server/connection.h | 1 + fs/tracefs/event_inode.c | 14 ++ fs/tracefs/inode.c | 6 +- fs/tracefs/internal.h | 3 + fs/udf/misc.c | 8 +- include/linux/dma-mapping.h | 13 ++ include/linux/fb.h | 4 +- .../linux/firmware/samsung/exynos-acpm-protocol.h | 29 ++-- include/linux/fsnotify_backend.h | 1 + include/linux/mmc/card.h | 2 + include/linux/printk.h | 13 ++ include/uapi/linux/io_uring.h | 3 +- include/video/udlfb.h | 1 + io_uring/io_uring.c | 12 +- io_uring/kbuf.c | 12 +- io_uring/kbuf.h | 7 + kernel/bpf/arena.c | 19 ++- kernel/exit.c | 1 + kernel/sched/ext_idle.c | 12 +- kernel/trace/trace_probe.c | 6 + kernel/trace/trace_probe.h | 4 +- kernel/tracepoint.c | 2 + lib/crypto/mpi/mpicoder.c | 2 +- lib/scatterlist.c | 8 +- mm/damon/core.c | 5 + mm/damon/stat.c | 30 ++-- mm/damon/sysfs-schemes.c | 12 +- mm/hugetlb_cma.c | 1 + mm/swapfile.c | 21 ++- net/bluetooth/hci_event.c | 29 +++- net/bluetooth/l2cap_sock.c | 9 ++ net/ceph/auth.c | 2 +- net/ceph/mon_client.c | 2 + net/core/flow_dissector.c | 13 +- net/core/netpoll.c | 23 +-- net/core/rtnetlink.c | 1 + net/ipv4/ah4.c | 14 +- net/ipv6/ah6.c | 14 +- net/ipv6/ip6_gre.c | 5 +- net/ipv6/xfrm6_protocol.c | 4 +- net/key/af_key.c | 52 +++--- net/mac80211/mlme.c | 9 +- net/mac80211/rx.c | 2 +- net/mac80211/util.c | 4 +- net/mptcp/fastopen.c | 4 +- net/mptcp/pm.c | 62 ++++--- net/mptcp/pm_kernel.c | 13 +- net/mptcp/protocol.c | 6 +- net/mptcp/sockopt.c | 16 +- net/mptcp/subflow.c | 4 +- net/openvswitch/vport-netdev.c | 6 +- net/psp/psp_main.c | 42 +++-- net/rds/message.c | 20 ++- net/sched/sch_red.c | 2 +- net/unix/af_unix.c | 3 + net/vmw_vsock/hyperv_transport.c | 33 +++- net/xfrm/xfrm_state.c | 12 +- net/xfrm/xfrm_user.c | 1 + rust/kernel/drm/gem/mod.rs | 13 +- rust/pin-init/src/__internal.rs | 28 ++-- rust/pin-init/src/macros.rs | 91 ++++++----- security/selinux/hooks.c | 38 ++--- security/selinux/include/objsec.h | 4 +- security/selinux/include/security.h | 2 - security/selinux/selinuxfs.c | 169 ++++--------------- security/selinux/ss/services.c | 125 --------------- sound/core/misc.c | 8 +- sound/core/oss/pcm_oss.c | 29 +++- sound/core/seq/seq_clientmgr.c | 2 +- sound/core/seq/seq_clientmgr.h | 5 +- sound/core/seq/seq_ump_client.c | 2 +- sound/firewire/tascam/tascam-hwdep.c | 1 + sound/hda/codecs/realtek/alc269.c | 19 +++ sound/hda/codecs/side-codecs/cs35l56_hda.c | 19 ++- sound/soc/amd/yc/acp6x-mach.c | 14 ++ sound/soc/codecs/es8389.c | 2 +- sound/soc/fsl/fsl_easrc.c | 2 +- sound/soc/intel/boards/bytcr_wm5102.c | 1 + sound/soc/qcom/qdsp6/q6apm-dai.c | 1 + sound/soc/qcom/qdsp6/q6apm-lpass-dais.c | 2 +- sound/soc/qcom/qdsp6/q6apm.c | 3 + sound/soc/sof/compress.c | 3 + sound/usb/midi2.c | 9 +- sound/usb/misc/ua101.c | 7 + sound/usb/stream.c | 4 +- tools/arch/x86/include/asm/msr-index.h | 3 +- tools/testing/selftests/net/mptcp/mptcp_lib.sh | 16 +- tools/testing/selftests/net/mptcp/pm_netlink.sh | 20 ++- 264 files changed, 2397 insertions(+), 1123 deletions(-)

5 days, 5 hours

8
7
0 0

[PATCH 6.12 000/206] 6.12.88-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.12.88 release. There are 206 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 14 May 2026 17:38:03 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.88-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.12.88-rc1 Prathyushi Nangia <prathyushi.nangia(a)amd.com> x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache Marc Zyngier <maz(a)kernel.org> KVM: arm64: Wake-up from WFI when iqrchip is in userspace Gary Guo <gary(a)garyguo.net> rust: pin-init: fix incorrect accessor reference lifetime David Carlier <devnexen(a)gmail.com> tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7925: fix incorrect TLV length in CLC command Sam Edwards <cfsworks(a)gmail.com> net: stmmac: Prevent NULL deref when RX memory exhausted Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY() Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> net: stmmac: avoid shadowing global buf_sz Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: aloop: Fix peer runtime UAF during format-change stop Thorsten Blum <thorsten.blum(a)linux.dev> crypto: caam - guard HMAC key hex dumps in hash_digest_key Thorsten Blum <thorsten.blum(a)linux.dev> printk: add print_hex_dump_devel() David Carlier <devnexen(a)gmail.com> gtp: disable BH before calling udp_tunnel_xmit_skb() Junrui Luo <moonafterrain(a)outlook.com> erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap() Gao Xiang <xiang(a)kernel.org> erofs: tidy up z_erofs_lz4_handle_overlap() Gao Xiang <xiang(a)kernel.org> erofs: move {in,out}pages into struct z_erofs_decompress_req Thorsten Blum <thorsten.blum(a)linux.dev> crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx Ard Biesheuvel <ardb(a)kernel.org> crypto: nx - Migrate to scomp API Zilin Guan <zilin(a)seu.edu.cn> hfsplus: fix held lock freed on hfsplus_fill_super() Deepanshu Kartikey <kartikey406(a)gmail.com> hfsplus: fix uninit-value by validating catalog record size Miquel Raynal <miquel.raynal(a)bootlin.com> mtd: spinand: winbond: Declare the QE bit on W25NxxJW Seohyeon Maeng <bioloidgp(a)gmail.com> udf: fix partition descriptor append bookkeeping Luke Wang <ziniu.wang_1(a)nxp.com> mmc: core: Optimize time for secure erase/trim for some Kingston eMMCs David Carlier <devnexen(a)gmail.com> octeon_ep_vf: add NULL check for napi_build_skb() Thomas Weißschuh <linux(a)weissschuh.net> hwmon: (powerz) Avoid cacheline sharing for DMA buffer Michael S. Tsirkin <mst(a)redhat.com> dma-mapping: add __dma_from_device_group_begin()/end() Christoph Hellwig <hch(a)lst.de> dma-mapping: drop unneeded includes from dma-mapping.h Amir Goldstein <amir73il(a)gmail.com> fs: prepare for adding LSM blob to backing_file Thomas Zimmermann <tzimmermann(a)suse.de> fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info Alexei Starovoitov <ast(a)kernel.org> bpf: Fix use-after-free in arena_vm_close on fork Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Use per-root-bridge PCIH flag to skip mem resource fixup Tao Cui <cuitao(a)kylinos.cn> LoongArch: KVM: Use kvm_set_pte() in kvm_flush_pte() Bibo Mao <maobibo(a)loongson.cn> LoongArch: KVM: Move unconditional delay into timer clear scenery Bibo Mao <maobibo(a)loongson.cn> LoongArch: KVM: Fix HW timer interrupt lost when inject interrupt by software Xianglai Li <lixianglai(a)loongson.cn> LoongArch: KVM: Fix "unreliable stack" for kvm_exc_entry Qiang Ma <maqianga(a)uniontech.com> LoongArch: KVM: Cap KVM_CAP_NR_VCPUS by KVM_CAP_MAX_VCPUS Wentao Guan <guanwentao(a)uniontech.com> LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang() Quentin Perret <qperret(a)google.com> KVM: arm64: Fix initialisation order in __pkvm_init_finalise() David Woodhouse <dwmw(a)amazon.co.uk> KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value Guangshuo Li <lgs201920130244(a)gmail.com> f2fs: fix uninitialized kobject put in f2fs_init_sysfs() Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix node_cnt race between extent node destroy and writeback Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix incorrect multidevice info in trace_f2fs_map_blocks() Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix fiemap boundary handling when read extent cache is incomplete Cen Zhang <zzzccc427(a)gmail.com> f2fs: add READ_ONCE() for i_blocks in f2fs_update_inode() Gang Yan <yangang(a)kylinos.cn> mptcp: fix scheduling with atomic in timestamp sockopt Gang Yan <yangang(a)kylinos.cn> mptcp: sockopt: set timestamp flags on subflow socket, not msk Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: fastclose msk when linger time is 0 Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: mptcp: pm: restrict 'unknown' check to pm_nl_ctl Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: mptcp: check output: catch cmd errors Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/rxe: Reject unknown opcodes before ICRC processing Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() Junrui Luo <moonafterrain(a)outlook.com> RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Validate rx_hash_key_len Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() André Draszik <andre.draszik(a)linaro.org> power: supply: max17042: avoid overflow when determining health Lukas Wunner <lukas(a)wunner.de> PCI/ASPM: Fix pci_clear_and_set_config_dword() usage Lukas Wunner <lukas(a)wunner.de> PCI/AER: Stop ruling out unbound devices as error source Shuai Xue <xueshuai(a)linux.alibaba.com> PCI/AER: Clear only error bits in PCIe Device Status Lukas Wunner <lukas(a)wunner.de> PCI: Update saved_config_space upon resource assignment SeongJae Park <sj(a)kernel.org> mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock Paolo Bonzini <pbonzini(a)redhat.com> KVM: x86: check for nEPT/nNPT in slow flush hypercalls Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: validate dacloffset before building DACL pointers Bjoern Doebel <doebel(a)amazon.de> smb: client: use kzalloc to zero-initialize security descriptor buffer Zisen Ye <zisenye(a)stu.xidian.edu.cn> smb/client: fix out-of-bounds read in symlink_data() Zisen Ye <zisenye(a)stu.xidian.edu.cn> smb/client: fix out-of-bounds read in smb2_compound_op() Vasily Gorbik <gor(a)linux.ibm.com> s390/debug: Reject zero-length input in debug_input_flush_fn() Osama Abdelkader <osama.abdelkader(a)gmail.com> riscv: kvm: fix vector context allocation leak Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/hns: Fix unlocked call to hns_roce_qp_remove() Ulf Hansson <ulf.hansson(a)linaro.org> pmdomain: core: Fix detach procedure for virtual devices in genpd Ilya Maximets <i.maximets(a)ovn.org> openvswitch: vport: fix self-deadlock on release of tunnel ports Chaitanya Kulkarni <kch(a)nvidia.com> nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free Chaitanya Kulkarni <kch(a)nvidia.com> nvmet-tcp: fix race between ICReq handling and queue teardown Fedor Pchelkin <pchelkin(a)ispras.ru> nvme-apple: drop invalid put of admin queue reference count Junrui Luo <moonafterrain(a)outlook.com> md/raid10: fix divide-by-zero in setup_geo() with zero far_copies Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Fix slab-out-of-bounds access in auth message processing Christian A. Ehrhardt <lk(a)c--e.de> lib/scatterlist: fix temp buffer in extract_user_to_sg() Christian A. Ehrhardt <lk(a)c--e.de> lib/scatterlist: fix length calculations in extract_kvec_to_sg Lukas Wunner <lukas(a)wunner.de> lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() Nicolin Chen <nicolinc(a)nvidia.com> iommu/arm-smmu-v3: Add a missing dma_wmb() for hitless STE update Michael Bommarito <michael.bommarito(a)gmail.com> isofs: validate block number from NFS file handle in isofs_export_iget Michael Bommarito <michael.bommarito(a)gmail.com> isofs: validate Rock Ridge CE continuation extent against volume size Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: correctly reject too-small hash devices Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: correctly reject too-small FEC devices David Carlier <devnexen(a)gmail.com> eventfs: Hold eventfs_mutex and SRCU when remount walks events Mikulas Patocka <mpatocka(a)redhat.com> dm: fix a buffer overflow in ioctl processing Mikulas Patocka <mpatocka(a)redhat.com> dm: don't report warning when doing deferred remove Mikulas Patocka <mpatocka(a)redhat.com> dm-thin: fix metadata refcount underflow Guangshuo Li <lgs201920130244(a)gmail.com> btrfs: fix double free in create_space_info() error path Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm: remove child devices when apm is removed Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error Joseph Salisbury <joseph.salisbury(a)oracle.com> ASoC: fsl_easrc: fix comment typo Tommaso Soncin <soncintommaso(a)gmail.com> ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table Shrikanth Hegde <sshegde(a)linux.ibm.com> cpuidle: powerpc: avoid double clear when breaking snooze Conor Dooley <conor.dooley(a)microchip.com> clk: microchip: mpfs-ccc: fix out of bounds access during output registration Stefan Eichenberger <stefan.eichenberger(a)toradex.com> clk: imx: imx8-acm: fix flags for acm clocks Johan Hovold <johan(a)kernel.org> spi: topcliff-pch: fix use-after-free on unbind Johan Hovold <johan(a)kernel.org> spi: topcliff-pch: fix controller deregistration Thorsten Blum <thorsten.blum(a)linux.dev> thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp Thorsten Blum <thorsten.blum(a)linux.dev> thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> thermal: core: Free thermal zone ID later during removal Michael Bommarito <michael.bommarito(a)gmail.com> udf: reject descriptors with oversized CRC length Johan Hovold <johan(a)kernel.org> spi: microchip-core-qspi: fix controller deregistration Guangshuo Li <lgs201920130244(a)gmail.com> ice: fix double free in ice_sf_eth_activate() error path Mingming Cao <mmc(a)linux.ibm.com> ibmveth: Disable GSO for packets with small MSS Hamza Mahfooz <hamzamahfooz(a)linux.microsoft.com> hv_sock: fix ARM64 support Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> gpio: of: clear OF_POPULATED on hog nodes in remove path Xu Yang <xu.yang_2(a)nxp.com> extcon: ptn5150: handle pending IRQ events during system resume Shyam Prasad N <sprasad(a)microsoft.com> cifs: change_conf needs to be called for session setup Shyam Prasad N <sprasad(a)microsoft.com> cifs: abort open_cached_dir if we don't request leases Naman Jain <namjain(a)linux.microsoft.com> block: add pgmap check to biovec_phys_mergeable Jiexun Wang <wangjiexun2025(a)gmail.com> af_unix: Reject SIOCATMARK on non-stream sockets Myeonghun Pak <mhun512(a)gmail.com> hwmon: (corsair-psu) Close HID device on probe errors Johan Hovold <johan(a)kernel.org> clk: rk808: fix OF node reference imbalance Sanman Pradhan <psanman(a)juniper.net> hwmon: (ltc2992) Fix u32 overflow in power read path Sanman Pradhan <psanman(a)juniper.net> hwmon: (ltc2992) Clamp threshold writes to hardware range Hongling Zeng <zenghongling(a)kylinos.cn> parisc: Fix IRQ leak in LASI driver Pavitra Jha <jhapavitra98(a)gmail.com> net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler Nan Li <tonanli66(a)gmail.com> net/rds: handle zerocopy send cleanup before the message is queued Maoyi Xie <maoyixie.tju(a)gmail.com> ip6_gre: Use cached t->net in ip6erspan_changelink(). Jiawen Wu <jiawenwu(a)trustnetic.com> net: libwx: fix VF illegal register access SeungJu Cheon <suunj1331(a)gmail.com> sound: ua101: fix division by zero at probe Kai Zen <kai.aizen.dev(a)gmail.com> net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Fix SYM_SIGFUNC_START definition for 32BIT Tudor Ambarus <tudor.ambarus(a)linaro.org> mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show() Fuad Tabba <tabba(a)google.com> KVM: arm64: Fix kvm_vcpu_initialized() macro parameter Miklos Szeredi <mszeredi(a)redhat.com> fanotify: fix false positive on permission events Johan Hovold <johan(a)kernel.org> staging: vme_user: fix root device leak on init failure Johan Hovold <johan(a)kernel.org> spi: s3c64xx: fix NULL-deref on driver unbind Johan Hovold <johan(a)kernel.org> spi: zynqmp-gqspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sun6i: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: ti-qspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sun4i: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: syncuacer: fix controller deregistration Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt Tristan Madani <tristan(a)talencesecurity.com> Bluetooth: btmtk: validate WMT event SKB length before struct access Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: virtio_bt: validate rx pkt_type header length Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: virtio_bt: clamp rx length before skb_put Tao Cui <cuitao(a)kylinos.cn> LoongArch: KVM: Fix missing EMULATE_FAIL in kvm_emu_mmio_read() Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: prune /sys/fs/selinux/disable Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: shrink critical section in sel_write_load() David Windsor <dwindsor(a)gmail.com> selinux: don't reserve xattr slot when we won't fill it Michael Bommarito <michael.bommarito(a)gmail.com> xfrm: ah: account for ESN high bits in async callbacks Yilin Zhu <zylzyl2333(a)gmail.com> ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() Michal Kosiorek <mkosiorek121(a)gmail.com> xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete Ruijie Li <ruijieli51(a)gmail.com> xfrm: provide message size for XFRM_MSG_MAPPING Sourabh Jain <sourabhjain(a)linux.ibm.com> powerpc/kdump: fix KASAN sanitization flag for core_$(BITS).o Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: firewire-tascam: Do not drop unread control events Takashi Iwai <tiwai(a)suse.de> ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger Felix Gu <ustc.gu(a)gmail.com> usb: ulpi: fix memory leak on ulpi_register() error paths Fabio Porcedda <fabio.porcedda(a)gmail.com> USB: serial: option: add Telit Cinterion LE910Cx compositions Aaro Koskinen <aaro.koskinen(a)iki.fi> USB: omap_udc: DMA: Don't enable burst 4 mode Amit Sunil Dhamne <amitsd(a)google.com> usb: typec: tcpm: reset internal port states on soft reset AMS Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Fix UAC3 cluster descriptor size check Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: midi2: Restart output URBs on resume Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: usblp: fix heap leak in IEEE 1284 device ID via short response Marek Szyprowski <m.szyprowski(a)samsung.com> wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task Tristan Madani <tristan(a)talencesecurity.com> wifi: b43: enforce bounds check on firmware key index in b43_rx() Johannes Berg <johannes.berg(a)intel.com> wifi: mac80211: remove station if connection prep fails Jiri Slaby (SUSE) <jirislaby(a)kernel.org> wifi: ath5k: do not access array OOB Benjamin Berg <benjamin.berg(a)intel.com> wifi: mac80211: use safe list iteration in radar detect work Jeongjun Park <aha310510(a)gmail.com> wifi: rsi: fix kthread lifetime race between self-exit and external-stop Catherine <enderaoelyther(a)gmail.com> wifi: mac80211: drop stray 'static' from fast-RX rx_result Tristan Madani <tristan(a)talencesecurity.com> wifi: b43legacy: enforce bounds check on firmware key index in RX path Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work Leon Yen <leon.yen(a)mediatek.com> wifi: mt76: mt7921: fix a potential clc buffer length underflow Ming Yen Hsieh <mingyen.hsieh(a)mediatek.com> wifi: mt76: mt7925: fix incorrect length field in txpower command Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7925: fix AMPDU state handling in mt7925_tx_check_aggr Jann Horn <jannh(a)google.com> exit: prevent preemption of oopsing TASK_DEAD task Hyunwoo Kim <imv4bel(a)gmail.com> rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present David Howells <dhowells(a)redhat.com> rxrpc: Fix conn-level packet handling to unshare RESPONSE packets Hyunwoo Kim <imv4bel(a)gmail.com> Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked Paolo Bonzini <pbonzini(a)redhat.com> KVM: SVM: check validity of VMCB controls when returning from SMM Zhengchuan Liang <zcliangcn(a)gmail.com> net: af_key: zero aligned sockaddr tail in PF_KEY exports Jiawen Wu <jiawenwu(a)trustnetic.com> net: txgbe: fix RTNL assertion warning when remove module Qingfang Deng <qingfang.deng(a)linux.dev> flow_dissector: do not dissect PPPoE PFC frames Ankit Soni <Ankit.Soni(a)amd.com> iommu/amd: serialize sequence allocation under concurrent TLB invalidations Uros Bizjak <ubizjak(a)gmail.com> iommu/amd: Use atomic64_inc_return() in iommu.c Sean Christopherson <seanjc(a)google.com> KVM: x86: Fix shadow paging use-after-free due to unexpected GFN Rick Edgecombe <rick.p.edgecombe(a)intel.com> x86/shstk: Prevent deadlock during shstk sigreturn Linus Torvalds <torvalds(a)linux-foundation.org> x86: shadow stacks: proper error handling for mmap lock Suren Baghdasaryan <surenb(a)google.com> mm: convert mm_lock_seq to a proper seqcount DaeMyung Kang <charsyam(a)gmail.com> ksmbd: rewrite stop_sessions() with restartable iteration Johan Hovold <johan(a)kernel.org> spi: rockchip: fix controller deregistration Mark Brown <broonie(a)kernel.org> ASoC: SOF: Don't allow pointer operations on unconfigured streams Sina Hassani <sina(a)openai.com> iommufd: Fix a race with concurrent allocation and unmap Shivam Kalra <shivamkalra98(a)zohomail.in> ACPI: video: force native backlight on HP OMEN 16 (8A44) Jinjie Ruan <ruanjinjie(a)huawei.com> ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug Jan Schär <jan(a)jschaer.ch> ACPI: video: Add backlight=native quirk for Dell OptiPlex 7770 AIO Guangshuo Li <lgs201920130244(a)gmail.com> ACPI: scan: Use acpi_dev_put() in object add error paths Rajat Gupta <rajgupt(a)qti.qualcomm.com> fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free Corey Minyard <corey(a)minyard.net> ipmi:si: Return state to normal if message allocation fails Corey Minyard <corey(a)minyard.net> ipmi: Check event message buffer response for bad data Corey Minyard <corey(a)minyard.net> ipmi: Add limits to event and receive message requests Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() ------------- Diffstat: Makefile | 4 +- arch/arm64/include/asm/kvm_host.h | 2 +- arch/arm64/kvm/arm.c | 5 + arch/arm64/kvm/hyp/nvhe/setup.c | 8 +- arch/arm64/kvm/vgic/vgic-mmio-v2.c | 2 +- arch/arm64/kvm/vgic/vgic-mmio-v3.c | 2 +- arch/loongarch/include/asm/linkage.h | 2 +- arch/loongarch/kvm/exit.c | 1 + arch/loongarch/kvm/interrupt.c | 14 ++ arch/loongarch/kvm/mmu.c | 2 +- arch/loongarch/kvm/switch.S | 2 +- arch/loongarch/kvm/timer.c | 10 +- arch/loongarch/kvm/vm.c | 2 +- arch/loongarch/pci/acpi.c | 5 + arch/loongarch/pci/pci.c | 3 + arch/powerpc/kexec/Makefile | 2 +- arch/powerpc/platforms/pseries/svm.c | 1 + arch/riscv/kvm/vcpu_vector.c | 5 +- arch/s390/kernel/debug.c | 5 + arch/x86/include/asm/msr-index.h | 3 +- arch/x86/kernel/cpu/amd.c | 3 + arch/x86/kernel/shstk.c | 45 ++++-- arch/x86/kvm/hyperv.c | 2 +- arch/x86/kvm/mmu/mmu.c | 35 ++-- arch/x86/kvm/svm/nested.c | 12 +- arch/x86/kvm/svm/svm.c | 4 + arch/x86/kvm/svm/svm.h | 1 + block/blk.h | 2 + drivers/acpi/cppc_acpi.c | 6 +- drivers/acpi/power.c | 2 +- drivers/acpi/scan.c | 2 +- drivers/acpi/video_detect.c | 16 ++ drivers/bluetooth/btmtk.c | 15 +- drivers/bluetooth/virtio_bt.c | 39 ++++- drivers/char/ipmi/ipmi_si_intf.c | 70 ++++++-- drivers/char/ipmi/ipmi_ssif.c | 23 ++- drivers/clk/clk-rk808.c | 2 +- drivers/clk/imx/clk-imx8-acm.c | 3 +- drivers/clk/microchip/clk-mpfs-ccc.c | 6 +- drivers/cpuidle/cpuidle-powernv.c | 5 +- drivers/cpuidle/cpuidle-pseries.c | 5 +- drivers/crypto/caam/caamalg_qi2.c | 4 +- drivers/crypto/caam/caamhash.c | 4 +- drivers/crypto/nx/nx-842.c | 41 ++--- drivers/crypto/nx/nx-842.h | 15 +- drivers/crypto/nx/nx-common-powernv.c | 31 ++-- drivers/crypto/nx/nx-common-pseries.c | 33 ++-- drivers/extcon/extcon-ptn5150.c | 14 ++ drivers/gpio/gpiolib-of.c | 9 +- drivers/hwmon/corsair-psu.c | 4 +- drivers/hwmon/ltc2992.c | 41 +++-- drivers/hwmon/powerz.c | 5 +- drivers/infiniband/hw/hns/hns_roce_qp.c | 7 + drivers/infiniband/hw/mana/qp.c | 16 +- drivers/infiniband/hw/mlx4/srq.c | 4 +- drivers/infiniband/hw/mlx5/main.c | 1 + drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 4 +- drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c | 2 +- drivers/infiniband/sw/rxe/rxe_recv.c | 11 ++ drivers/infiniband/sw/rxe/rxe_resp.c | 14 +- drivers/iommu/amd/amd_iommu_types.h | 2 +- drivers/iommu/amd/init.c | 2 +- drivers/iommu/amd/iommu.c | 18 ++- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 7 + drivers/iommu/iommufd/io_pagetable.c | 10 ++ drivers/md/dm-ioctl.c | 6 +- drivers/md/dm-verity-fec.c | 8 +- drivers/md/persistent-data/dm-btree-remove.c | 8 + drivers/md/raid10.c | 2 + drivers/mmc/core/card.h | 5 + drivers/mmc/core/queue.c | 9 +- drivers/mmc/core/quirks.h | 9 ++ drivers/mtd/nand/spi/winbond.c | 4 +- drivers/mtd/spi-nor/debugfs.c | 4 +- drivers/net/ethernet/ibm/ibmveth.c | 22 +++ drivers/net/ethernet/ibm/ibmveth.h | 1 + drivers/net/ethernet/intel/ice/ice_sf_eth.c | 2 + .../ethernet/marvell/octeon_ep_vf/octep_vf_rx.c | 36 ++++- drivers/net/ethernet/stmicro/stmmac/chain_mode.c | 2 +- drivers/net/ethernet/stmicro/stmmac/common.h | 2 +- drivers/net/ethernet/stmicro/stmmac/ring_mode.c | 2 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 47 +++--- drivers/net/ethernet/wangxun/libwx/wx_hw.c | 7 +- drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c | 2 + drivers/net/gtp.c | 2 + drivers/net/wireless/ath/ath5k/base.c | 3 +- drivers/net/wireless/broadcom/b43/xmit.c | 3 +- drivers/net/wireless/broadcom/b43legacy/xmit.c | 3 +- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 6 +- drivers/net/wireless/mediatek/mt76/mt7921/main.c | 7 +- drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | 3 + drivers/net/wireless/mediatek/mt76/mt7925/mac.c | 6 +- drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 4 +- drivers/net/wireless/rsi/rsi_common.h | 5 +- drivers/net/wwan/t7xx/t7xx_modem_ops.c | 20 ++- drivers/net/wwan/t7xx/t7xx_port_ctrl_msg.c | 18 ++- drivers/net/wwan/t7xx/t7xx_port_proxy.h | 2 +- drivers/nvme/host/apple.c | 6 +- drivers/nvme/target/core.c | 2 +- drivers/nvme/target/tcp.c | 26 +++ drivers/parisc/lasi.c | 12 +- drivers/pci/pci.c | 7 +- drivers/pci/pcie/aer.c | 2 - drivers/pci/pcie/aspm.c | 17 +- drivers/pci/setup-res.c | 2 + drivers/pmdomain/core.c | 10 +- drivers/power/supply/max17042_battery.c | 2 +- drivers/spi/spi-microchip-core-qspi.c | 12 +- drivers/spi/spi-rockchip.c | 4 +- drivers/spi/spi-s3c64xx.c | 5 - drivers/spi/spi-sun4i.c | 10 +- drivers/spi/spi-sun6i.c | 8 +- drivers/spi/spi-synquacer.c | 8 +- drivers/spi/spi-ti-qspi.c | 14 +- drivers/spi/spi-topcliff-pch.c | 11 +- drivers/spi/spi-zynqmp-gqspi.c | 4 +- drivers/staging/vme_user/vme_fake.c | 2 + drivers/target/target_core_configfs.c | 2 +- drivers/thermal/sprd_thermal.c | 4 +- drivers/thermal/thermal_core.c | 6 +- drivers/usb/class/usblp.c | 3 +- drivers/usb/common/ulpi.c | 5 +- drivers/usb/gadget/udc/omap_udc.c | 4 - drivers/usb/serial/option.c | 4 + drivers/usb/typec/tcpm/tcpm.c | 2 + drivers/video/fbdev/core/fb_defio.c | 179 ++++++++++++++++----- drivers/video/fbdev/udlfb.c | 31 +++- fs/btrfs/space-info.c | 2 +- fs/erofs/compress.h | 2 +- fs/erofs/decompressor.c | 163 +++++++++---------- fs/erofs/decompressor_deflate.c | 8 +- fs/erofs/decompressor_lzma.c | 8 +- fs/erofs/decompressor_zstd.c | 8 +- fs/erofs/zdata.c | 2 + fs/f2fs/data.c | 28 +++- fs/f2fs/extent_cache.c | 17 +- fs/f2fs/inode.c | 2 +- fs/f2fs/sysfs.c | 10 +- fs/file_table.c | 22 ++- fs/hfsplus/bfind.c | 51 ++++++ fs/hfsplus/catalog.c | 4 +- fs/hfsplus/dir.c | 2 +- fs/hfsplus/hfsplus_fs.h | 9 ++ fs/hfsplus/super.c | 6 +- fs/isofs/export.c | 2 +- fs/isofs/rock.c | 9 ++ fs/notify/fsnotify.c | 2 +- fs/notify/mark.c | 18 ++- fs/smb/client/cached_dir.c | 8 + fs/smb/client/cifsacl.c | 37 ++++- fs/smb/client/smb2inode.c | 12 +- fs/smb/client/smb2misc.c | 3 +- fs/smb/client/smb2ops.c | 11 ++ fs/smb/server/connection.c | 48 ++++-- fs/smb/server/connection.h | 1 + fs/tracefs/event_inode.c | 14 ++ fs/tracefs/inode.c | 5 +- fs/tracefs/internal.h | 3 + fs/udf/misc.c | 8 +- fs/udf/super.c | 4 +- include/linux/dma-mapping.h | 17 +- include/linux/fb.h | 4 +- include/linux/fsnotify_backend.h | 1 + include/linux/mm.h | 12 +- include/linux/mm_types.h | 7 +- include/linux/mmap_lock.h | 101 +++++++----- include/linux/mmc/card.h | 1 + include/linux/printk.h | 13 ++ include/trace/events/rxrpc.h | 1 + include/video/udlfb.h | 1 + kernel/bpf/arena.c | 19 ++- kernel/exit.c | 1 + kernel/fork.c | 5 +- kernel/tracepoint.c | 2 + lib/crypto/mpi/mpicoder.c | 2 +- lib/scatterlist.c | 8 +- mm/damon/sysfs-schemes.c | 12 +- mm/init-mm.c | 2 +- net/bluetooth/hci_event.c | 29 +++- net/bluetooth/l2cap_core.c | 8 +- net/bluetooth/l2cap_sock.c | 6 + net/ceph/auth.c | 2 +- net/ceph/mon_client.c | 2 + net/core/flow_dissector.c | 13 +- net/core/rtnetlink.c | 1 + net/ipv4/ah4.c | 14 +- net/ipv6/ah6.c | 14 +- net/ipv6/ip6_gre.c | 5 +- net/ipv6/xfrm6_protocol.c | 4 +- net/key/af_key.c | 52 +++--- net/mac80211/mlme.c | 9 +- net/mac80211/rx.c | 2 +- net/mac80211/util.c | 4 +- net/mptcp/protocol.c | 3 +- net/mptcp/sockopt.c | 12 +- net/mptcp/subflow.c | 4 +- net/openvswitch/vport-netdev.c | 6 +- net/rds/message.c | 20 ++- net/rxrpc/call_event.c | 4 +- net/rxrpc/conn_event.c | 30 +++- net/sched/sch_red.c | 2 +- net/unix/af_unix.c | 3 + net/vmw_vsock/hyperv_transport.c | 4 +- net/xfrm/xfrm_state.c | 12 +- net/xfrm/xfrm_user.c | 1 + rust/kernel/init/__internal.rs | 28 ++-- rust/kernel/init/macros.rs | 91 ++++++----- security/selinux/hooks.c | 3 +- security/selinux/selinuxfs.c | 54 ++----- sound/core/oss/pcm_oss.c | 29 +++- sound/drivers/aloop.c | 44 +++-- sound/firewire/tascam/tascam-hwdep.c | 1 + sound/soc/amd/yc/acp6x-mach.c | 14 ++ sound/soc/fsl/fsl_easrc.c | 2 +- sound/soc/intel/boards/bytcr_wm5102.c | 1 + sound/soc/qcom/qdsp6/q6apm-dai.c | 1 + sound/soc/qcom/qdsp6/q6apm-lpass-dais.c | 2 +- sound/soc/qcom/qdsp6/q6apm.c | 3 + sound/soc/sof/compress.c | 3 + sound/usb/midi2.c | 9 +- sound/usb/misc/ua101.c | 7 + sound/usb/stream.c | 4 +- tools/arch/x86/include/asm/msr-index.h | 3 +- tools/testing/selftests/net/mptcp/mptcp_lib.sh | 16 +- tools/testing/selftests/net/mptcp/pm_netlink.sh | 20 ++- tools/testing/vma/vma.c | 4 +- tools/testing/vma/vma_internal.h | 4 +- 227 files changed, 1903 insertions(+), 785 deletions(-)

5 days, 8 hours

10
9
0 0

[PATCH 6.12 000/202] 6.12.88-rc2 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.12.88 release. There are 202 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Fri, 15 May 2026 15:37:24 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.88-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.12.88-rc2 Prathyushi Nangia <prathyushi.nangia(a)amd.com> x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache Marc Zyngier <maz(a)kernel.org> KVM: arm64: Wake-up from WFI when iqrchip is in userspace David Carlier <devnexen(a)gmail.com> tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7925: fix incorrect TLV length in CLC command Sam Edwards <cfsworks(a)gmail.com> net: stmmac: Prevent NULL deref when RX memory exhausted Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY() Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> net: stmmac: avoid shadowing global buf_sz Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: aloop: Fix peer runtime UAF during format-change stop Thorsten Blum <thorsten.blum(a)linux.dev> crypto: caam - guard HMAC key hex dumps in hash_digest_key Thorsten Blum <thorsten.blum(a)linux.dev> printk: add print_hex_dump_devel() David Carlier <devnexen(a)gmail.com> gtp: disable BH before calling udp_tunnel_xmit_skb() Junrui Luo <moonafterrain(a)outlook.com> erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap() Gao Xiang <xiang(a)kernel.org> erofs: tidy up z_erofs_lz4_handle_overlap() Gao Xiang <xiang(a)kernel.org> erofs: move {in,out}pages into struct z_erofs_decompress_req Thorsten Blum <thorsten.blum(a)linux.dev> crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx Zilin Guan <zilin(a)seu.edu.cn> hfsplus: fix held lock freed on hfsplus_fill_super() Deepanshu Kartikey <kartikey406(a)gmail.com> hfsplus: fix uninit-value by validating catalog record size Miquel Raynal <miquel.raynal(a)bootlin.com> mtd: spinand: winbond: Declare the QE bit on W25NxxJW Seohyeon Maeng <bioloidgp(a)gmail.com> udf: fix partition descriptor append bookkeeping Luke Wang <ziniu.wang_1(a)nxp.com> mmc: core: Optimize time for secure erase/trim for some Kingston eMMCs David Carlier <devnexen(a)gmail.com> octeon_ep_vf: add NULL check for napi_build_skb() Thomas Weißschuh <linux(a)weissschuh.net> hwmon: (powerz) Avoid cacheline sharing for DMA buffer Michael S. Tsirkin <mst(a)redhat.com> dma-mapping: add __dma_from_device_group_begin()/end() Christoph Hellwig <hch(a)lst.de> dma-mapping: drop unneeded includes from dma-mapping.h Amir Goldstein <amir73il(a)gmail.com> fs: prepare for adding LSM blob to backing_file Thomas Zimmermann <tzimmermann(a)suse.de> fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info Alexei Starovoitov <ast(a)kernel.org> bpf: Fix use-after-free in arena_vm_close on fork Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Use per-root-bridge PCIH flag to skip mem resource fixup Tao Cui <cuitao(a)kylinos.cn> LoongArch: KVM: Use kvm_set_pte() in kvm_flush_pte() Bibo Mao <maobibo(a)loongson.cn> LoongArch: KVM: Move unconditional delay into timer clear scenery Bibo Mao <maobibo(a)loongson.cn> LoongArch: KVM: Fix HW timer interrupt lost when inject interrupt by software Xianglai Li <lixianglai(a)loongson.cn> LoongArch: KVM: Fix "unreliable stack" for kvm_exc_entry Qiang Ma <maqianga(a)uniontech.com> LoongArch: KVM: Cap KVM_CAP_NR_VCPUS by KVM_CAP_MAX_VCPUS Wentao Guan <guanwentao(a)uniontech.com> LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang() Quentin Perret <qperret(a)google.com> KVM: arm64: Fix initialisation order in __pkvm_init_finalise() David Woodhouse <dwmw(a)amazon.co.uk> KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value Guangshuo Li <lgs201920130244(a)gmail.com> f2fs: fix uninitialized kobject put in f2fs_init_sysfs() Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix node_cnt race between extent node destroy and writeback Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix incorrect multidevice info in trace_f2fs_map_blocks() Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix fiemap boundary handling when read extent cache is incomplete Cen Zhang <zzzccc427(a)gmail.com> f2fs: add READ_ONCE() for i_blocks in f2fs_update_inode() Gang Yan <yangang(a)kylinos.cn> mptcp: fix scheduling with atomic in timestamp sockopt Gang Yan <yangang(a)kylinos.cn> mptcp: sockopt: set timestamp flags on subflow socket, not msk Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: fastclose msk when linger time is 0 Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: mptcp: pm: restrict 'unknown' check to pm_nl_ctl Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: mptcp: check output: catch cmd errors Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/rxe: Reject unknown opcodes before ICRC processing Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() Junrui Luo <moonafterrain(a)outlook.com> RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Validate rx_hash_key_len Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() André Draszik <andre.draszik(a)linaro.org> power: supply: max17042: avoid overflow when determining health Lukas Wunner <lukas(a)wunner.de> PCI/ASPM: Fix pci_clear_and_set_config_dword() usage Lukas Wunner <lukas(a)wunner.de> PCI/AER: Stop ruling out unbound devices as error source Shuai Xue <xueshuai(a)linux.alibaba.com> PCI/AER: Clear only error bits in PCIe Device Status Lukas Wunner <lukas(a)wunner.de> PCI: Update saved_config_space upon resource assignment SeongJae Park <sj(a)kernel.org> mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock Paolo Bonzini <pbonzini(a)redhat.com> KVM: x86: check for nEPT/nNPT in slow flush hypercalls Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: validate dacloffset before building DACL pointers Bjoern Doebel <doebel(a)amazon.de> smb: client: use kzalloc to zero-initialize security descriptor buffer Zisen Ye <zisenye(a)stu.xidian.edu.cn> smb/client: fix out-of-bounds read in symlink_data() Zisen Ye <zisenye(a)stu.xidian.edu.cn> smb/client: fix out-of-bounds read in smb2_compound_op() Vasily Gorbik <gor(a)linux.ibm.com> s390/debug: Reject zero-length input in debug_input_flush_fn() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/hns: Fix unlocked call to hns_roce_qp_remove() Ulf Hansson <ulf.hansson(a)linaro.org> pmdomain: core: Fix detach procedure for virtual devices in genpd Ilya Maximets <i.maximets(a)ovn.org> openvswitch: vport: fix self-deadlock on release of tunnel ports Chaitanya Kulkarni <kch(a)nvidia.com> nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free Chaitanya Kulkarni <kch(a)nvidia.com> nvmet-tcp: fix race between ICReq handling and queue teardown Fedor Pchelkin <pchelkin(a)ispras.ru> nvme-apple: drop invalid put of admin queue reference count Junrui Luo <moonafterrain(a)outlook.com> md/raid10: fix divide-by-zero in setup_geo() with zero far_copies Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Fix slab-out-of-bounds access in auth message processing Christian A. Ehrhardt <lk(a)c--e.de> lib/scatterlist: fix temp buffer in extract_user_to_sg() Christian A. Ehrhardt <lk(a)c--e.de> lib/scatterlist: fix length calculations in extract_kvec_to_sg Lukas Wunner <lukas(a)wunner.de> lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() Nicolin Chen <nicolinc(a)nvidia.com> iommu/arm-smmu-v3: Add a missing dma_wmb() for hitless STE update Michael Bommarito <michael.bommarito(a)gmail.com> isofs: validate block number from NFS file handle in isofs_export_iget Michael Bommarito <michael.bommarito(a)gmail.com> isofs: validate Rock Ridge CE continuation extent against volume size Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: correctly reject too-small hash devices Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: correctly reject too-small FEC devices David Carlier <devnexen(a)gmail.com> eventfs: Hold eventfs_mutex and SRCU when remount walks events Mikulas Patocka <mpatocka(a)redhat.com> dm: fix a buffer overflow in ioctl processing Mikulas Patocka <mpatocka(a)redhat.com> dm: don't report warning when doing deferred remove Mikulas Patocka <mpatocka(a)redhat.com> dm-thin: fix metadata refcount underflow Guangshuo Li <lgs201920130244(a)gmail.com> btrfs: fix double free in create_space_info() error path Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm: remove child devices when apm is removed Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error Joseph Salisbury <joseph.salisbury(a)oracle.com> ASoC: fsl_easrc: fix comment typo Tommaso Soncin <soncintommaso(a)gmail.com> ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table Shrikanth Hegde <sshegde(a)linux.ibm.com> cpuidle: powerpc: avoid double clear when breaking snooze Conor Dooley <conor.dooley(a)microchip.com> clk: microchip: mpfs-ccc: fix out of bounds access during output registration Stefan Eichenberger <stefan.eichenberger(a)toradex.com> clk: imx: imx8-acm: fix flags for acm clocks Johan Hovold <johan(a)kernel.org> spi: topcliff-pch: fix use-after-free on unbind Johan Hovold <johan(a)kernel.org> spi: topcliff-pch: fix controller deregistration Thorsten Blum <thorsten.blum(a)linux.dev> thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp Thorsten Blum <thorsten.blum(a)linux.dev> thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> thermal: core: Free thermal zone ID later during removal Michael Bommarito <michael.bommarito(a)gmail.com> udf: reject descriptors with oversized CRC length Johan Hovold <johan(a)kernel.org> spi: microchip-core-qspi: fix controller deregistration Guangshuo Li <lgs201920130244(a)gmail.com> ice: fix double free in ice_sf_eth_activate() error path Mingming Cao <mmc(a)linux.ibm.com> ibmveth: Disable GSO for packets with small MSS Hamza Mahfooz <hamzamahfooz(a)linux.microsoft.com> hv_sock: fix ARM64 support Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> gpio: of: clear OF_POPULATED on hog nodes in remove path Xu Yang <xu.yang_2(a)nxp.com> extcon: ptn5150: handle pending IRQ events during system resume Shyam Prasad N <sprasad(a)microsoft.com> cifs: change_conf needs to be called for session setup Shyam Prasad N <sprasad(a)microsoft.com> cifs: abort open_cached_dir if we don't request leases Naman Jain <namjain(a)linux.microsoft.com> block: add pgmap check to biovec_phys_mergeable Jiexun Wang <wangjiexun2025(a)gmail.com> af_unix: Reject SIOCATMARK on non-stream sockets Myeonghun Pak <mhun512(a)gmail.com> hwmon: (corsair-psu) Close HID device on probe errors Johan Hovold <johan(a)kernel.org> clk: rk808: fix OF node reference imbalance Sanman Pradhan <psanman(a)juniper.net> hwmon: (ltc2992) Fix u32 overflow in power read path Sanman Pradhan <psanman(a)juniper.net> hwmon: (ltc2992) Clamp threshold writes to hardware range Hongling Zeng <zenghongling(a)kylinos.cn> parisc: Fix IRQ leak in LASI driver Pavitra Jha <jhapavitra98(a)gmail.com> net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler Nan Li <tonanli66(a)gmail.com> net/rds: handle zerocopy send cleanup before the message is queued Maoyi Xie <maoyixie.tju(a)gmail.com> ip6_gre: Use cached t->net in ip6erspan_changelink(). Jiawen Wu <jiawenwu(a)trustnetic.com> net: libwx: fix VF illegal register access SeungJu Cheon <suunj1331(a)gmail.com> sound: ua101: fix division by zero at probe Kai Zen <kai.aizen.dev(a)gmail.com> net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Fix SYM_SIGFUNC_START definition for 32BIT Tudor Ambarus <tudor.ambarus(a)linaro.org> mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show() Fuad Tabba <tabba(a)google.com> KVM: arm64: Fix kvm_vcpu_initialized() macro parameter Miklos Szeredi <mszeredi(a)redhat.com> fanotify: fix false positive on permission events Johan Hovold <johan(a)kernel.org> staging: vme_user: fix root device leak on init failure Johan Hovold <johan(a)kernel.org> spi: s3c64xx: fix NULL-deref on driver unbind Johan Hovold <johan(a)kernel.org> spi: zynqmp-gqspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sun6i: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: ti-qspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sun4i: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: syncuacer: fix controller deregistration Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt Tristan Madani <tristan(a)talencesecurity.com> Bluetooth: btmtk: validate WMT event SKB length before struct access Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: virtio_bt: validate rx pkt_type header length Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: virtio_bt: clamp rx length before skb_put Tao Cui <cuitao(a)kylinos.cn> LoongArch: KVM: Fix missing EMULATE_FAIL in kvm_emu_mmio_read() Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: prune /sys/fs/selinux/disable Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: shrink critical section in sel_write_load() David Windsor <dwindsor(a)gmail.com> selinux: don't reserve xattr slot when we won't fill it Michael Bommarito <michael.bommarito(a)gmail.com> xfrm: ah: account for ESN high bits in async callbacks Yilin Zhu <zylzyl2333(a)gmail.com> ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() Michal Kosiorek <mkosiorek121(a)gmail.com> xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete Ruijie Li <ruijieli51(a)gmail.com> xfrm: provide message size for XFRM_MSG_MAPPING Sourabh Jain <sourabhjain(a)linux.ibm.com> powerpc/kdump: fix KASAN sanitization flag for core_$(BITS).o Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: firewire-tascam: Do not drop unread control events Takashi Iwai <tiwai(a)suse.de> ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger Felix Gu <ustc.gu(a)gmail.com> usb: ulpi: fix memory leak on ulpi_register() error paths Fabio Porcedda <fabio.porcedda(a)gmail.com> USB: serial: option: add Telit Cinterion LE910Cx compositions Aaro Koskinen <aaro.koskinen(a)iki.fi> USB: omap_udc: DMA: Don't enable burst 4 mode Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Fix UAC3 cluster descriptor size check Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: midi2: Restart output URBs on resume Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: usblp: fix heap leak in IEEE 1284 device ID via short response Marek Szyprowski <m.szyprowski(a)samsung.com> wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task Tristan Madani <tristan(a)talencesecurity.com> wifi: b43: enforce bounds check on firmware key index in b43_rx() Johannes Berg <johannes.berg(a)intel.com> wifi: mac80211: remove station if connection prep fails Jiri Slaby (SUSE) <jirislaby(a)kernel.org> wifi: ath5k: do not access array OOB Benjamin Berg <benjamin.berg(a)intel.com> wifi: mac80211: use safe list iteration in radar detect work Jeongjun Park <aha310510(a)gmail.com> wifi: rsi: fix kthread lifetime race between self-exit and external-stop Catherine <enderaoelyther(a)gmail.com> wifi: mac80211: drop stray 'static' from fast-RX rx_result Tristan Madani <tristan(a)talencesecurity.com> wifi: b43legacy: enforce bounds check on firmware key index in RX path Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work Leon Yen <leon.yen(a)mediatek.com> wifi: mt76: mt7921: fix a potential clc buffer length underflow Ming Yen Hsieh <mingyen.hsieh(a)mediatek.com> wifi: mt76: mt7925: fix incorrect length field in txpower command Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7925: fix AMPDU state handling in mt7925_tx_check_aggr Jann Horn <jannh(a)google.com> exit: prevent preemption of oopsing TASK_DEAD task Hyunwoo Kim <imv4bel(a)gmail.com> rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present David Howells <dhowells(a)redhat.com> rxrpc: Fix conn-level packet handling to unshare RESPONSE packets Hyunwoo Kim <imv4bel(a)gmail.com> Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked Paolo Bonzini <pbonzini(a)redhat.com> KVM: SVM: check validity of VMCB controls when returning from SMM Zhengchuan Liang <zcliangcn(a)gmail.com> net: af_key: zero aligned sockaddr tail in PF_KEY exports Jiawen Wu <jiawenwu(a)trustnetic.com> net: txgbe: fix RTNL assertion warning when remove module Qingfang Deng <qingfang.deng(a)linux.dev> flow_dissector: do not dissect PPPoE PFC frames Ankit Soni <Ankit.Soni(a)amd.com> iommu/amd: serialize sequence allocation under concurrent TLB invalidations Uros Bizjak <ubizjak(a)gmail.com> iommu/amd: Use atomic64_inc_return() in iommu.c Sean Christopherson <seanjc(a)google.com> KVM: x86: Fix shadow paging use-after-free due to unexpected GFN Rick Edgecombe <rick.p.edgecombe(a)intel.com> x86/shstk: Prevent deadlock during shstk sigreturn Linus Torvalds <torvalds(a)linux-foundation.org> x86: shadow stacks: proper error handling for mmap lock Suren Baghdasaryan <surenb(a)google.com> mm: convert mm_lock_seq to a proper seqcount DaeMyung Kang <charsyam(a)gmail.com> ksmbd: rewrite stop_sessions() with restartable iteration Johan Hovold <johan(a)kernel.org> spi: rockchip: fix controller deregistration Mark Brown <broonie(a)kernel.org> ASoC: SOF: Don't allow pointer operations on unconfigured streams Sina Hassani <sina(a)openai.com> iommufd: Fix a race with concurrent allocation and unmap Shivam Kalra <shivamkalra98(a)zohomail.in> ACPI: video: force native backlight on HP OMEN 16 (8A44) Jinjie Ruan <ruanjinjie(a)huawei.com> ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug Jan Schär <jan(a)jschaer.ch> ACPI: video: Add backlight=native quirk for Dell OptiPlex 7770 AIO Guangshuo Li <lgs201920130244(a)gmail.com> ACPI: scan: Use acpi_dev_put() in object add error paths Rajat Gupta <rajgupt(a)qti.qualcomm.com> fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free Corey Minyard <corey(a)minyard.net> ipmi:si: Return state to normal if message allocation fails Corey Minyard <corey(a)minyard.net> ipmi: Check event message buffer response for bad data Corey Minyard <corey(a)minyard.net> ipmi: Add limits to event and receive message requests Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() ------------- Diffstat: Makefile | 4 +- arch/arm64/include/asm/kvm_host.h | 2 +- arch/arm64/kvm/arm.c | 5 + arch/arm64/kvm/hyp/nvhe/setup.c | 8 +- arch/arm64/kvm/vgic/vgic-mmio-v2.c | 2 +- arch/arm64/kvm/vgic/vgic-mmio-v3.c | 2 +- arch/loongarch/include/asm/linkage.h | 2 +- arch/loongarch/kvm/exit.c | 1 + arch/loongarch/kvm/interrupt.c | 14 ++ arch/loongarch/kvm/mmu.c | 2 +- arch/loongarch/kvm/switch.S | 2 +- arch/loongarch/kvm/timer.c | 10 +- arch/loongarch/kvm/vm.c | 2 +- arch/loongarch/pci/acpi.c | 5 + arch/loongarch/pci/pci.c | 3 + arch/powerpc/kexec/Makefile | 2 +- arch/powerpc/platforms/pseries/svm.c | 1 + arch/s390/kernel/debug.c | 5 + arch/x86/include/asm/msr-index.h | 3 +- arch/x86/kernel/cpu/amd.c | 3 + arch/x86/kernel/shstk.c | 45 ++++-- arch/x86/kvm/hyperv.c | 2 +- arch/x86/kvm/mmu/mmu.c | 35 ++-- arch/x86/kvm/svm/nested.c | 12 +- arch/x86/kvm/svm/svm.c | 4 + arch/x86/kvm/svm/svm.h | 1 + block/blk.h | 2 + drivers/acpi/cppc_acpi.c | 6 +- drivers/acpi/power.c | 2 +- drivers/acpi/scan.c | 2 +- drivers/acpi/video_detect.c | 16 ++ drivers/bluetooth/btmtk.c | 15 +- drivers/bluetooth/virtio_bt.c | 39 ++++- drivers/char/ipmi/ipmi_si_intf.c | 70 ++++++-- drivers/char/ipmi/ipmi_ssif.c | 23 ++- drivers/clk/clk-rk808.c | 2 +- drivers/clk/imx/clk-imx8-acm.c | 3 +- drivers/clk/microchip/clk-mpfs-ccc.c | 6 +- drivers/cpuidle/cpuidle-powernv.c | 5 +- drivers/cpuidle/cpuidle-pseries.c | 5 +- drivers/crypto/caam/caamalg_qi2.c | 4 +- drivers/crypto/caam/caamhash.c | 4 +- drivers/crypto/nx/nx-842.c | 8 +- drivers/extcon/extcon-ptn5150.c | 14 ++ drivers/gpio/gpiolib-of.c | 9 +- drivers/hwmon/corsair-psu.c | 4 +- drivers/hwmon/ltc2992.c | 41 +++-- drivers/hwmon/powerz.c | 5 +- drivers/infiniband/hw/hns/hns_roce_qp.c | 7 + drivers/infiniband/hw/mana/qp.c | 16 +- drivers/infiniband/hw/mlx4/srq.c | 4 +- drivers/infiniband/hw/mlx5/main.c | 1 + drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 4 +- drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c | 2 +- drivers/infiniband/sw/rxe/rxe_recv.c | 11 ++ drivers/infiniband/sw/rxe/rxe_resp.c | 14 +- drivers/iommu/amd/amd_iommu_types.h | 2 +- drivers/iommu/amd/init.c | 2 +- drivers/iommu/amd/iommu.c | 18 ++- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 7 + drivers/iommu/iommufd/io_pagetable.c | 10 ++ drivers/md/dm-ioctl.c | 6 +- drivers/md/dm-verity-fec.c | 8 +- drivers/md/persistent-data/dm-btree-remove.c | 8 + drivers/md/raid10.c | 2 + drivers/mmc/core/card.h | 5 + drivers/mmc/core/queue.c | 9 +- drivers/mmc/core/quirks.h | 9 ++ drivers/mtd/nand/spi/winbond.c | 4 +- drivers/mtd/spi-nor/debugfs.c | 4 +- drivers/net/ethernet/ibm/ibmveth.c | 22 +++ drivers/net/ethernet/ibm/ibmveth.h | 1 + drivers/net/ethernet/intel/ice/ice_sf_eth.c | 2 + .../ethernet/marvell/octeon_ep_vf/octep_vf_rx.c | 36 ++++- drivers/net/ethernet/stmicro/stmmac/chain_mode.c | 2 +- drivers/net/ethernet/stmicro/stmmac/common.h | 2 +- drivers/net/ethernet/stmicro/stmmac/ring_mode.c | 2 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 47 +++--- drivers/net/ethernet/wangxun/libwx/wx_hw.c | 7 +- drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c | 2 + drivers/net/gtp.c | 2 + drivers/net/wireless/ath/ath5k/base.c | 3 +- drivers/net/wireless/broadcom/b43/xmit.c | 3 +- drivers/net/wireless/broadcom/b43legacy/xmit.c | 3 +- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 6 +- drivers/net/wireless/mediatek/mt76/mt7921/main.c | 7 +- drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | 3 + drivers/net/wireless/mediatek/mt76/mt7925/mac.c | 6 +- drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 4 +- drivers/net/wireless/rsi/rsi_common.h | 5 +- drivers/net/wwan/t7xx/t7xx_modem_ops.c | 20 ++- drivers/net/wwan/t7xx/t7xx_port_ctrl_msg.c | 18 ++- drivers/net/wwan/t7xx/t7xx_port_proxy.h | 2 +- drivers/nvme/host/apple.c | 6 +- drivers/nvme/target/core.c | 2 +- drivers/nvme/target/tcp.c | 26 +++ drivers/parisc/lasi.c | 12 +- drivers/pci/pci.c | 7 +- drivers/pci/pcie/aer.c | 2 - drivers/pci/pcie/aspm.c | 17 +- drivers/pci/setup-res.c | 2 + drivers/pmdomain/core.c | 10 +- drivers/power/supply/max17042_battery.c | 2 +- drivers/spi/spi-microchip-core-qspi.c | 12 +- drivers/spi/spi-rockchip.c | 4 +- drivers/spi/spi-s3c64xx.c | 5 - drivers/spi/spi-sun4i.c | 10 +- drivers/spi/spi-sun6i.c | 8 +- drivers/spi/spi-synquacer.c | 8 +- drivers/spi/spi-ti-qspi.c | 14 +- drivers/spi/spi-topcliff-pch.c | 11 +- drivers/spi/spi-zynqmp-gqspi.c | 4 +- drivers/staging/vme_user/vme_fake.c | 2 + drivers/target/target_core_configfs.c | 2 +- drivers/thermal/sprd_thermal.c | 4 +- drivers/thermal/thermal_core.c | 6 +- drivers/usb/class/usblp.c | 3 +- drivers/usb/common/ulpi.c | 5 +- drivers/usb/gadget/udc/omap_udc.c | 4 - drivers/usb/serial/option.c | 4 + drivers/video/fbdev/core/fb_defio.c | 179 ++++++++++++++++----- drivers/video/fbdev/udlfb.c | 31 +++- fs/btrfs/space-info.c | 2 +- fs/erofs/compress.h | 2 +- fs/erofs/decompressor.c | 163 +++++++++---------- fs/erofs/decompressor_deflate.c | 8 +- fs/erofs/decompressor_lzma.c | 8 +- fs/erofs/decompressor_zstd.c | 8 +- fs/erofs/zdata.c | 2 + fs/f2fs/data.c | 28 +++- fs/f2fs/extent_cache.c | 17 +- fs/f2fs/inode.c | 2 +- fs/f2fs/sysfs.c | 10 +- fs/file_table.c | 22 ++- fs/hfsplus/bfind.c | 51 ++++++ fs/hfsplus/catalog.c | 4 +- fs/hfsplus/dir.c | 2 +- fs/hfsplus/hfsplus_fs.h | 9 ++ fs/hfsplus/super.c | 6 +- fs/isofs/export.c | 2 +- fs/isofs/rock.c | 9 ++ fs/notify/fsnotify.c | 2 +- fs/notify/mark.c | 18 ++- fs/smb/client/cached_dir.c | 8 + fs/smb/client/cifsacl.c | 37 ++++- fs/smb/client/smb2inode.c | 12 +- fs/smb/client/smb2misc.c | 3 +- fs/smb/client/smb2ops.c | 11 ++ fs/smb/server/connection.c | 48 ++++-- fs/smb/server/connection.h | 1 + fs/tracefs/event_inode.c | 14 ++ fs/tracefs/inode.c | 5 +- fs/tracefs/internal.h | 3 + fs/udf/misc.c | 8 +- fs/udf/super.c | 4 +- include/linux/dma-mapping.h | 17 +- include/linux/fb.h | 4 +- include/linux/fsnotify_backend.h | 1 + include/linux/mm.h | 12 +- include/linux/mm_types.h | 7 +- include/linux/mmap_lock.h | 101 +++++++----- include/linux/mmc/card.h | 1 + include/linux/printk.h | 13 ++ include/trace/events/rxrpc.h | 1 + include/video/udlfb.h | 1 + kernel/bpf/arena.c | 19 ++- kernel/exit.c | 1 + kernel/fork.c | 5 +- kernel/tracepoint.c | 2 + lib/crypto/mpi/mpicoder.c | 2 +- lib/scatterlist.c | 8 +- mm/damon/sysfs-schemes.c | 12 +- mm/init-mm.c | 2 +- net/bluetooth/hci_event.c | 29 +++- net/bluetooth/l2cap_core.c | 8 +- net/bluetooth/l2cap_sock.c | 6 + net/ceph/auth.c | 2 +- net/ceph/mon_client.c | 2 + net/core/flow_dissector.c | 13 +- net/core/rtnetlink.c | 1 + net/ipv4/ah4.c | 14 +- net/ipv6/ah6.c | 14 +- net/ipv6/ip6_gre.c | 5 +- net/ipv6/xfrm6_protocol.c | 4 +- net/key/af_key.c | 52 +++--- net/mac80211/mlme.c | 9 +- net/mac80211/rx.c | 2 +- net/mac80211/util.c | 4 +- net/mptcp/protocol.c | 3 +- net/mptcp/sockopt.c | 12 +- net/mptcp/subflow.c | 4 +- net/openvswitch/vport-netdev.c | 6 +- net/rds/message.c | 20 ++- net/rxrpc/call_event.c | 4 +- net/rxrpc/conn_event.c | 30 +++- net/sched/sch_red.c | 2 +- net/unix/af_unix.c | 3 + net/vmw_vsock/hyperv_transport.c | 4 +- net/xfrm/xfrm_state.c | 12 +- net/xfrm/xfrm_user.c | 1 + security/selinux/hooks.c | 3 +- security/selinux/selinuxfs.c | 54 ++----- sound/core/oss/pcm_oss.c | 29 +++- sound/drivers/aloop.c | 44 +++-- sound/firewire/tascam/tascam-hwdep.c | 1 + sound/soc/amd/yc/acp6x-mach.c | 14 ++ sound/soc/fsl/fsl_easrc.c | 2 +- sound/soc/intel/boards/bytcr_wm5102.c | 1 + sound/soc/qcom/qdsp6/q6apm-dai.c | 1 + sound/soc/qcom/qdsp6/q6apm-lpass-dais.c | 2 +- sound/soc/qcom/qdsp6/q6apm.c | 3 + sound/soc/sof/compress.c | 3 + sound/usb/midi2.c | 9 +- sound/usb/misc/ua101.c | 7 + sound/usb/stream.c | 4 +- tools/arch/x86/include/asm/msr-index.h | 3 +- tools/testing/selftests/net/mptcp/mptcp_lib.sh | 16 +- tools/testing/selftests/net/mptcp/pm_netlink.sh | 20 ++- tools/testing/vma/vma.c | 4 +- tools/testing/vma/vma_internal.h | 4 +- 220 files changed, 1766 insertions(+), 684 deletions(-)

5 days, 8 hours

8
7
0 0

[PATCH 7.0 000/305] 7.0.7-rc2 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 7.0.7 release. There are 305 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Fri, 15 May 2026 15:37:27 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.0.7-rc2.… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.0.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 7.0.7-rc2 Prathyushi Nangia <prathyushi.nangia(a)amd.com> x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache Gary Guo <gary(a)garyguo.net> rust: pin-init: fix incorrect accessor reference lifetime Sam Edwards <cfsworks(a)gmail.com> net: stmmac: Prevent NULL deref when RX memory exhausted Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY() Thorsten Blum <thorsten.blum(a)linux.dev> crypto: caam - guard HMAC key hex dumps in hash_digest_key Thorsten Blum <thorsten.blum(a)linux.dev> printk: add print_hex_dump_devel() Longxuan Yu <ylong030(a)ucr.edu> 8021q: delete cleared egress QoS mappings Longxuan Yu <ylong030(a)ucr.edu> 8021q: use RCU for egress QoS mappings Zilin Guan <zilin(a)seu.edu.cn> hfsplus: fix held lock freed on hfsplus_fill_super() Deepanshu Kartikey <kartikey406(a)gmail.com> hfsplus: fix uninit-value by validating catalog record size Suman Kumar Chakraborty <suman.kumar.chakraborty(a)intel.com> crypto: qat - fix firmware loading failure for GEN6 devices Suman Kumar Chakraborty <suman.kumar.chakraborty(a)intel.com> crypto: qat - fix indentation of macros in qat_hal.c Luke Wang <ziniu.wang_1(a)nxp.com> mmc: core: Optimize time for secure erase/trim for some Kingston eMMCs Avri Altman <avri.altman(a)sandisk.com> mmc: core: Add quirk for incorrect manufacturing date Avri Altman <avri.altman(a)sandisk.com> mmc: core: Adjust MDT beyond 2025 David Carlier <devnexen(a)gmail.com> octeon_ep_vf: add NULL check for napi_build_skb() Alexei Starovoitov <ast(a)kernel.org> bpf: Fix use-after-free in arena_vm_close on fork Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Use per-root-bridge PCIH flag to skip mem resource fixup Tao Cui <cuitao(a)kylinos.cn> LoongArch: KVM: Use kvm_set_pte() in kvm_flush_pte() Bibo Mao <maobibo(a)loongson.cn> LoongArch: KVM: Move unconditional delay into timer clear scenery Bibo Mao <maobibo(a)loongson.cn> LoongArch: KVM: Fix HW timer interrupt lost when inject interrupt by software Xianglai Li <lixianglai(a)loongson.cn> LoongArch: KVM: Fix "unreliable stack" for kvm_exc_entry Qiang Ma <maqianga(a)uniontech.com> LoongArch: KVM: Cap KVM_CAP_NR_VCPUS by KVM_CAP_MAX_VCPUS Wentao Guan <guanwentao(a)uniontech.com> LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang() Fuad Tabba <tabba(a)google.com> KVM: arm64: Fix pin leak and publication ordering in __pkvm_init_vcpu() Fuad Tabba <tabba(a)google.com> KVM: arm64: Fix FEAT_Debugv8p9 to check DebugVer, not PMUVer Fuad Tabba <tabba(a)google.com> KVM: arm64: Fix FEAT_SPE_FnE to use PMSIDR_EL1.FnE, not PMSVer Quentin Perret <qperret(a)google.com> KVM: arm64: Fix initialisation order in __pkvm_init_finalise() David Woodhouse <dwmw(a)amazon.co.uk> KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value Marc Zyngier <maz(a)kernel.org> KVM: arm64: Wake-up from WFI when iqrchip is in userspace Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix fsck inconsistency caused by FGGC of node block Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix inline data not being written to disk in writeback path Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: refactor f2fs_move_node_folio function Guangshuo Li <lgs201920130244(a)gmail.com> f2fs: fix uninitialized kobject put in f2fs_init_sysfs() Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix node_cnt race between extent node destroy and writeback Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix incorrect multidevice info in trace_f2fs_map_blocks() Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix incorrect file address mapping when inline inode is unwritten Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix fsck inconsistency caused by incorrect nat_entry flag usage Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix fiemap boundary handling when read extent cache is incomplete Chao Yu <chao(a)kernel.org> f2fs: fix false alarm of lockdep on cp_global_sem lock Cen Zhang <zzzccc427(a)gmail.com> f2fs: add READ_ONCE() for i_blocks in f2fs_update_inode() Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: return early if no retrans Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: free sk if last Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: always decrease sk refcount Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: fix potential data-race Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: allow ID 0 Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: kernel: correctly retransmit ADD_ADDR ID 0 Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: kernel: reset fullmesh counter after flush Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: prio: skip closed subflows Gang Yan <yangang(a)kylinos.cn> mptcp: fix scheduling with atomic in timestamp sockopt Paolo Abeni <pabeni(a)redhat.com> mptcp: fix rx timestamp corruption on fastopen Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: sockopt: increase seq in mptcp_setsockopt_all_sf Gang Yan <yangang(a)kylinos.cn> mptcp: sockopt: set timestamp flags on subflow socket, not msk Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: fastclose msk when linger time is 0 Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: mptcp: pm: restrict 'unknown' check to pm_nl_ctl Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: mptcp: check output: catch cmd errors Tejun Heo <tj(a)kernel.org> sched_ext: Use dsq->first_task instead of list_empty() in dispatch_enqueue() FIFO-tail David Carlier <devnexen(a)gmail.com> sched_ext: idle: Recheck prev_cpu after narrowing allowed mask Chen Ni <nichen(a)iscas.ac.cn> remoteproc: k3: Fix NULL vs IS_ERR() bug in k3_reserved_mem_init() Chen Ni <nichen(a)iscas.ac.cn> remoteproc: imx_rproc: Fix NULL vs IS_ERR() bug in imx_rproc_addr_init() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/rxe: Reject unknown opcodes before ICRC processing Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() Junrui Luo <moonafterrain(a)outlook.com> RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Validate rx_hash_key_len Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/ionic: Fix typo in format string Kai Zen <kai.aizen.dev(a)gmail.com> RDMA/ionic: bound node_desc sysfs read with %.64s Dapeng Mi <dapeng1.mi(a)linux.intel.com> perf/x86/intel: Enable auto counter reload for DMR Dapeng Mi <dapeng1.mi(a)linux.intel.com> perf/x86/intel: Disable PMI for self-reloaded ACR events Dapeng Mi <dapeng1.mi(a)linux.intel.com> perf/x86/intel: Always reprogram ACR events to prevent stale masks Nilay Shroff <nilay(a)linux.ibm.com> powerpc/xive: fix kmemleak caused by incorrect chip_data lookup André Draszik <andre.draszik(a)linaro.org> power: supply: max17042: avoid overflow when determining health Lukas Wunner <lukas(a)wunner.de> PCI/ASPM: Fix pci_clear_and_set_config_dword() usage Lukas Wunner <lukas(a)wunner.de> PCI/AER: Stop ruling out unbound devices as error source Shuai Xue <xueshuai(a)linux.alibaba.com> PCI/AER: Clear only error bits in PCIe Device Status Lukas Wunner <lukas(a)wunner.de> PCI: Update saved_config_space upon resource assignment SeongJae Park <sj(a)kernel.org> mm/damon/sysfs-schemes: protect path kfree() with damon_sysfs_lock SeongJae Park <sj(a)kernel.org> mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock SeongJae Park <sj(a)kernel.org> mm/damon/stat: detect and use fresh enabled value SeongJae Park <sj(a)kernel.org> mm/damon/reclaim: detect and use fresh enabled and kdamond_pid values SeongJae Park <sj(a)kernel.org> mm/damon/lru_sort: detect and use fresh enabled and kdamond_pid values Paolo Bonzini <pbonzini(a)redhat.com> KVM: x86: Do IRR scan in __kvm_apic_update_irr even if PIR is empty Paolo Bonzini <pbonzini(a)redhat.com> KVM: x86: check for nEPT/nNPT in slow flush hypercalls Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: validate dacloffset before building DACL pointers Bjoern Doebel <doebel(a)amazon.de> smb: client: use kzalloc to zero-initialize security descriptor buffer Zisen Ye <zisenye(a)stu.xidian.edu.cn> smb/client: fix out-of-bounds read in symlink_data() Zisen Ye <zisenye(a)stu.xidian.edu.cn> smb/client: fix out-of-bounds read in smb2_compound_op() Ranjan Kumar <ranjan.kumar(a)broadcom.com> scsi: mpt3sas: Limit NVMe request size to 2 MiB Pengpeng Hou <pengpeng(a)iscas.ac.cn> s390/debug: Reject zero-length input before trimming a newline Vasily Gorbik <gor(a)linux.ibm.com> s390/debug: Reject zero-length input in debug_input_flush_fn() Osama Abdelkader <osama.abdelkader(a)gmail.com> riscv: kvm: fix vector context allocation leak Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/hns: Fix unlocked call to hns_roce_qp_remove() David Carlier <devnexen(a)gmail.com> psp: strip variable-length PSP header in psp_dev_rcv() Ulf Hansson <ulfh(a)kernel.org> pmdomain: core: Fix detach procedure for virtual devices in genpd Ilya Maximets <i.maximets(a)ovn.org> openvswitch: vport: fix self-deadlock on release of tunnel ports Chaitanya Kulkarni <kch(a)nvidia.com> nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free Chaitanya Kulkarni <kch(a)nvidia.com> nvmet-tcp: fix race between ICReq handling and queue teardown Fedor Pchelkin <pchelkin(a)ispras.ru> nvme-apple: drop invalid put of admin queue reference count Junrui Luo <moonafterrain(a)outlook.com> md/raid10: fix divide-by-zero in setup_geo() with zero far_copies Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Fix slab-out-of-bounds access in auth message processing Christian A. Ehrhardt <lk(a)c--e.de> lib/scatterlist: fix temp buffer in extract_user_to_sg() Christian A. Ehrhardt <lk(a)c--e.de> lib/scatterlist: fix length calculations in extract_kvec_to_sg Eric Biggers <ebiggers(a)kernel.org> lib/crc: tests: Make crc_kunit test only the enabled CRC variants Lukas Wunner <lukas(a)wunner.de> lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() Nicolin Chen <nicolinc(a)nvidia.com> iommu/arm-smmu-v3: Add a missing dma_wmb() for hitless STE update Zhenzhong Duan <zhenzhong.duan(a)intel.com> iommu/vt-d: Block PASID attachment to nested domain with dirty tracking Zhenzhong Duan <zhenzhong.duan(a)intel.com> iommufd: Fix return value of iommufd_fault_fops_write() Michael Bommarito <michael.bommarito(a)gmail.com> isofs: validate block number from NFS file handle in isofs_export_iget Michael Bommarito <michael.bommarito(a)gmail.com> isofs: validate Rock Ridge CE continuation extent against volume size Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: fix the size of dm_verity_fec_io::erasures Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: fix reading parity bytes split across blocks (take 3) Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: fix corrected block count stat Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: correctly reject too-small hash devices Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: correctly reject too-small FEC devices David Carlier <devnexen(a)gmail.com> eventfs: Hold eventfs_mutex and SRCU when remount walks events Mikulas Patocka <mpatocka(a)redhat.com> dm: fix a buffer overflow in ioctl processing Mikulas Patocka <mpatocka(a)redhat.com> dm: don't report warning when doing deferred remove Mikulas Patocka <mpatocka(a)redhat.com> dm-thin: fix metadata refcount underflow Filipe Manana <fdmanana(a)suse.com> btrfs: fix missing last_unlink_trans update when removing a directory Guangshuo Li <lgs201920130244(a)gmail.com> btrfs: fix double free in create_space_info_sub_group() error path Guangshuo Li <lgs201920130244(a)gmail.com> btrfs: fix double free in create_space_info() error path Yochai Eisenrich <yochaie(a)sweet.security> btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak Qu Wenruo <wqu(a)suse.com> btrfs: do not mark inode incompressible after inline attempt fails Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm: remove child devices when apm is removed Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error Joseph Salisbury <joseph.salisbury(a)oracle.com> ASoC: fsl_easrc: fix comment typo Li Jian <lazycat-xiao(a)foxmail.com> ASoC: ES8389: convert to devm_clk_get_optional() to get clock Tommaso Soncin <soncintommaso(a)gmail.com> ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table Shrikanth Hegde <sshegde(a)linux.ibm.com> cpuidle: powerpc: avoid double clear when breaking snooze Conor Dooley <conor.dooley(a)microchip.com> clk: microchip: mpfs-ccc: fix out of bounds access during output registration Stefan Eichenberger <stefan.eichenberger(a)toradex.com> clk: imx: imx8-acm: fix flags for acm clocks Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/fprobe: Check the same type fprobe on table as the unregistered one Steven Rostedt <rostedt(a)goodmis.org> tracing/probes: Limit size of event probe to 3K Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/fprobe: Unregister fprobe even if memory allocation fails Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/fprobe: Remove fprobe from hash in failure path Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/fprobe: Avoid kcalloc() in rcu_read_lock section Johan Hovold <johan(a)kernel.org> spi: topcliff-pch: fix use-after-free on unbind Johan Hovold <johan(a)kernel.org> spi: topcliff-pch: fix controller deregistration Thorsten Blum <thorsten.blum(a)linux.dev> thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp Thorsten Blum <thorsten.blum(a)linux.dev> thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> thermal: core: Free thermal zone ID later during removal David Gow <david(a)davidgow.net> x86/boot/e820: Re-enable BIOS fallback if e820 table is empty Michael Bommarito <michael.bommarito(a)gmail.com> udf: reject descriptors with oversized CRC length David Carlier <devnexen(a)gmail.com> tracefs: Fix default permissions not being applied on initial mount Conor Dooley <conor.dooley(a)microchip.com> spi: microchip-core-qspi: control built-in cs manually Conor Dooley <conor.dooley(a)microchip.com> spi: microchip-core-qspi: don't attempt to transmit during emulated read-only dual/quad operations Johan Hovold <johan(a)kernel.org> spi: microchip-core-spi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: microchip-core-qspi: fix controller deregistration Guangshuo Li <lgs201920130244(a)gmail.com> ice: fix double free in ice_sf_eth_activate() error path Mingming Cao <mmc(a)linux.ibm.com> ibmveth: Disable GSO for packets with small MSS Dexuan Cui <decui(a)microsoft.com> hv_sock: Return -EIO for malformed/short packets Dexuan Cui <decui(a)microsoft.com> hv_sock: Report EOF instead of -EIO for FIN Hamza Mahfooz <hamzamahfooz(a)linux.microsoft.com> hv_sock: fix ARM64 support Thomas Zimmermann <tzimmermann(a)suse.de> hv: Select CONFIG_SYSFB only for CONFIG_HYPERV_VMBUS Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> gpio: of: clear OF_POPULATED on hog nodes in remove path Thomas Zimmermann <tzimmermann(a)suse.de> fbcon: Avoid OOB font access if console rotation fails Xu Yang <xu.yang_2(a)nxp.com> extcon: ptn5150: handle pending IRQ events during system resume Shyam Prasad N <sprasad(a)microsoft.com> cifs: change_conf needs to be called for session setup Shyam Prasad N <sprasad(a)microsoft.com> cifs: abort open_cached_dir if we don't request leases Jens Axboe <axboe(a)kernel.dk> block: only read from sqe on initial invocation of blkdev_uring_cmd() Damien Le Moal <dlemoal(a)kernel.org> block: fix zone write plug removal Naman Jain <namjain(a)linux.microsoft.com> block: add pgmap check to biovec_phys_mergeable Wentao Liang <vulab(a)iscas.ac.cn> pmdomain: mediatek: fix use-after-free in scpsys_get_bus_protection_legacy() Breno Leitao <leitao(a)debian.org> arm64/fpsimd: ptrace: zero target's fpsimd_state, not the tracer's Jiexun Wang <wangjiexun2025(a)gmail.com> af_unix: Reject SIOCATMARK on non-stream sockets Myeonghun Pak <mhun512(a)gmail.com> hwmon: (corsair-psu) Close HID device on probe errors Johan Hovold <johan(a)kernel.org> clk: rk808: fix OF node reference imbalance Sanman Pradhan <psanman(a)juniper.net> hwmon: (ltc2992) Fix u32 overflow in power read path Sanman Pradhan <psanman(a)juniper.net> hwmon: (ltc2992) Clamp threshold writes to hardware range Ivan Hu <ivan.hu(a)canonical.com> x86/efi: Fix graceful fault handling after FPU softirq changes Hongling Zeng <zenghongling(a)kylinos.cn> parisc: Fix IRQ leak in LASI driver Tzung-Bi Shih <tzungbi(a)kernel.org> platform/chrome: cros_ec_typec: Init mutex in Thunderbolt registration Colin Walters <walters(a)verbum.org> ovl: fix verity lazy-load guard broken by fsverity_active() semantic change Pavitra Jha <jhapavitra98(a)gmail.com> net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler Nan Li <tonanli66(a)gmail.com> net/rds: handle zerocopy send cleanup before the message is queued Breno Leitao <leitao(a)debian.org> netpoll: pass buffer size to egress_dev() to avoid MAC truncation Jiawen Wu <jiawenwu(a)trustnetic.com> net: libwx: use request_irq for VF misc interrupt Maoyi Xie <maoyixie.tju(a)gmail.com> ip6_gre: Use cached t->net in ip6erspan_changelink(). Jiawen Wu <jiawenwu(a)trustnetic.com> net: libwx: fix VF illegal register access Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> pseries/papr-hvpipe: Fix the usage of copy_to_user() Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> pseries/papr-hvpipe: Fix & simplify error handling in papr_hvpipe_init() Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> pseries/papr-hvpipe: Fix null ptr deref in papr_hvpipe_dev_create_handle() Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> pseries/papr-hvpipe: Prevent kernel stack memory leak to userspace Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> pseries/papr-hvpipe: Fix race with interrupt handler SeungJu Cheon <suunj1331(a)gmail.com> sound: ua101: fix division by zero at probe Karol Wachowski <karol.wachowski(a)linux.intel.com> accel/ivpu: Disallow re-exporting imported GEM objects Thomas Gleixner <tglx(a)kernel.org> selftests/rseq: Expand for optimized RSEQ ABI v2 Thomas Gleixner <tglx(a)kernel.org> selftests/rseq: Validate legacy behavior Thomas Gleixner <tglx(a)kernel.org> selftests/rseq: Skip tests if time slice extensions are not available Thomas Gleixner <tglx(a)kernel.org> selftests/rseq: Make registration flexible for legacy and optimized mode Thomas Gleixner <tglx(a)kernel.org> rseq: Don't advertise time slice extensions if disabled Thomas Gleixner <tglx(a)kernel.org> rseq: Protect rseq_reset() against interrupts Thomas Gleixner <tglx(a)kernel.org> rseq: Set rseq::cpu_id_start to 0 on unregistration Mark Brown <broonie(a)kernel.org> selftests/rseq: Don't run tests with runner scripts outside of the scripts Dapeng Mi <dapeng1.mi(a)linux.intel.com> perf/x86/intel: Improve validation and configuration of ACR masks Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: skip inactive subflows Kai Zen <kai.aizen.dev(a)gmail.com> net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo Xianglai Li <lixianglai(a)loongson.cn> LoongArch: KVM: Compile switch.S directly into the kernel Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Fix SYM_SIGFUNC_START definition for 32BIT Sang-Heon Jeon <ekffu200098(a)gmail.com> mm/hugetlb_cma: round up per_node before logging it Kevin Brodsky <kevin.brodsky(a)arm.com> arm64: signal: Preserve POR_EL0 if poe_context is missing Tudor Ambarus <tudor.ambarus(a)linaro.org> mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show() Fuad Tabba <tabba(a)google.com> KVM: arm64: Fix kvm_vcpu_initialized() macro parameter Miklos Szeredi <mszeredi(a)redhat.com> fanotify: fix false positive on permission events Johan Hovold <johan(a)kernel.org> staging: vme_user: fix root device leak on init failure Shyam Sunder Reddy Padira <shyamsunderreddypadira(a)gmail.com> staging: rtl8723bs: os_dep: avoid NULL pointer dereference in rtw_cbuf_alloc Johan Hovold <johan(a)kernel.org> spi: s3c64xx: fix NULL-deref on driver unbind Johan Hovold <johan(a)kernel.org> spi: tegra20-sflash: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: zynqmp-gqspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: tegra114: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sun6i: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: ti-qspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: zynq-qspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sun4i: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: syncuacer: fix controller deregistration Gary Guo <gary(a)garyguo.net> rust: pin-init: internal: move alignment check to `make_field_check` Miguel Ojeda <ojeda(a)kernel.org> rust: allow `clippy::collapsible_if` globally Miguel Ojeda <ojeda(a)kernel.org> rust: allow `clippy::collapsible_match` globally Eliot Courtney <ecourtney(a)nvidia.com> rust: drm: gem: clean up GEM state in init failure case Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt David Carlier <devnexen(a)gmail.com> Bluetooth: hci_conn: fix potential UAF in create_big_sync Tristan Madani <tristan(a)talencesecurity.com> Bluetooth: btmtk: validate WMT event SKB length before struct access Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: virtio_bt: validate rx pkt_type header length Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: virtio_bt: clamp rx length before skb_put Tao Cui <cuitao(a)kylinos.cn> LoongArch: KVM: Fix missing EMULATE_FAIL in kvm_emu_mmio_read() Jens Axboe <axboe(a)kernel.dk> io_uring/tw: serialize ctx->retry_llist with ->uring_lock Martin Michaelis <code(a)mgjm.de> io_uring/kbuf: support min length left for incremental buffers Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: allow multiple opens of /sys/fs/selinux/policy Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: prune /sys/fs/selinux/user Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: prune /sys/fs/selinux/disable Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: prune /sys/fs/selinux/checkreqprot Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: shrink critical section in sel_write_load() David Windsor <dwindsor(a)gmail.com> selinux: don't reserve xattr slot when we won't fill it Zongyao Chen <ZongYao.Chen(a)linux.alibaba.com> selinux: use sk blob accessor in socket permission helpers Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: fix avdcache auditing Michael Bommarito <michael.bommarito(a)gmail.com> xfrm: ah: account for ESN high bits in async callbacks Yilin Zhu <zylzyl2333(a)gmail.com> ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() Michal Kosiorek <mkosiorek121(a)gmail.com> xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete Ruijie Li <ruijieli51(a)gmail.com> xfrm: provide message size for XFRM_MSG_MAPPING Tejun Heo <tj(a)kernel.org> sched_ext: Read scx_root under scx_cgroup_ops_rwsem in cgroup setters Ard Biesheuvel <ardb(a)kernel.org> x86/efi: Restore IRQ state in EFI page fault handler Sourabh Jain <sourabhjain(a)linux.ibm.com> powerpc/kdump: fix KASAN sanitization flag for core_$(BITS).o Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: seq: Fix UMP group 16 filtering Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: core: Serialize deferred fasync state checks Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: firewire-tascam: Do not drop unread control events Yuriy Padlyak <yuriypadlyak(a)gmail.com> ALSA: hda/realtek: Fix speaker silence after S3 resume on Xiaomi Mi Laptop Pro 15 Takashi Iwai <tiwai(a)suse.de> ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: hda: cs35l56: Propagate ASP TX source control errors Xu Yang <xu.yang_2(a)nxp.com> usb: typec: tcpm: fix debug accessory mode detection for sink ports Felix Gu <ustc.gu(a)gmail.com> usb: ulpi: fix memory leak on ulpi_register() error paths Fabio Porcedda <fabio.porcedda(a)gmail.com> USB: serial: option: add Telit Cinterion LE910Cx compositions Aaro Koskinen <aaro.koskinen(a)iki.fi> USB: omap_udc: DMA: Don't enable burst 4 mode Selvarasu Ganesan <selvarasu.g(a)samsung.com> usb: dwc3: Move GUID programming after PHY initialization Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Fix UAC3 cluster descriptor size check Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: midi2: Restart output URBs on resume Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: usblp: fix heap leak in IEEE 1284 device ID via short response Marek Szyprowski <m.szyprowski(a)samsung.com> wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task Tristan Madani <tristan(a)talencesecurity.com> wifi: b43: enforce bounds check on firmware key index in b43_rx() Johannes Berg <johannes.berg(a)intel.com> wifi: mac80211: remove station if connection prep fails Jiri Slaby (SUSE) <jirislaby(a)kernel.org> wifi: ath5k: do not access array OOB Benjamin Berg <benjamin.berg(a)intel.com> wifi: mac80211: use safe list iteration in radar detect work Jeongjun Park <aha310510(a)gmail.com> wifi: rsi: fix kthread lifetime race between self-exit and external-stop Catherine <enderaoelyther(a)gmail.com> wifi: mac80211: drop stray 'static' from fast-RX rx_result Tristan Madani <tristan(a)talencesecurity.com> wifi: b43legacy: enforce bounds check on firmware key index in RX path Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work Leon Yen <leon.yen(a)mediatek.com> wifi: mt76: mt7921: fix a potential clc buffer length underflow Ming Yen Hsieh <mingyen.hsieh(a)mediatek.com> wifi: mt76: mt7925: fix incorrect length field in txpower command Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7925: fix AMPDU state handling in mt7925_tx_check_aggr Jann Horn <jannh(a)google.com> exit: prevent preemption of oopsing TASK_DEAD task Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked Yi Kuo <yi(a)yikuo.dev> smb: client/smbdirect: fix MR registration for coalesced SG lists Qingfang Deng <qingfang.deng(a)linux.dev> flow_dissector: do not dissect PPPoE PFC frames Sean Christopherson <seanjc(a)google.com> KVM: x86: Fix shadow paging use-after-free due to unexpected GFN DaeMyung Kang <charsyam(a)gmail.com> ksmbd: rewrite stop_sessions() with restartable iteration Johan Hovold <johan(a)kernel.org> spi: rockchip: fix controller deregistration Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7925: fix incorrect TLV length in CLC command Mark Brown <broonie(a)kernel.org> ASoC: SOF: Don't allow pointer operations on unconfigured streams Sina Hassani <sina(a)openai.com> iommufd: Fix a race with concurrent allocation and unmap David Carlier <devnexen(a)gmail.com> tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() Shivam Kalra <shivamkalra98(a)zohomail.in> ACPI: video: force native backlight on HP OMEN 16 (8A44) Jinjie Ruan <ruanjinjie(a)huawei.com> ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug Jan Schär <jan(a)jschaer.ch> ACPI: video: Add backlight=native quirk for Dell OptiPlex 7770 AIO Guangshuo Li <lgs201920130244(a)gmail.com> ACPI: scan: Use acpi_dev_put() in object add error paths Breno Leitao <leitao(a)debian.org> ACPI: arm64: cpuidle: Tolerate platforms with no deep PSCI idle states Rajat Gupta <rajgupt(a)qti.qualcomm.com> fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free Corey Minyard <corey(a)minyard.net> ipmi:si: Return state to normal if message allocation fails Corey Minyard <corey(a)minyard.net> ipmi: Check event message buffer response for bad data Corey Minyard <corey(a)minyard.net> ipmi: Add limits to event and receive message requests Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() ------------- Diffstat: .../ABI/{obsolete => removed}/sysfs-selinux-user | 0 Makefile | 6 +- arch/arm64/include/asm/kvm_host.h | 2 +- arch/arm64/kernel/ptrace.c | 4 +- arch/arm64/kernel/signal.c | 54 +++- arch/arm64/kvm/arm.c | 4 + arch/arm64/kvm/config.c | 17 +- arch/arm64/kvm/hyp/nvhe/pkvm.c | 38 ++- arch/arm64/kvm/hyp/nvhe/setup.c | 8 +- arch/arm64/kvm/vgic/vgic-mmio-v2.c | 2 +- arch/arm64/kvm/vgic/vgic-mmio-v3.c | 2 +- arch/loongarch/Kbuild | 2 +- arch/loongarch/include/asm/asm-prototypes.h | 20 ++ arch/loongarch/include/asm/kvm_host.h | 3 - arch/loongarch/include/asm/linkage.h | 2 +- arch/loongarch/kvm/Makefile | 3 +- arch/loongarch/kvm/exit.c | 1 + arch/loongarch/kvm/interrupt.c | 14 ++ arch/loongarch/kvm/main.c | 35 +-- arch/loongarch/kvm/mmu.c | 2 +- arch/loongarch/kvm/switch.S | 22 +- arch/loongarch/kvm/timer.c | 10 +- arch/loongarch/kvm/vm.c | 2 +- arch/loongarch/pci/acpi.c | 5 + arch/loongarch/pci/pci.c | 3 + arch/powerpc/kexec/Makefile | 2 +- arch/powerpc/platforms/pseries/papr-hvpipe.c | 122 +++++---- arch/powerpc/sysdev/xive/common.c | 16 +- arch/riscv/kvm/vcpu_vector.c | 5 +- arch/s390/kernel/debug.c | 8 + arch/x86/events/core.c | 13 +- arch/x86/events/intel/core.c | 50 +++- arch/x86/events/perf_event.h | 10 + arch/x86/include/asm/efi.h | 3 +- arch/x86/include/asm/msr-index.h | 3 +- arch/x86/kernel/cpu/amd.c | 3 + arch/x86/kernel/e820.c | 6 +- arch/x86/kvm/hyperv.c | 2 +- arch/x86/kvm/lapic.c | 8 +- arch/x86/kvm/mmu/mmu.c | 35 ++- arch/x86/mm/fault.c | 2 +- arch/x86/platform/efi/quirks.c | 13 +- block/blk-zoned.c | 151 +++++------ block/blk.h | 2 + block/ioctl.c | 24 +- drivers/accel/ivpu/ivpu_drv.c | 21 ++ drivers/acpi/arm64/cpuidle.c | 10 +- drivers/acpi/cppc_acpi.c | 6 +- drivers/acpi/power.c | 2 +- drivers/acpi/scan.c | 2 +- drivers/acpi/video_detect.c | 16 ++ drivers/android/binder/range_alloc/array.rs | 1 - drivers/bluetooth/btmtk.c | 15 +- drivers/bluetooth/virtio_bt.c | 39 ++- drivers/char/ipmi/ipmi_si_intf.c | 70 ++++-- drivers/char/ipmi/ipmi_ssif.c | 23 +- drivers/clk/clk-rk808.c | 2 +- drivers/clk/imx/clk-imx8-acm.c | 3 +- drivers/clk/microchip/clk-mpfs-ccc.c | 6 +- drivers/cpuidle/cpuidle-powernv.c | 5 +- drivers/cpuidle/cpuidle-pseries.c | 5 +- drivers/crypto/caam/caamalg_qi2.c | 4 +- drivers/crypto/caam/caamhash.c | 4 +- .../crypto/intel/qat/qat_common/adf_accel_engine.c | 7 + .../qat/qat_common/icp_qat_fw_loader_handle.h | 1 + drivers/crypto/intel/qat/qat_common/qat_hal.c | 27 +- drivers/extcon/extcon-ptn5150.c | 14 ++ drivers/gpio/gpiolib-of.c | 9 +- drivers/hv/Kconfig | 2 +- drivers/hwmon/corsair-psu.c | 4 +- drivers/hwmon/ltc2992.c | 41 ++- drivers/infiniband/hw/hns/hns_roce_qp.c | 7 + drivers/infiniband/hw/ionic/ionic_ibdev.c | 2 +- drivers/infiniband/hw/mana/cq.c | 5 +- drivers/infiniband/hw/mana/qp.c | 16 +- drivers/infiniband/hw/mlx4/srq.c | 4 +- drivers/infiniband/hw/mlx5/main.c | 1 + drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 4 +- drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c | 2 +- drivers/infiniband/sw/rxe/rxe_recv.c | 11 + drivers/infiniband/sw/rxe/rxe_resp.c | 14 +- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 7 + drivers/iommu/intel/nested.c | 6 +- drivers/iommu/iommufd/eventq.c | 5 +- drivers/iommu/iommufd/io_pagetable.c | 10 + drivers/md/dm-ioctl.c | 6 +- drivers/md/dm-verity-fec.c | 113 ++++----- drivers/md/dm-verity-fec.h | 3 +- drivers/md/persistent-data/dm-btree-remove.c | 8 + drivers/md/raid10.c | 2 + drivers/mmc/core/card.h | 11 + drivers/mmc/core/mmc.c | 12 + drivers/mmc/core/queue.c | 9 +- drivers/mmc/core/quirks.h | 12 + drivers/mtd/spi-nor/debugfs.c | 4 +- drivers/net/ethernet/ibm/ibmveth.c | 22 ++ drivers/net/ethernet/ibm/ibmveth.h | 1 + drivers/net/ethernet/intel/ice/ice_sf_eth.c | 2 + .../ethernet/marvell/octeon_ep_vf/octep_vf_rx.c | 36 ++- drivers/net/ethernet/mellanox/mlx4/srq.c | 13 +- drivers/net/ethernet/stmicro/stmmac/chain_mode.c | 2 +- drivers/net/ethernet/stmicro/stmmac/common.h | 2 +- drivers/net/ethernet/stmicro/stmmac/ring_mode.c | 2 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 41 +-- drivers/net/ethernet/wangxun/libwx/wx_hw.c | 7 +- drivers/net/ethernet/wangxun/libwx/wx_vf_common.c | 4 +- drivers/net/wireless/ath/ath5k/base.c | 3 +- drivers/net/wireless/broadcom/b43/xmit.c | 3 +- drivers/net/wireless/broadcom/b43legacy/xmit.c | 3 +- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 6 +- drivers/net/wireless/mediatek/mt76/mt7921/main.c | 7 +- drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | 3 + drivers/net/wireless/mediatek/mt76/mt7925/mac.c | 6 +- drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 4 +- drivers/net/wireless/rsi/rsi_common.h | 5 +- drivers/net/wwan/t7xx/t7xx_modem_ops.c | 20 +- drivers/net/wwan/t7xx/t7xx_port_ctrl_msg.c | 18 +- drivers/net/wwan/t7xx/t7xx_port_proxy.h | 2 +- drivers/nvme/host/apple.c | 6 +- drivers/nvme/target/core.c | 2 +- drivers/nvme/target/tcp.c | 26 ++ drivers/parisc/lasi.c | 12 +- drivers/pci/pci.c | 7 +- drivers/pci/pcie/aer.c | 2 - drivers/pci/pcie/aspm.c | 17 +- drivers/pci/setup-res.c | 2 + drivers/platform/chrome/cros_typec_altmode.c | 1 + drivers/pmdomain/core.c | 10 +- drivers/pmdomain/mediatek/mtk-pm-domains.c | 10 +- drivers/power/supply/max17042_battery.c | 2 +- drivers/remoteproc/imx_rproc.c | 2 +- drivers/remoteproc/ti_k3_common.c | 2 +- drivers/scsi/mpt3sas/mpt3sas_scsih.c | 14 +- drivers/spi/spi-microchip-core-qspi.c | 103 ++++++-- drivers/spi/spi-microchip-core-spi.c | 4 +- drivers/spi/spi-rockchip.c | 4 +- drivers/spi/spi-s3c64xx.c | 5 - drivers/spi/spi-sun4i.c | 10 +- drivers/spi/spi-sun6i.c | 8 +- drivers/spi/spi-synquacer.c | 8 +- drivers/spi/spi-tegra114.c | 8 +- drivers/spi/spi-tegra20-sflash.c | 8 +- drivers/spi/spi-ti-qspi.c | 14 +- drivers/spi/spi-topcliff-pch.c | 11 +- drivers/spi/spi-zynq-qspi.c | 15 +- drivers/spi/spi-zynqmp-gqspi.c | 4 +- drivers/staging/rtl8723bs/os_dep/osdep_service.c | 3 +- drivers/staging/vme_user/vme_fake.c | 2 + drivers/target/target_core_configfs.c | 2 +- drivers/thermal/sprd_thermal.c | 4 +- drivers/thermal/thermal_core.c | 6 +- drivers/usb/class/usblp.c | 3 +- drivers/usb/common/ulpi.c | 5 +- drivers/usb/dwc3/core.c | 12 +- drivers/usb/gadget/udc/omap_udc.c | 4 - drivers/usb/serial/option.c | 4 + drivers/usb/typec/tcpm/tcpm.c | 25 +- drivers/video/fbdev/core/fbcon_rotate.c | 5 +- drivers/video/fbdev/udlfb.c | 31 ++- fs/btrfs/inode.c | 8 + fs/btrfs/ioctl.c | 5 +- fs/btrfs/space-info.c | 6 +- fs/f2fs/data.c | 28 ++- fs/f2fs/extent_cache.c | 17 +- fs/f2fs/f2fs.h | 5 + fs/f2fs/inline.c | 22 +- fs/f2fs/inode.c | 2 +- fs/f2fs/node.c | 95 +++---- fs/f2fs/super.c | 11 + fs/f2fs/sysfs.c | 10 +- fs/hfsplus/bfind.c | 51 ++++ fs/hfsplus/catalog.c | 4 +- fs/hfsplus/dir.c | 2 +- fs/hfsplus/hfsplus_fs.h | 9 + fs/hfsplus/super.c | 6 +- fs/isofs/export.c | 2 +- fs/isofs/rock.c | 9 + fs/notify/fsnotify.c | 2 +- fs/notify/mark.c | 18 +- fs/overlayfs/util.c | 2 +- fs/smb/client/cached_dir.c | 8 + fs/smb/client/cifsacl.c | 37 ++- fs/smb/client/smb2inode.c | 12 +- fs/smb/client/smb2misc.c | 3 +- fs/smb/client/smb2ops.c | 11 + fs/smb/client/smbdirect.c | 21 +- fs/smb/server/connection.c | 48 +++- fs/smb/server/connection.h | 1 + fs/tracefs/event_inode.c | 14 ++ fs/tracefs/inode.c | 6 +- fs/tracefs/internal.h | 3 + fs/udf/misc.c | 8 +- include/linux/fsnotify_backend.h | 1 + include/linux/if_vlan.h | 25 +- include/linux/mmc/card.h | 2 + include/linux/printk.h | 13 + include/linux/rseq.h | 2 + include/uapi/linux/io_uring.h | 3 +- include/uapi/linux/rseq.h | 5 +- include/video/udlfb.h | 1 + io_uring/kbuf.c | 8 +- io_uring/kbuf.h | 7 + io_uring/tw.c | 12 +- kernel/bpf/arena.c | 19 +- kernel/exit.c | 1 + kernel/rseq.c | 29 ++- kernel/sched/ext.c | 19 +- kernel/sched/ext_idle.c | 12 +- kernel/trace/fprobe.c | 279 ++++++++++++--------- kernel/trace/trace_probe.c | 6 + kernel/trace/trace_probe.h | 4 +- kernel/tracepoint.c | 2 + lib/crc/Kconfig | 7 +- lib/crc/tests/crc_kunit.c | 28 ++- lib/crypto/mpi/mpicoder.c | 2 +- lib/scatterlist.c | 8 +- mm/damon/lru_sort.c | 85 ++++--- mm/damon/reclaim.c | 85 ++++--- mm/damon/stat.c | 30 ++- mm/damon/sysfs-schemes.c | 24 +- mm/hugetlb_cma.c | 1 + net/8021q/vlan_dev.c | 45 ++-- net/8021q/vlan_netlink.c | 10 +- net/8021q/vlanproc.c | 12 +- net/bluetooth/hci_conn.c | 19 +- net/bluetooth/hci_event.c | 29 ++- net/bluetooth/l2cap_sock.c | 9 + net/ceph/auth.c | 2 +- net/ceph/mon_client.c | 2 + net/core/flow_dissector.c | 13 +- net/core/netpoll.c | 23 +- net/core/rtnetlink.c | 1 + net/ipv4/ah4.c | 14 +- net/ipv6/ah6.c | 14 +- net/ipv6/ip6_gre.c | 5 +- net/ipv6/xfrm6_protocol.c | 4 +- net/mac80211/mlme.c | 9 +- net/mac80211/rx.c | 2 +- net/mac80211/util.c | 4 +- net/mptcp/fastopen.c | 4 +- net/mptcp/pm.c | 62 +++-- net/mptcp/pm_kernel.c | 14 +- net/mptcp/protocol.c | 3 +- net/mptcp/sockopt.c | 16 +- net/mptcp/subflow.c | 4 +- net/openvswitch/vport-netdev.c | 6 +- net/psp/psp_main.c | 42 +++- net/rds/message.c | 20 +- net/sched/sch_red.c | 2 +- net/unix/af_unix.c | 3 + net/vmw_vsock/hyperv_transport.c | 33 ++- net/xfrm/xfrm_state.c | 12 +- net/xfrm/xfrm_user.c | 1 + rust/kernel/drm/gem/mod.rs | 13 +- rust/pin-init/internal/src/init.rs | 184 +++++++------- rust/pin-init/src/__internal.rs | 28 ++- security/selinux/hooks.c | 38 ++- security/selinux/include/objsec.h | 4 +- security/selinux/include/security.h | 2 - security/selinux/selinuxfs.c | 196 +++------------ security/selinux/ss/services.c | 125 --------- sound/core/misc.c | 8 +- sound/core/oss/pcm_oss.c | 29 ++- sound/core/seq/seq_clientmgr.c | 2 +- sound/core/seq/seq_clientmgr.h | 5 +- sound/core/seq/seq_ump_client.c | 2 +- sound/firewire/tascam/tascam-hwdep.c | 1 + sound/hda/codecs/realtek/alc269.c | 19 ++ sound/hda/codecs/side-codecs/cs35l56_hda.c | 19 +- sound/soc/amd/yc/acp6x-mach.c | 14 ++ sound/soc/codecs/es8389.c | 2 +- sound/soc/fsl/fsl_easrc.c | 2 +- sound/soc/intel/boards/bytcr_wm5102.c | 1 + sound/soc/qcom/qdsp6/q6apm-dai.c | 1 + sound/soc/qcom/qdsp6/q6apm-lpass-dais.c | 2 +- sound/soc/qcom/qdsp6/q6apm.c | 3 + sound/soc/sof/compress.c | 3 + sound/usb/midi2.c | 9 +- sound/usb/misc/ua101.c | 7 + sound/usb/stream.c | 4 +- tools/arch/x86/include/asm/msr-index.h | 3 +- tools/testing/selftests/net/mptcp/mptcp_lib.sh | 16 +- tools/testing/selftests/net/mptcp/pm_netlink.sh | 20 +- tools/testing/selftests/rseq/Makefile | 21 +- tools/testing/selftests/rseq/check_optimized.c | 17 ++ tools/testing/selftests/rseq/legacy_check.c | 65 +++++ tools/testing/selftests/rseq/param_test.c | 25 +- tools/testing/selftests/rseq/rseq-abi.h | 7 +- tools/testing/selftests/rseq/rseq.c | 39 ++- tools/testing/selftests/rseq/rseq.h | 8 +- tools/testing/selftests/rseq/run_legacy_check.sh | 4 + tools/testing/selftests/rseq/run_param_test.sh | 39 +++ tools/testing/selftests/rseq/run_timeslice_test.sh | 14 ++ tools/testing/selftests/rseq/slice_test.c | 12 +- 294 files changed, 3030 insertions(+), 1615 deletions(-)

5 days, 8 hours

12
12
0 0

[PATCH 6.18 000/270] 6.18.30-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.18.30 release. There are 270 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 14 May 2026 17:38:03 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.30-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.18.30-rc1 Prathyushi Nangia <prathyushi.nangia(a)amd.com> x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache Gary Guo <gary(a)garyguo.net> rust: pin-init: fix incorrect accessor reference lifetime Sam Edwards <cfsworks(a)gmail.com> net: stmmac: Prevent NULL deref when RX memory exhausted Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY() Thorsten Blum <thorsten.blum(a)linux.dev> crypto: caam - guard HMAC key hex dumps in hash_digest_key Thorsten Blum <thorsten.blum(a)linux.dev> printk: add print_hex_dump_devel() Junrui Luo <moonafterrain(a)outlook.com> erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap() Gao Xiang <xiang(a)kernel.org> erofs: tidy up z_erofs_lz4_handle_overlap() Zilin Guan <zilin(a)seu.edu.cn> hfsplus: fix held lock freed on hfsplus_fill_super() Deepanshu Kartikey <kartikey406(a)gmail.com> hfsplus: fix uninit-value by validating catalog record size Krzysztof Kozlowski <krzysztof.kozlowski(a)oss.qualcomm.com> firmware: exynos-acpm: Drop fake 'const' on handle pointer Kairui Song <kasong(a)tencent.com> mm, swap: speed up hibernation allocation and writeout Suman Kumar Chakraborty <suman.kumar.chakraborty(a)intel.com> crypto: qat - fix firmware loading failure for GEN6 devices Suman Kumar Chakraborty <suman.kumar.chakraborty(a)intel.com> crypto: qat - fix indentation of macros in qat_hal.c Luke Wang <ziniu.wang_1(a)nxp.com> mmc: core: Optimize time for secure erase/trim for some Kingston eMMCs Avri Altman <avri.altman(a)sandisk.com> mmc: core: Add quirk for incorrect manufacturing date Avri Altman <avri.altman(a)sandisk.com> mmc: core: Adjust MDT beyond 2025 David Carlier <devnexen(a)gmail.com> octeon_ep_vf: add NULL check for napi_build_skb() Thomas Weißschuh <linux(a)weissschuh.net> hwmon: (powerz) Avoid cacheline sharing for DMA buffer Michael S. Tsirkin <mst(a)redhat.com> dma-mapping: add __dma_from_device_group_begin()/end() Thomas Zimmermann <tzimmermann(a)suse.de> fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info SeongJae Park <sj(a)kernel.org> mm/damon/core: disallow non-power of two min_region_sz on damon_start() Alexei Starovoitov <ast(a)kernel.org> bpf: Fix use-after-free in arena_vm_close on fork Jens Axboe <axboe(a)kernel.dk> io_uring/tw: serialize ctx->retry_llist with ->uring_lock Martin Michaelis <code(a)mgjm.de> io_uring/kbuf: support min length left for incremental buffers Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Use per-root-bridge PCIH flag to skip mem resource fixup Tao Cui <cuitao(a)kylinos.cn> LoongArch: KVM: Use kvm_set_pte() in kvm_flush_pte() Bibo Mao <maobibo(a)loongson.cn> LoongArch: KVM: Move unconditional delay into timer clear scenery Bibo Mao <maobibo(a)loongson.cn> LoongArch: KVM: Fix HW timer interrupt lost when inject interrupt by software Xianglai Li <lixianglai(a)loongson.cn> LoongArch: KVM: Fix "unreliable stack" for kvm_exc_entry Qiang Ma <maqianga(a)uniontech.com> LoongArch: KVM: Cap KVM_CAP_NR_VCPUS by KVM_CAP_MAX_VCPUS Wentao Guan <guanwentao(a)uniontech.com> LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang() Fuad Tabba <tabba(a)google.com> KVM: arm64: Fix pin leak and publication ordering in __pkvm_init_vcpu() Fuad Tabba <tabba(a)google.com> KVM: arm64: Fix FEAT_Debugv8p9 to check DebugVer, not PMUVer Fuad Tabba <tabba(a)google.com> KVM: arm64: Fix FEAT_SPE_FnE to use PMSIDR_EL1.FnE, not PMSVer Quentin Perret <qperret(a)google.com> KVM: arm64: Fix initialisation order in __pkvm_init_finalise() David Woodhouse <dwmw(a)amazon.co.uk> KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value Marc Zyngier <maz(a)kernel.org> KVM: arm64: Wake-up from WFI when iqrchip is in userspace Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix fsck inconsistency caused by FGGC of node block Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix inline data not being written to disk in writeback path Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: refactor f2fs_move_node_folio function Guangshuo Li <lgs201920130244(a)gmail.com> f2fs: fix uninitialized kobject put in f2fs_init_sysfs() Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix node_cnt race between extent node destroy and writeback Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix incorrect multidevice info in trace_f2fs_map_blocks() Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix incorrect file address mapping when inline inode is unwritten Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix fsck inconsistency caused by incorrect nat_entry flag usage Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix fiemap boundary handling when read extent cache is incomplete Cen Zhang <zzzccc427(a)gmail.com> f2fs: add READ_ONCE() for i_blocks in f2fs_update_inode() Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: return early if no retrans Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: free sk if last Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: always decrease sk refcount Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: fix potential data-race Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: allow ID 0 Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: kernel: correctly retransmit ADD_ADDR ID 0 Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: prio: skip closed subflows Gang Yan <yangang(a)kylinos.cn> mptcp: fix scheduling with atomic in timestamp sockopt Paolo Abeni <pabeni(a)redhat.com> mptcp: fix rx timestamp corruption on fastopen Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: sockopt: increase seq in mptcp_setsockopt_all_sf Gang Yan <yangang(a)kylinos.cn> mptcp: sockopt: set timestamp flags on subflow socket, not msk Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: fastclose msk when linger time is 0 Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: mptcp: pm: restrict 'unknown' check to pm_nl_ctl Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: mptcp: check output: catch cmd errors David Carlier <devnexen(a)gmail.com> sched_ext: idle: Recheck prev_cpu after narrowing allowed mask Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/rxe: Reject unknown opcodes before ICRC processing Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() Junrui Luo <moonafterrain(a)outlook.com> RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Validate rx_hash_key_len Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/ionic: Fix typo in format string Kai Zen <kai.aizen.dev(a)gmail.com> RDMA/ionic: bound node_desc sysfs read with %.64s Dapeng Mi <dapeng1.mi(a)linux.intel.com> perf/x86/intel: Always reprogram ACR events to prevent stale masks Nilay Shroff <nilay(a)linux.ibm.com> powerpc/xive: fix kmemleak caused by incorrect chip_data lookup André Draszik <andre.draszik(a)linaro.org> power: supply: max17042: avoid overflow when determining health Lukas Wunner <lukas(a)wunner.de> PCI/ASPM: Fix pci_clear_and_set_config_dword() usage Lukas Wunner <lukas(a)wunner.de> PCI/AER: Stop ruling out unbound devices as error source Shuai Xue <xueshuai(a)linux.alibaba.com> PCI/AER: Clear only error bits in PCIe Device Status Lukas Wunner <lukas(a)wunner.de> PCI: Update saved_config_space upon resource assignment SeongJae Park <sj(a)kernel.org> mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock SeongJae Park <sj(a)kernel.org> mm/damon/stat: detect and use fresh enabled value Paolo Bonzini <pbonzini(a)redhat.com> KVM: x86: Do IRR scan in __kvm_apic_update_irr even if PIR is empty Paolo Bonzini <pbonzini(a)redhat.com> KVM: x86: check for nEPT/nNPT in slow flush hypercalls Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: validate dacloffset before building DACL pointers Bjoern Doebel <doebel(a)amazon.de> smb: client: use kzalloc to zero-initialize security descriptor buffer Zisen Ye <zisenye(a)stu.xidian.edu.cn> smb/client: fix out-of-bounds read in symlink_data() Zisen Ye <zisenye(a)stu.xidian.edu.cn> smb/client: fix out-of-bounds read in smb2_compound_op() Ranjan Kumar <ranjan.kumar(a)broadcom.com> scsi: mpt3sas: Limit NVMe request size to 2 MiB Pengpeng Hou <pengpeng(a)iscas.ac.cn> s390/debug: Reject zero-length input before trimming a newline Vasily Gorbik <gor(a)linux.ibm.com> s390/debug: Reject zero-length input in debug_input_flush_fn() Osama Abdelkader <osama.abdelkader(a)gmail.com> riscv: kvm: fix vector context allocation leak Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/hns: Fix unlocked call to hns_roce_qp_remove() David Carlier <devnexen(a)gmail.com> psp: strip variable-length PSP header in psp_dev_rcv() Ulf Hansson <ulf.hansson(a)linaro.org> pmdomain: core: Fix detach procedure for virtual devices in genpd Ilya Maximets <i.maximets(a)ovn.org> openvswitch: vport: fix self-deadlock on release of tunnel ports Chaitanya Kulkarni <kch(a)nvidia.com> nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free Chaitanya Kulkarni <kch(a)nvidia.com> nvmet-tcp: fix race between ICReq handling and queue teardown Fedor Pchelkin <pchelkin(a)ispras.ru> nvme-apple: drop invalid put of admin queue reference count Junrui Luo <moonafterrain(a)outlook.com> md/raid10: fix divide-by-zero in setup_geo() with zero far_copies Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Fix slab-out-of-bounds access in auth message processing Christian A. Ehrhardt <lk(a)c--e.de> lib/scatterlist: fix temp buffer in extract_user_to_sg() Christian A. Ehrhardt <lk(a)c--e.de> lib/scatterlist: fix length calculations in extract_kvec_to_sg Lukas Wunner <lukas(a)wunner.de> lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() Nicolin Chen <nicolinc(a)nvidia.com> iommu/arm-smmu-v3: Add a missing dma_wmb() for hitless STE update Zhenzhong Duan <zhenzhong.duan(a)intel.com> iommu/vt-d: Block PASID attachment to nested domain with dirty tracking Zhenzhong Duan <zhenzhong.duan(a)intel.com> iommufd: Fix return value of iommufd_fault_fops_write() Michael Bommarito <michael.bommarito(a)gmail.com> isofs: validate block number from NFS file handle in isofs_export_iget Michael Bommarito <michael.bommarito(a)gmail.com> isofs: validate Rock Ridge CE continuation extent against volume size Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: correctly reject too-small hash devices Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: correctly reject too-small FEC devices David Carlier <devnexen(a)gmail.com> eventfs: Hold eventfs_mutex and SRCU when remount walks events Mikulas Patocka <mpatocka(a)redhat.com> dm: fix a buffer overflow in ioctl processing Mikulas Patocka <mpatocka(a)redhat.com> dm: don't report warning when doing deferred remove Mikulas Patocka <mpatocka(a)redhat.com> dm-thin: fix metadata refcount underflow Filipe Manana <fdmanana(a)suse.com> btrfs: fix missing last_unlink_trans update when removing a directory Guangshuo Li <lgs201920130244(a)gmail.com> btrfs: fix double free in create_space_info() error path Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm: remove child devices when apm is removed Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error Joseph Salisbury <joseph.salisbury(a)oracle.com> ASoC: fsl_easrc: fix comment typo Li Jian <lazycat-xiao(a)foxmail.com> ASoC: ES8389: convert to devm_clk_get_optional() to get clock Tommaso Soncin <soncintommaso(a)gmail.com> ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table Shrikanth Hegde <sshegde(a)linux.ibm.com> cpuidle: powerpc: avoid double clear when breaking snooze Conor Dooley <conor.dooley(a)microchip.com> clk: microchip: mpfs-ccc: fix out of bounds access during output registration Stefan Eichenberger <stefan.eichenberger(a)toradex.com> clk: imx: imx8-acm: fix flags for acm clocks Steven Rostedt <rostedt(a)goodmis.org> tracing/probes: Limit size of event probe to 3K Johan Hovold <johan(a)kernel.org> spi: topcliff-pch: fix use-after-free on unbind Johan Hovold <johan(a)kernel.org> spi: topcliff-pch: fix controller deregistration Thorsten Blum <thorsten.blum(a)linux.dev> thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp Thorsten Blum <thorsten.blum(a)linux.dev> thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> thermal: core: Free thermal zone ID later during removal Michael Bommarito <michael.bommarito(a)gmail.com> udf: reject descriptors with oversized CRC length David Carlier <devnexen(a)gmail.com> tracefs: Fix default permissions not being applied on initial mount Conor Dooley <conor.dooley(a)microchip.com> spi: microchip-core-qspi: control built-in cs manually Conor Dooley <conor.dooley(a)microchip.com> spi: microchip-core-qspi: don't attempt to transmit during emulated read-only dual/quad operations Johan Hovold <johan(a)kernel.org> spi: microchip-core-qspi: fix controller deregistration Guangshuo Li <lgs201920130244(a)gmail.com> ice: fix double free in ice_sf_eth_activate() error path Mingming Cao <mmc(a)linux.ibm.com> ibmveth: Disable GSO for packets with small MSS Dexuan Cui <decui(a)microsoft.com> hv_sock: Return -EIO for malformed/short packets Dexuan Cui <decui(a)microsoft.com> hv_sock: Report EOF instead of -EIO for FIN Hamza Mahfooz <hamzamahfooz(a)linux.microsoft.com> hv_sock: fix ARM64 support Thomas Zimmermann <tzimmermann(a)suse.de> hv: Select CONFIG_SYSFB only for CONFIG_HYPERV_VMBUS Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> gpio: of: clear OF_POPULATED on hog nodes in remove path Xu Yang <xu.yang_2(a)nxp.com> extcon: ptn5150: handle pending IRQ events during system resume Shyam Prasad N <sprasad(a)microsoft.com> cifs: change_conf needs to be called for session setup Shyam Prasad N <sprasad(a)microsoft.com> cifs: abort open_cached_dir if we don't request leases Jens Axboe <axboe(a)kernel.dk> block: only read from sqe on initial invocation of blkdev_uring_cmd() Naman Jain <namjain(a)linux.microsoft.com> block: add pgmap check to biovec_phys_mergeable Wentao Liang <vulab(a)iscas.ac.cn> pmdomain: mediatek: fix use-after-free in scpsys_get_bus_protection_legacy() Breno Leitao <leitao(a)debian.org> arm64/fpsimd: ptrace: zero target's fpsimd_state, not the tracer's Jiexun Wang <wangjiexun2025(a)gmail.com> af_unix: Reject SIOCATMARK on non-stream sockets Myeonghun Pak <mhun512(a)gmail.com> hwmon: (corsair-psu) Close HID device on probe errors Johan Hovold <johan(a)kernel.org> clk: rk808: fix OF node reference imbalance Sanman Pradhan <psanman(a)juniper.net> hwmon: (ltc2992) Fix u32 overflow in power read path Sanman Pradhan <psanman(a)juniper.net> hwmon: (ltc2992) Clamp threshold writes to hardware range Ivan Hu <ivan.hu(a)canonical.com> x86/efi: Fix graceful fault handling after FPU softirq changes Hongling Zeng <zenghongling(a)kylinos.cn> parisc: Fix IRQ leak in LASI driver Tzung-Bi Shih <tzungbi(a)kernel.org> platform/chrome: cros_ec_typec: Init mutex in Thunderbolt registration Pavitra Jha <jhapavitra98(a)gmail.com> net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler Nan Li <tonanli66(a)gmail.com> net/rds: handle zerocopy send cleanup before the message is queued Breno Leitao <leitao(a)debian.org> netpoll: pass buffer size to egress_dev() to avoid MAC truncation Jiawen Wu <jiawenwu(a)trustnetic.com> net: libwx: use request_irq for VF misc interrupt Maoyi Xie <maoyixie.tju(a)gmail.com> ip6_gre: Use cached t->net in ip6erspan_changelink(). Jiawen Wu <jiawenwu(a)trustnetic.com> net: libwx: fix VF illegal register access Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> pseries/papr-hvpipe: Fix the usage of copy_to_user() Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> pseries/papr-hvpipe: Fix & simplify error handling in papr_hvpipe_init() Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> pseries/papr-hvpipe: Prevent kernel stack memory leak to userspace SeungJu Cheon <suunj1331(a)gmail.com> sound: ua101: fix division by zero at probe Dapeng Mi <dapeng1.mi(a)linux.intel.com> perf/x86/intel: Improve validation and configuration of ACR masks Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: skip inactive subflows Kai Zen <kai.aizen.dev(a)gmail.com> net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo Xianglai Li <lixianglai(a)loongson.cn> LoongArch: KVM: Compile switch.S directly into the kernel Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Fix SYM_SIGFUNC_START definition for 32BIT Sang-Heon Jeon <ekffu200098(a)gmail.com> mm/hugetlb_cma: round up per_node before logging it Kevin Brodsky <kevin.brodsky(a)arm.com> arm64: signal: Preserve POR_EL0 if poe_context is missing Tudor Ambarus <tudor.ambarus(a)linaro.org> mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show() Fuad Tabba <tabba(a)google.com> KVM: arm64: Fix kvm_vcpu_initialized() macro parameter Miklos Szeredi <mszeredi(a)redhat.com> fanotify: fix false positive on permission events Johan Hovold <johan(a)kernel.org> staging: vme_user: fix root device leak on init failure Johan Hovold <johan(a)kernel.org> spi: s3c64xx: fix NULL-deref on driver unbind Johan Hovold <johan(a)kernel.org> spi: zynqmp-gqspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sun6i: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: ti-qspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sun4i: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: syncuacer: fix controller deregistration Miguel Ojeda <ojeda(a)kernel.org> rust: allow `clippy::collapsible_if` globally Miguel Ojeda <ojeda(a)kernel.org> rust: allow `clippy::collapsible_match` globally Eliot Courtney <ecourtney(a)nvidia.com> rust: drm: gem: clean up GEM state in init failure case Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt Tristan Madani <tristan(a)talencesecurity.com> Bluetooth: btmtk: validate WMT event SKB length before struct access Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: virtio_bt: validate rx pkt_type header length Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: virtio_bt: clamp rx length before skb_put Tao Cui <cuitao(a)kylinos.cn> LoongArch: KVM: Fix missing EMULATE_FAIL in kvm_emu_mmio_read() Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: prune /sys/fs/selinux/user Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: prune /sys/fs/selinux/disable Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: prune /sys/fs/selinux/checkreqprot Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: shrink critical section in sel_write_load() David Windsor <dwindsor(a)gmail.com> selinux: don't reserve xattr slot when we won't fill it Zongyao Chen <ZongYao.Chen(a)linux.alibaba.com> selinux: use sk blob accessor in socket permission helpers Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: fix avdcache auditing Michael Bommarito <michael.bommarito(a)gmail.com> xfrm: ah: account for ESN high bits in async callbacks Yilin Zhu <zylzyl2333(a)gmail.com> ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() Michal Kosiorek <mkosiorek121(a)gmail.com> xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete Ruijie Li <ruijieli51(a)gmail.com> xfrm: provide message size for XFRM_MSG_MAPPING Ard Biesheuvel <ardb(a)kernel.org> x86/efi: Restore IRQ state in EFI page fault handler Sourabh Jain <sourabhjain(a)linux.ibm.com> powerpc/kdump: fix KASAN sanitization flag for core_$(BITS).o Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: seq: Fix UMP group 16 filtering Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: core: Serialize deferred fasync state checks Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: firewire-tascam: Do not drop unread control events Yuriy Padlyak <yuriypadlyak(a)gmail.com> ALSA: hda/realtek: Fix speaker silence after S3 resume on Xiaomi Mi Laptop Pro 15 Takashi Iwai <tiwai(a)suse.de> ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: hda: cs35l56: Propagate ASP TX source control errors Xu Yang <xu.yang_2(a)nxp.com> usb: typec: tcpm: fix debug accessory mode detection for sink ports Felix Gu <ustc.gu(a)gmail.com> usb: ulpi: fix memory leak on ulpi_register() error paths Fabio Porcedda <fabio.porcedda(a)gmail.com> USB: serial: option: add Telit Cinterion LE910Cx compositions Aaro Koskinen <aaro.koskinen(a)iki.fi> USB: omap_udc: DMA: Don't enable burst 4 mode Amit Sunil Dhamne <amitsd(a)google.com> usb: typec: tcpm: reset internal port states on soft reset AMS Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Fix UAC3 cluster descriptor size check Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: midi2: Restart output URBs on resume Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: usblp: fix heap leak in IEEE 1284 device ID via short response Marek Szyprowski <m.szyprowski(a)samsung.com> wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task Tristan Madani <tristan(a)talencesecurity.com> wifi: b43: enforce bounds check on firmware key index in b43_rx() Johannes Berg <johannes.berg(a)intel.com> wifi: mac80211: remove station if connection prep fails Jiri Slaby (SUSE) <jirislaby(a)kernel.org> wifi: ath5k: do not access array OOB Benjamin Berg <benjamin.berg(a)intel.com> wifi: mac80211: use safe list iteration in radar detect work Jeongjun Park <aha310510(a)gmail.com> wifi: rsi: fix kthread lifetime race between self-exit and external-stop Catherine <enderaoelyther(a)gmail.com> wifi: mac80211: drop stray 'static' from fast-RX rx_result Tristan Madani <tristan(a)talencesecurity.com> wifi: b43legacy: enforce bounds check on firmware key index in RX path Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work Leon Yen <leon.yen(a)mediatek.com> wifi: mt76: mt7921: fix a potential clc buffer length underflow Ming Yen Hsieh <mingyen.hsieh(a)mediatek.com> wifi: mt76: mt7925: fix incorrect length field in txpower command Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7925: fix AMPDU state handling in mt7925_tx_check_aggr Jann Horn <jannh(a)google.com> exit: prevent preemption of oopsing TASK_DEAD task Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked Ovidiu Panait <ovidiu.panait.rb(a)renesas.com> net: stmmac: Disable EEE RX clock stop when VLAN is enabled Paolo Bonzini <pbonzini(a)redhat.com> KVM: SVM: check validity of VMCB controls when returning from SMM Zhengchuan Liang <zcliangcn(a)gmail.com> net: af_key: zero aligned sockaddr tail in PF_KEY exports Yi Kuo <yi(a)yikuo.dev> smb: client/smbdirect: fix MR registration for coalesced SG lists Gang Yan <yangang(a)kylinos.cn> mptcp: sync the msk->sndbuf at accept() time Qingfang Deng <qingfang.deng(a)linux.dev> flow_dissector: do not dissect PPPoE PFC frames Sam Edwards <cfsworks(a)gmail.com> ceph: fix num_ops off-by-one when crypto allocation fails Sean Christopherson <seanjc(a)google.com> KVM: x86: Fix shadow paging use-after-free due to unexpected GFN DaeMyung Kang <charsyam(a)gmail.com> ksmbd: rewrite stop_sessions() with restartable iteration Johan Hovold <johan(a)kernel.org> spi: rockchip: fix controller deregistration Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7925: fix incorrect TLV length in CLC command Mark Brown <broonie(a)kernel.org> ASoC: SOF: Don't allow pointer operations on unconfigured streams Sina Hassani <sina(a)openai.com> iommufd: Fix a race with concurrent allocation and unmap David Carlier <devnexen(a)gmail.com> tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() Shivam Kalra <shivamkalra98(a)zohomail.in> ACPI: video: force native backlight on HP OMEN 16 (8A44) Jinjie Ruan <ruanjinjie(a)huawei.com> ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug Jan Schär <jan(a)jschaer.ch> ACPI: video: Add backlight=native quirk for Dell OptiPlex 7770 AIO Guangshuo Li <lgs201920130244(a)gmail.com> ACPI: scan: Use acpi_dev_put() in object add error paths Rajat Gupta <rajgupt(a)qti.qualcomm.com> fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free Corey Minyard <corey(a)minyard.net> ipmi:si: Return state to normal if message allocation fails Corey Minyard <corey(a)minyard.net> ipmi: Check event message buffer response for bad data Corey Minyard <corey(a)minyard.net> ipmi: Add limits to event and receive message requests Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() ------------- Diffstat: .../ABI/{obsolete => removed}/sysfs-selinux-user | 0 Makefile | 6 +- arch/arm64/include/asm/kvm_host.h | 2 +- arch/arm64/kernel/ptrace.c | 4 +- arch/arm64/kernel/signal.c | 54 +++++-- arch/arm64/kvm/arm.c | 4 + arch/arm64/kvm/config.c | 17 +- arch/arm64/kvm/hyp/nvhe/pkvm.c | 38 +++-- arch/arm64/kvm/hyp/nvhe/setup.c | 8 +- arch/arm64/kvm/vgic/vgic-mmio-v2.c | 2 +- arch/arm64/kvm/vgic/vgic-mmio-v3.c | 2 +- arch/loongarch/Kbuild | 2 +- arch/loongarch/include/asm/asm-prototypes.h | 20 +++ arch/loongarch/include/asm/kvm_host.h | 3 - arch/loongarch/include/asm/linkage.h | 2 +- arch/loongarch/kvm/Makefile | 3 +- arch/loongarch/kvm/exit.c | 1 + arch/loongarch/kvm/interrupt.c | 14 ++ arch/loongarch/kvm/main.c | 35 +--- arch/loongarch/kvm/mmu.c | 2 +- arch/loongarch/kvm/switch.S | 22 ++- arch/loongarch/kvm/timer.c | 10 +- arch/loongarch/kvm/vm.c | 2 +- arch/loongarch/pci/acpi.c | 5 + arch/loongarch/pci/pci.c | 3 + arch/powerpc/kexec/Makefile | 2 +- arch/powerpc/platforms/pseries/papr-hvpipe.c | 53 +++--- arch/powerpc/sysdev/xive/common.c | 16 +- arch/riscv/kvm/vcpu_vector.c | 5 +- arch/s390/kernel/debug.c | 8 + arch/x86/events/core.c | 13 +- arch/x86/events/intel/core.c | 32 +++- arch/x86/include/asm/efi.h | 3 +- arch/x86/include/asm/msr-index.h | 3 +- arch/x86/kernel/cpu/amd.c | 3 + arch/x86/kvm/hyperv.c | 2 +- arch/x86/kvm/lapic.c | 8 +- arch/x86/kvm/mmu/mmu.c | 35 ++-- arch/x86/kvm/svm/nested.c | 12 +- arch/x86/kvm/svm/svm.c | 4 + arch/x86/kvm/svm/svm.h | 1 + arch/x86/mm/fault.c | 2 +- arch/x86/platform/efi/quirks.c | 13 +- block/blk.h | 2 + block/ioctl.c | 24 +-- drivers/acpi/cppc_acpi.c | 6 +- drivers/acpi/power.c | 2 +- drivers/acpi/scan.c | 2 +- drivers/acpi/video_detect.c | 16 ++ drivers/android/binder/range_alloc/array.rs | 1 - drivers/bluetooth/btmtk.c | 15 +- drivers/bluetooth/virtio_bt.c | 39 ++++- drivers/char/ipmi/ipmi_si_intf.c | 70 ++++++-- drivers/char/ipmi/ipmi_ssif.c | 23 ++- drivers/clk/clk-rk808.c | 2 +- drivers/clk/imx/clk-imx8-acm.c | 3 +- drivers/clk/microchip/clk-mpfs-ccc.c | 6 +- drivers/cpuidle/cpuidle-powernv.c | 5 +- drivers/cpuidle/cpuidle-pseries.c | 5 +- drivers/crypto/caam/caamalg_qi2.c | 4 +- drivers/crypto/caam/caamhash.c | 4 +- .../crypto/intel/qat/qat_common/adf_accel_engine.c | 7 + .../qat/qat_common/icp_qat_fw_loader_handle.h | 1 + drivers/crypto/intel/qat/qat_common/qat_hal.c | 27 ++-- drivers/extcon/extcon-ptn5150.c | 14 ++ drivers/firmware/samsung/exynos-acpm-pmic.c | 10 +- drivers/firmware/samsung/exynos-acpm-pmic.h | 10 +- drivers/firmware/samsung/exynos-acpm.c | 16 +- drivers/firmware/samsung/exynos-acpm.h | 2 +- drivers/gpio/gpiolib-of.c | 9 +- drivers/hv/Kconfig | 2 +- drivers/hwmon/corsair-psu.c | 4 +- drivers/hwmon/ltc2992.c | 41 +++-- drivers/hwmon/powerz.c | 5 +- drivers/infiniband/hw/hns/hns_roce_qp.c | 7 + drivers/infiniband/hw/ionic/ionic_ibdev.c | 2 +- drivers/infiniband/hw/mana/cq.c | 5 +- drivers/infiniband/hw/mana/qp.c | 16 +- drivers/infiniband/hw/mlx4/srq.c | 4 +- drivers/infiniband/hw/mlx5/main.c | 1 + drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 4 +- drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c | 2 +- drivers/infiniband/sw/rxe/rxe_recv.c | 11 ++ drivers/infiniband/sw/rxe/rxe_resp.c | 14 +- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 7 + drivers/iommu/intel/nested.c | 6 +- drivers/iommu/iommufd/eventq.c | 5 +- drivers/iommu/iommufd/io_pagetable.c | 10 ++ drivers/md/dm-ioctl.c | 6 +- drivers/md/dm-verity-fec.c | 8 +- drivers/md/persistent-data/dm-btree-remove.c | 8 + drivers/md/raid10.c | 2 + drivers/mfd/sec-acpm.c | 10 +- drivers/mmc/core/card.h | 11 ++ drivers/mmc/core/mmc.c | 12 ++ drivers/mmc/core/queue.c | 9 +- drivers/mmc/core/quirks.h | 12 ++ drivers/mtd/spi-nor/debugfs.c | 4 +- drivers/net/ethernet/ibm/ibmveth.c | 22 +++ drivers/net/ethernet/ibm/ibmveth.h | 1 + drivers/net/ethernet/intel/ice/ice_sf_eth.c | 2 + .../ethernet/marvell/octeon_ep_vf/octep_vf_rx.c | 36 ++++- drivers/net/ethernet/mellanox/mlx4/srq.c | 13 +- drivers/net/ethernet/stmicro/stmmac/chain_mode.c | 2 +- drivers/net/ethernet/stmicro/stmmac/common.h | 2 +- drivers/net/ethernet/stmicro/stmmac/ring_mode.c | 2 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 47 +++--- drivers/net/ethernet/wangxun/libwx/wx_hw.c | 7 +- drivers/net/ethernet/wangxun/libwx/wx_vf_common.c | 4 +- drivers/net/wireless/ath/ath5k/base.c | 3 +- drivers/net/wireless/broadcom/b43/xmit.c | 3 +- drivers/net/wireless/broadcom/b43legacy/xmit.c | 3 +- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 6 +- drivers/net/wireless/mediatek/mt76/mt7921/main.c | 7 +- drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | 3 + drivers/net/wireless/mediatek/mt76/mt7925/mac.c | 6 +- drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 4 +- drivers/net/wireless/rsi/rsi_common.h | 5 +- drivers/net/wwan/t7xx/t7xx_modem_ops.c | 20 ++- drivers/net/wwan/t7xx/t7xx_port_ctrl_msg.c | 18 ++- drivers/net/wwan/t7xx/t7xx_port_proxy.h | 2 +- drivers/nvme/host/apple.c | 6 +- drivers/nvme/target/core.c | 2 +- drivers/nvme/target/tcp.c | 26 +++ drivers/parisc/lasi.c | 12 +- drivers/pci/pci.c | 7 +- drivers/pci/pcie/aer.c | 2 - drivers/pci/pcie/aspm.c | 17 +- drivers/pci/setup-res.c | 2 + drivers/platform/chrome/cros_typec_altmode.c | 1 + drivers/pmdomain/core.c | 10 +- drivers/pmdomain/mediatek/mtk-pm-domains.c | 10 +- drivers/power/supply/max17042_battery.c | 2 +- drivers/scsi/mpt3sas/mpt3sas_scsih.c | 14 +- drivers/spi/spi-microchip-core-qspi.c | 103 +++++++++--- drivers/spi/spi-rockchip.c | 4 +- drivers/spi/spi-s3c64xx.c | 5 - drivers/spi/spi-sun4i.c | 10 +- drivers/spi/spi-sun6i.c | 8 +- drivers/spi/spi-synquacer.c | 8 +- drivers/spi/spi-ti-qspi.c | 14 +- drivers/spi/spi-topcliff-pch.c | 11 +- drivers/spi/spi-zynqmp-gqspi.c | 4 +- drivers/staging/vme_user/vme_fake.c | 2 + drivers/target/target_core_configfs.c | 2 +- drivers/thermal/sprd_thermal.c | 4 +- drivers/thermal/thermal_core.c | 6 +- drivers/usb/class/usblp.c | 3 +- drivers/usb/common/ulpi.c | 5 +- drivers/usb/gadget/udc/omap_udc.c | 4 - drivers/usb/serial/option.c | 4 + drivers/usb/typec/tcpm/tcpm.c | 27 ++-- drivers/video/fbdev/core/fb_defio.c | 178 ++++++++++++++++----- drivers/video/fbdev/udlfb.c | 31 +++- fs/btrfs/inode.c | 2 + fs/btrfs/space-info.c | 2 +- fs/ceph/addr.c | 4 + fs/erofs/decompressor.c | 86 +++++----- fs/f2fs/data.c | 28 +++- fs/f2fs/extent_cache.c | 17 +- fs/f2fs/f2fs.h | 2 + fs/f2fs/inline.c | 22 ++- fs/f2fs/inode.c | 2 +- fs/f2fs/node.c | 95 +++++------ fs/f2fs/sysfs.c | 10 +- fs/hfsplus/bfind.c | 51 ++++++ fs/hfsplus/catalog.c | 4 +- fs/hfsplus/dir.c | 2 +- fs/hfsplus/hfsplus_fs.h | 9 ++ fs/hfsplus/super.c | 6 +- fs/isofs/export.c | 2 +- fs/isofs/rock.c | 9 ++ fs/notify/fsnotify.c | 2 +- fs/notify/mark.c | 18 ++- fs/smb/client/cached_dir.c | 8 + fs/smb/client/cifsacl.c | 37 ++++- fs/smb/client/smb2inode.c | 12 +- fs/smb/client/smb2misc.c | 3 +- fs/smb/client/smb2ops.c | 11 ++ fs/smb/client/smbdirect.c | 21 +-- fs/smb/server/connection.c | 48 ++++-- fs/smb/server/connection.h | 1 + fs/tracefs/event_inode.c | 14 ++ fs/tracefs/inode.c | 6 +- fs/tracefs/internal.h | 3 + fs/udf/misc.c | 8 +- include/linux/dma-mapping.h | 13 ++ include/linux/fb.h | 4 +- .../linux/firmware/samsung/exynos-acpm-protocol.h | 29 ++-- include/linux/fsnotify_backend.h | 1 + include/linux/mmc/card.h | 2 + include/linux/printk.h | 13 ++ include/uapi/linux/io_uring.h | 3 +- include/video/udlfb.h | 1 + io_uring/io_uring.c | 12 +- io_uring/kbuf.c | 12 +- io_uring/kbuf.h | 7 + kernel/bpf/arena.c | 19 ++- kernel/exit.c | 1 + kernel/sched/ext_idle.c | 12 +- kernel/trace/trace_probe.c | 6 + kernel/trace/trace_probe.h | 4 +- kernel/tracepoint.c | 2 + lib/crypto/mpi/mpicoder.c | 2 +- lib/scatterlist.c | 8 +- mm/damon/core.c | 5 + mm/damon/stat.c | 30 ++-- mm/damon/sysfs-schemes.c | 12 +- mm/hugetlb_cma.c | 1 + mm/swapfile.c | 21 ++- net/bluetooth/hci_event.c | 29 +++- net/bluetooth/l2cap_sock.c | 9 ++ net/ceph/auth.c | 2 +- net/ceph/mon_client.c | 2 + net/core/flow_dissector.c | 13 +- net/core/netpoll.c | 23 +-- net/core/rtnetlink.c | 1 + net/ipv4/ah4.c | 14 +- net/ipv6/ah6.c | 14 +- net/ipv6/ip6_gre.c | 5 +- net/ipv6/xfrm6_protocol.c | 4 +- net/key/af_key.c | 52 +++--- net/mac80211/mlme.c | 9 +- net/mac80211/rx.c | 2 +- net/mac80211/util.c | 4 +- net/mptcp/fastopen.c | 4 +- net/mptcp/pm.c | 62 ++++--- net/mptcp/pm_kernel.c | 13 +- net/mptcp/protocol.c | 6 +- net/mptcp/sockopt.c | 16 +- net/mptcp/subflow.c | 4 +- net/openvswitch/vport-netdev.c | 6 +- net/psp/psp_main.c | 42 +++-- net/rds/message.c | 20 ++- net/sched/sch_red.c | 2 +- net/unix/af_unix.c | 3 + net/vmw_vsock/hyperv_transport.c | 33 +++- net/xfrm/xfrm_state.c | 12 +- net/xfrm/xfrm_user.c | 1 + rust/kernel/drm/gem/mod.rs | 13 +- rust/pin-init/src/__internal.rs | 28 ++-- rust/pin-init/src/macros.rs | 91 ++++++----- security/selinux/hooks.c | 38 ++--- security/selinux/include/objsec.h | 4 +- security/selinux/include/security.h | 2 - security/selinux/selinuxfs.c | 169 ++++--------------- security/selinux/ss/services.c | 125 --------------- sound/core/misc.c | 8 +- sound/core/oss/pcm_oss.c | 29 +++- sound/core/seq/seq_clientmgr.c | 2 +- sound/core/seq/seq_clientmgr.h | 5 +- sound/core/seq/seq_ump_client.c | 2 +- sound/firewire/tascam/tascam-hwdep.c | 1 + sound/hda/codecs/realtek/alc269.c | 19 +++ sound/hda/codecs/side-codecs/cs35l56_hda.c | 19 ++- sound/soc/amd/yc/acp6x-mach.c | 14 ++ sound/soc/codecs/es8389.c | 2 +- sound/soc/fsl/fsl_easrc.c | 2 +- sound/soc/intel/boards/bytcr_wm5102.c | 1 + sound/soc/qcom/qdsp6/q6apm-dai.c | 1 + sound/soc/qcom/qdsp6/q6apm-lpass-dais.c | 2 +- sound/soc/qcom/qdsp6/q6apm.c | 3 + sound/soc/sof/compress.c | 3 + sound/usb/midi2.c | 9 +- sound/usb/misc/ua101.c | 7 + sound/usb/stream.c | 4 +- tools/arch/x86/include/asm/msr-index.h | 3 +- tools/testing/selftests/net/mptcp/mptcp_lib.sh | 16 +- tools/testing/selftests/net/mptcp/pm_netlink.sh | 20 ++- 269 files changed, 2440 insertions(+), 1165 deletions(-)

6 days, 4 hours

8
7
0 0

[PATCH 7.0 000/307] 7.0.7-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 7.0.7 release. There are 307 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 14 May 2026 17:38:03 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.0.7-rc1.… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.0.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 7.0.7-rc1 Prathyushi Nangia <prathyushi.nangia(a)amd.com> x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache Gary Guo <gary(a)garyguo.net> rust: pin-init: fix incorrect accessor reference lifetime Sam Edwards <cfsworks(a)gmail.com> net: stmmac: Prevent NULL deref when RX memory exhausted Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY() Thorsten Blum <thorsten.blum(a)linux.dev> crypto: caam - guard HMAC key hex dumps in hash_digest_key Thorsten Blum <thorsten.blum(a)linux.dev> printk: add print_hex_dump_devel() Longxuan Yu <ylong030(a)ucr.edu> 8021q: delete cleared egress QoS mappings Longxuan Yu <ylong030(a)ucr.edu> 8021q: use RCU for egress QoS mappings Zilin Guan <zilin(a)seu.edu.cn> hfsplus: fix held lock freed on hfsplus_fill_super() Deepanshu Kartikey <kartikey406(a)gmail.com> hfsplus: fix uninit-value by validating catalog record size Suman Kumar Chakraborty <suman.kumar.chakraborty(a)intel.com> crypto: qat - fix firmware loading failure for GEN6 devices Suman Kumar Chakraborty <suman.kumar.chakraborty(a)intel.com> crypto: qat - fix indentation of macros in qat_hal.c Luke Wang <ziniu.wang_1(a)nxp.com> mmc: core: Optimize time for secure erase/trim for some Kingston eMMCs Avri Altman <avri.altman(a)sandisk.com> mmc: core: Add quirk for incorrect manufacturing date Avri Altman <avri.altman(a)sandisk.com> mmc: core: Adjust MDT beyond 2025 David Carlier <devnexen(a)gmail.com> octeon_ep_vf: add NULL check for napi_build_skb() Alexei Starovoitov <ast(a)kernel.org> bpf: Fix use-after-free in arena_vm_close on fork Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Use per-root-bridge PCIH flag to skip mem resource fixup Tao Cui <cuitao(a)kylinos.cn> LoongArch: KVM: Use kvm_set_pte() in kvm_flush_pte() Bibo Mao <maobibo(a)loongson.cn> LoongArch: KVM: Move unconditional delay into timer clear scenery Bibo Mao <maobibo(a)loongson.cn> LoongArch: KVM: Fix HW timer interrupt lost when inject interrupt by software Xianglai Li <lixianglai(a)loongson.cn> LoongArch: KVM: Fix "unreliable stack" for kvm_exc_entry Qiang Ma <maqianga(a)uniontech.com> LoongArch: KVM: Cap KVM_CAP_NR_VCPUS by KVM_CAP_MAX_VCPUS Wentao Guan <guanwentao(a)uniontech.com> LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang() Fuad Tabba <tabba(a)google.com> KVM: arm64: Fix pin leak and publication ordering in __pkvm_init_vcpu() Fuad Tabba <tabba(a)google.com> KVM: arm64: Fix FEAT_Debugv8p9 to check DebugVer, not PMUVer Fuad Tabba <tabba(a)google.com> KVM: arm64: Fix FEAT_SPE_FnE to use PMSIDR_EL1.FnE, not PMSVer Quentin Perret <qperret(a)google.com> KVM: arm64: Fix initialisation order in __pkvm_init_finalise() David Woodhouse <dwmw(a)amazon.co.uk> KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value Marc Zyngier <maz(a)kernel.org> KVM: arm64: Wake-up from WFI when iqrchip is in userspace Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix fsck inconsistency caused by FGGC of node block Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix inline data not being written to disk in writeback path Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: refactor f2fs_move_node_folio function Guangshuo Li <lgs201920130244(a)gmail.com> f2fs: fix uninitialized kobject put in f2fs_init_sysfs() Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix node_cnt race between extent node destroy and writeback Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix incorrect multidevice info in trace_f2fs_map_blocks() Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix incorrect file address mapping when inline inode is unwritten Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix fsck inconsistency caused by incorrect nat_entry flag usage Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix fiemap boundary handling when read extent cache is incomplete Chao Yu <chao(a)kernel.org> f2fs: fix false alarm of lockdep on cp_global_sem lock Cen Zhang <zzzccc427(a)gmail.com> f2fs: add READ_ONCE() for i_blocks in f2fs_update_inode() Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: return early if no retrans Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: free sk if last Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: always decrease sk refcount Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: fix potential data-race Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: allow ID 0 Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: kernel: correctly retransmit ADD_ADDR ID 0 Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: kernel: reset fullmesh counter after flush Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: prio: skip closed subflows Gang Yan <yangang(a)kylinos.cn> mptcp: fix scheduling with atomic in timestamp sockopt Paolo Abeni <pabeni(a)redhat.com> mptcp: fix rx timestamp corruption on fastopen Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: sockopt: increase seq in mptcp_setsockopt_all_sf Gang Yan <yangang(a)kylinos.cn> mptcp: sockopt: set timestamp flags on subflow socket, not msk Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: fastclose msk when linger time is 0 Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: mptcp: pm: restrict 'unknown' check to pm_nl_ctl Matthieu Baerts (NGI0) <matttbe(a)kernel.org> selftests: mptcp: check output: catch cmd errors Tejun Heo <tj(a)kernel.org> sched_ext: Use dsq->first_task instead of list_empty() in dispatch_enqueue() FIFO-tail Tejun Heo <tj(a)kernel.org> sched_ext: Skip tasks with stale task_rq in bypass_lb_cpu() David Carlier <devnexen(a)gmail.com> sched_ext: idle: Recheck prev_cpu after narrowing allowed mask Chen Ni <nichen(a)iscas.ac.cn> remoteproc: k3: Fix NULL vs IS_ERR() bug in k3_reserved_mem_init() Chen Ni <nichen(a)iscas.ac.cn> remoteproc: imx_rproc: Fix NULL vs IS_ERR() bug in imx_rproc_addr_init() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/rxe: Reject unknown opcodes before ICRC processing Michael Bommarito <michael.bommarito(a)gmail.com> RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() Junrui Luo <moonafterrain(a)outlook.com> RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Validate rx_hash_key_len Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/ionic: Fix typo in format string Kai Zen <kai.aizen.dev(a)gmail.com> RDMA/ionic: bound node_desc sysfs read with %.64s Dapeng Mi <dapeng1.mi(a)linux.intel.com> perf/x86/intel: Enable auto counter reload for DMR Dapeng Mi <dapeng1.mi(a)linux.intel.com> perf/x86/intel: Disable PMI for self-reloaded ACR events Dapeng Mi <dapeng1.mi(a)linux.intel.com> perf/x86/intel: Always reprogram ACR events to prevent stale masks Nilay Shroff <nilay(a)linux.ibm.com> powerpc/xive: fix kmemleak caused by incorrect chip_data lookup André Draszik <andre.draszik(a)linaro.org> power: supply: max17042: avoid overflow when determining health Lukas Wunner <lukas(a)wunner.de> PCI/ASPM: Fix pci_clear_and_set_config_dword() usage Lukas Wunner <lukas(a)wunner.de> PCI/AER: Stop ruling out unbound devices as error source Shuai Xue <xueshuai(a)linux.alibaba.com> PCI/AER: Clear only error bits in PCIe Device Status Lukas Wunner <lukas(a)wunner.de> PCI: Update saved_config_space upon resource assignment SeongJae Park <sj(a)kernel.org> mm/damon/sysfs-schemes: protect path kfree() with damon_sysfs_lock SeongJae Park <sj(a)kernel.org> mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock SeongJae Park <sj(a)kernel.org> mm/damon/stat: detect and use fresh enabled value SeongJae Park <sj(a)kernel.org> mm/damon/reclaim: detect and use fresh enabled and kdamond_pid values SeongJae Park <sj(a)kernel.org> mm/damon/lru_sort: detect and use fresh enabled and kdamond_pid values Paolo Bonzini <pbonzini(a)redhat.com> KVM: x86: Do IRR scan in __kvm_apic_update_irr even if PIR is empty Paolo Bonzini <pbonzini(a)redhat.com> KVM: x86: check for nEPT/nNPT in slow flush hypercalls Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: validate dacloffset before building DACL pointers Bjoern Doebel <doebel(a)amazon.de> smb: client: use kzalloc to zero-initialize security descriptor buffer Zisen Ye <zisenye(a)stu.xidian.edu.cn> smb/client: fix out-of-bounds read in symlink_data() Zisen Ye <zisenye(a)stu.xidian.edu.cn> smb/client: fix out-of-bounds read in smb2_compound_op() Ranjan Kumar <ranjan.kumar(a)broadcom.com> scsi: mpt3sas: Limit NVMe request size to 2 MiB Pengpeng Hou <pengpeng(a)iscas.ac.cn> s390/debug: Reject zero-length input before trimming a newline Vasily Gorbik <gor(a)linux.ibm.com> s390/debug: Reject zero-length input in debug_input_flush_fn() Osama Abdelkader <osama.abdelkader(a)gmail.com> riscv: kvm: fix vector context allocation leak Jason Gunthorpe <jgg(a)ziepe.ca> RDMA/hns: Fix unlocked call to hns_roce_qp_remove() David Carlier <devnexen(a)gmail.com> psp: strip variable-length PSP header in psp_dev_rcv() Ulf Hansson <ulfh(a)kernel.org> pmdomain: core: Fix detach procedure for virtual devices in genpd Ilya Maximets <i.maximets(a)ovn.org> openvswitch: vport: fix self-deadlock on release of tunnel ports Chaitanya Kulkarni <kch(a)nvidia.com> nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free Chaitanya Kulkarni <kch(a)nvidia.com> nvmet-tcp: fix race between ICReq handling and queue teardown Fedor Pchelkin <pchelkin(a)ispras.ru> nvme-apple: drop invalid put of admin queue reference count Junrui Luo <moonafterrain(a)outlook.com> md/raid10: fix divide-by-zero in setup_geo() with zero far_copies Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Fix slab-out-of-bounds access in auth message processing Christian A. Ehrhardt <lk(a)c--e.de> lib/scatterlist: fix temp buffer in extract_user_to_sg() Christian A. Ehrhardt <lk(a)c--e.de> lib/scatterlist: fix length calculations in extract_kvec_to_sg Eric Biggers <ebiggers(a)kernel.org> lib/crc: tests: Make crc_kunit test only the enabled CRC variants Lukas Wunner <lukas(a)wunner.de> lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() Nicolin Chen <nicolinc(a)nvidia.com> iommu/arm-smmu-v3: Add a missing dma_wmb() for hitless STE update Zhenzhong Duan <zhenzhong.duan(a)intel.com> iommu/vt-d: Block PASID attachment to nested domain with dirty tracking Zhenzhong Duan <zhenzhong.duan(a)intel.com> iommufd: Fix return value of iommufd_fault_fops_write() Michael Bommarito <michael.bommarito(a)gmail.com> isofs: validate block number from NFS file handle in isofs_export_iget Michael Bommarito <michael.bommarito(a)gmail.com> isofs: validate Rock Ridge CE continuation extent against volume size Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: fix the size of dm_verity_fec_io::erasures Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: fix reading parity bytes split across blocks (take 3) Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: fix corrected block count stat Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: correctly reject too-small hash devices Eric Biggers <ebiggers(a)kernel.org> dm-verity-fec: correctly reject too-small FEC devices David Carlier <devnexen(a)gmail.com> eventfs: Hold eventfs_mutex and SRCU when remount walks events Mikulas Patocka <mpatocka(a)redhat.com> dm: fix a buffer overflow in ioctl processing Mikulas Patocka <mpatocka(a)redhat.com> dm: don't report warning when doing deferred remove Mikulas Patocka <mpatocka(a)redhat.com> dm-thin: fix metadata refcount underflow Filipe Manana <fdmanana(a)suse.com> btrfs: fix missing last_unlink_trans update when removing a directory Guangshuo Li <lgs201920130244(a)gmail.com> btrfs: fix double free in create_space_info_sub_group() error path Guangshuo Li <lgs201920130244(a)gmail.com> btrfs: fix double free in create_space_info() error path Yochai Eisenrich <yochaie(a)sweet.security> btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak Qu Wenruo <wqu(a)suse.com> btrfs: do not mark inode incompressible after inline attempt fails Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm: remove child devices when apm is removed Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error Joseph Salisbury <joseph.salisbury(a)oracle.com> ASoC: fsl_easrc: fix comment typo Li Jian <lazycat-xiao(a)foxmail.com> ASoC: ES8389: convert to devm_clk_get_optional() to get clock Tommaso Soncin <soncintommaso(a)gmail.com> ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table Shrikanth Hegde <sshegde(a)linux.ibm.com> cpuidle: powerpc: avoid double clear when breaking snooze Conor Dooley <conor.dooley(a)microchip.com> clk: microchip: mpfs-ccc: fix out of bounds access during output registration Stefan Eichenberger <stefan.eichenberger(a)toradex.com> clk: imx: imx8-acm: fix flags for acm clocks Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/fprobe: Check the same type fprobe on table as the unregistered one Steven Rostedt <rostedt(a)goodmis.org> tracing/probes: Limit size of event probe to 3K Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/fprobe: Unregister fprobe even if memory allocation fails Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/fprobe: Remove fprobe from hash in failure path Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/fprobe: Avoid kcalloc() in rcu_read_lock section Johan Hovold <johan(a)kernel.org> spi: topcliff-pch: fix use-after-free on unbind Johan Hovold <johan(a)kernel.org> spi: topcliff-pch: fix controller deregistration Thorsten Blum <thorsten.blum(a)linux.dev> thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp Thorsten Blum <thorsten.blum(a)linux.dev> thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> thermal: core: Free thermal zone ID later during removal David Gow <david(a)davidgow.net> x86/boot/e820: Re-enable BIOS fallback if e820 table is empty Michael Bommarito <michael.bommarito(a)gmail.com> udf: reject descriptors with oversized CRC length David Carlier <devnexen(a)gmail.com> tracefs: Fix default permissions not being applied on initial mount Conor Dooley <conor.dooley(a)microchip.com> spi: microchip-core-qspi: control built-in cs manually Conor Dooley <conor.dooley(a)microchip.com> spi: microchip-core-qspi: don't attempt to transmit during emulated read-only dual/quad operations Johan Hovold <johan(a)kernel.org> spi: microchip-core-spi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: microchip-core-qspi: fix controller deregistration Guangshuo Li <lgs201920130244(a)gmail.com> ice: fix double free in ice_sf_eth_activate() error path Mingming Cao <mmc(a)linux.ibm.com> ibmveth: Disable GSO for packets with small MSS Dexuan Cui <decui(a)microsoft.com> hv_sock: Return -EIO for malformed/short packets Dexuan Cui <decui(a)microsoft.com> hv_sock: Report EOF instead of -EIO for FIN Hamza Mahfooz <hamzamahfooz(a)linux.microsoft.com> hv_sock: fix ARM64 support Thomas Zimmermann <tzimmermann(a)suse.de> hv: Select CONFIG_SYSFB only for CONFIG_HYPERV_VMBUS Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> gpio: of: clear OF_POPULATED on hog nodes in remove path Thomas Zimmermann <tzimmermann(a)suse.de> fbcon: Avoid OOB font access if console rotation fails Xu Yang <xu.yang_2(a)nxp.com> extcon: ptn5150: handle pending IRQ events during system resume Shyam Prasad N <sprasad(a)microsoft.com> cifs: change_conf needs to be called for session setup Shyam Prasad N <sprasad(a)microsoft.com> cifs: abort open_cached_dir if we don't request leases Jens Axboe <axboe(a)kernel.dk> block: only read from sqe on initial invocation of blkdev_uring_cmd() Damien Le Moal <dlemoal(a)kernel.org> block: fix zone write plug removal Naman Jain <namjain(a)linux.microsoft.com> block: add pgmap check to biovec_phys_mergeable Wentao Liang <vulab(a)iscas.ac.cn> pmdomain: mediatek: fix use-after-free in scpsys_get_bus_protection_legacy() Breno Leitao <leitao(a)debian.org> arm64/fpsimd: ptrace: zero target's fpsimd_state, not the tracer's Jiexun Wang <wangjiexun2025(a)gmail.com> af_unix: Reject SIOCATMARK on non-stream sockets Myeonghun Pak <mhun512(a)gmail.com> hwmon: (corsair-psu) Close HID device on probe errors Johan Hovold <johan(a)kernel.org> clk: rk808: fix OF node reference imbalance Sanman Pradhan <psanman(a)juniper.net> hwmon: (ltc2992) Fix u32 overflow in power read path Sanman Pradhan <psanman(a)juniper.net> hwmon: (ltc2992) Clamp threshold writes to hardware range Ivan Hu <ivan.hu(a)canonical.com> x86/efi: Fix graceful fault handling after FPU softirq changes Hongling Zeng <zenghongling(a)kylinos.cn> parisc: Fix IRQ leak in LASI driver Tzung-Bi Shih <tzungbi(a)kernel.org> platform/chrome: cros_ec_typec: Init mutex in Thunderbolt registration Colin Walters <walters(a)verbum.org> ovl: fix verity lazy-load guard broken by fsverity_active() semantic change Pavitra Jha <jhapavitra98(a)gmail.com> net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler Nan Li <tonanli66(a)gmail.com> net/rds: handle zerocopy send cleanup before the message is queued Breno Leitao <leitao(a)debian.org> netpoll: pass buffer size to egress_dev() to avoid MAC truncation Jiawen Wu <jiawenwu(a)trustnetic.com> net: libwx: use request_irq for VF misc interrupt Maoyi Xie <maoyixie.tju(a)gmail.com> ip6_gre: Use cached t->net in ip6erspan_changelink(). Jiawen Wu <jiawenwu(a)trustnetic.com> net: libwx: fix VF illegal register access Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> pseries/papr-hvpipe: Fix the usage of copy_to_user() Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> pseries/papr-hvpipe: Fix & simplify error handling in papr_hvpipe_init() Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> pseries/papr-hvpipe: Fix null ptr deref in papr_hvpipe_dev_create_handle() Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> pseries/papr-hvpipe: Prevent kernel stack memory leak to userspace Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> pseries/papr-hvpipe: Fix race with interrupt handler SeungJu Cheon <suunj1331(a)gmail.com> sound: ua101: fix division by zero at probe Karol Wachowski <karol.wachowski(a)linux.intel.com> accel/ivpu: Disallow re-exporting imported GEM objects Thomas Gleixner <tglx(a)kernel.org> selftests/rseq: Expand for optimized RSEQ ABI v2 Thomas Gleixner <tglx(a)kernel.org> selftests/rseq: Validate legacy behavior Thomas Gleixner <tglx(a)kernel.org> selftests/rseq: Skip tests if time slice extensions are not available Thomas Gleixner <tglx(a)kernel.org> selftests/rseq: Make registration flexible for legacy and optimized mode Thomas Gleixner <tglx(a)kernel.org> rseq: Don't advertise time slice extensions if disabled Thomas Gleixner <tglx(a)kernel.org> rseq: Protect rseq_reset() against interrupts Thomas Gleixner <tglx(a)kernel.org> rseq: Set rseq::cpu_id_start to 0 on unregistration Mark Brown <broonie(a)kernel.org> selftests/rseq: Don't run tests with runner scripts outside of the scripts Dapeng Mi <dapeng1.mi(a)linux.intel.com> perf/x86/intel: Improve validation and configuration of ACR masks Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: skip inactive subflows Kai Zen <kai.aizen.dev(a)gmail.com> net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo Xianglai Li <lixianglai(a)loongson.cn> LoongArch: KVM: Compile switch.S directly into the kernel Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Fix SYM_SIGFUNC_START definition for 32BIT Sang-Heon Jeon <ekffu200098(a)gmail.com> mm/hugetlb_cma: round up per_node before logging it Kevin Brodsky <kevin.brodsky(a)arm.com> arm64: signal: Preserve POR_EL0 if poe_context is missing Tudor Ambarus <tudor.ambarus(a)linaro.org> mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show() Fuad Tabba <tabba(a)google.com> KVM: arm64: Fix kvm_vcpu_initialized() macro parameter Miklos Szeredi <mszeredi(a)redhat.com> fanotify: fix false positive on permission events Johan Hovold <johan(a)kernel.org> staging: vme_user: fix root device leak on init failure Shyam Sunder Reddy Padira <shyamsunderreddypadira(a)gmail.com> staging: rtl8723bs: os_dep: avoid NULL pointer dereference in rtw_cbuf_alloc Johan Hovold <johan(a)kernel.org> spi: s3c64xx: fix NULL-deref on driver unbind Johan Hovold <johan(a)kernel.org> spi: tegra20-sflash: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: zynqmp-gqspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: tegra114: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sun6i: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: ti-qspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: zynq-qspi: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: sun4i: fix controller deregistration Johan Hovold <johan(a)kernel.org> spi: syncuacer: fix controller deregistration Gary Guo <gary(a)garyguo.net> rust: pin-init: internal: move alignment check to `make_field_check` Miguel Ojeda <ojeda(a)kernel.org> rust: allow `clippy::collapsible_if` globally Miguel Ojeda <ojeda(a)kernel.org> rust: allow `clippy::collapsible_match` globally Eliot Courtney <ecourtney(a)nvidia.com> rust: drm: gem: clean up GEM state in init failure case Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() Siwei Zhang <oss(a)fourdim.xyz> Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt David Carlier <devnexen(a)gmail.com> Bluetooth: hci_conn: fix potential UAF in create_big_sync Tristan Madani <tristan(a)talencesecurity.com> Bluetooth: btmtk: validate WMT event SKB length before struct access Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: virtio_bt: validate rx pkt_type header length Michael Bommarito <michael.bommarito(a)gmail.com> Bluetooth: virtio_bt: clamp rx length before skb_put Tao Cui <cuitao(a)kylinos.cn> LoongArch: KVM: Fix missing EMULATE_FAIL in kvm_emu_mmio_read() Jens Axboe <axboe(a)kernel.dk> io_uring/tw: serialize ctx->retry_llist with ->uring_lock Martin Michaelis <code(a)mgjm.de> io_uring/kbuf: support min length left for incremental buffers Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: allow multiple opens of /sys/fs/selinux/policy Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: prune /sys/fs/selinux/user Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: prune /sys/fs/selinux/disable Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: prune /sys/fs/selinux/checkreqprot Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: shrink critical section in sel_write_load() David Windsor <dwindsor(a)gmail.com> selinux: don't reserve xattr slot when we won't fill it Zongyao Chen <ZongYao.Chen(a)linux.alibaba.com> selinux: use sk blob accessor in socket permission helpers Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: fix avdcache auditing Michael Bommarito <michael.bommarito(a)gmail.com> xfrm: ah: account for ESN high bits in async callbacks Yilin Zhu <zylzyl2333(a)gmail.com> ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() Michal Kosiorek <mkosiorek121(a)gmail.com> xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete Ruijie Li <ruijieli51(a)gmail.com> xfrm: provide message size for XFRM_MSG_MAPPING Tejun Heo <tj(a)kernel.org> sched_ext: Read scx_root under scx_cgroup_ops_rwsem in cgroup setters Ard Biesheuvel <ardb(a)kernel.org> x86/efi: Restore IRQ state in EFI page fault handler Sourabh Jain <sourabhjain(a)linux.ibm.com> powerpc/kdump: fix KASAN sanitization flag for core_$(BITS).o Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: seq: Fix UMP group 16 filtering Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: core: Serialize deferred fasync state checks Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: firewire-tascam: Do not drop unread control events Yuriy Padlyak <yuriypadlyak(a)gmail.com> ALSA: hda/realtek: Fix speaker silence after S3 resume on Xiaomi Mi Laptop Pro 15 Takashi Iwai <tiwai(a)suse.de> ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: hda: cs35l56: Propagate ASP TX source control errors Xu Yang <xu.yang_2(a)nxp.com> usb: typec: tcpm: fix debug accessory mode detection for sink ports Felix Gu <ustc.gu(a)gmail.com> usb: ulpi: fix memory leak on ulpi_register() error paths Fabio Porcedda <fabio.porcedda(a)gmail.com> USB: serial: option: add Telit Cinterion LE910Cx compositions Aaro Koskinen <aaro.koskinen(a)iki.fi> USB: omap_udc: DMA: Don't enable burst 4 mode Amit Sunil Dhamne <amitsd(a)google.com> usb: typec: tcpm: reset internal port states on soft reset AMS Selvarasu Ganesan <selvarasu.g(a)samsung.com> usb: dwc3: Move GUID programming after PHY initialization Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Fix UAC3 cluster descriptor size check Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: midi2: Restart output URBs on resume Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: usblp: fix heap leak in IEEE 1284 device ID via short response Marek Szyprowski <m.szyprowski(a)samsung.com> wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task Tristan Madani <tristan(a)talencesecurity.com> wifi: b43: enforce bounds check on firmware key index in b43_rx() Johannes Berg <johannes.berg(a)intel.com> wifi: mac80211: remove station if connection prep fails Jiri Slaby (SUSE) <jirislaby(a)kernel.org> wifi: ath5k: do not access array OOB Benjamin Berg <benjamin.berg(a)intel.com> wifi: mac80211: use safe list iteration in radar detect work Jeongjun Park <aha310510(a)gmail.com> wifi: rsi: fix kthread lifetime race between self-exit and external-stop Catherine <enderaoelyther(a)gmail.com> wifi: mac80211: drop stray 'static' from fast-RX rx_result Tristan Madani <tristan(a)talencesecurity.com> wifi: b43legacy: enforce bounds check on firmware key index in RX path Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work Leon Yen <leon.yen(a)mediatek.com> wifi: mt76: mt7921: fix a potential clc buffer length underflow Ming Yen Hsieh <mingyen.hsieh(a)mediatek.com> wifi: mt76: mt7925: fix incorrect length field in txpower command Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7925: fix AMPDU state handling in mt7925_tx_check_aggr Jann Horn <jannh(a)google.com> exit: prevent preemption of oopsing TASK_DEAD task Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked Yi Kuo <yi(a)yikuo.dev> smb: client/smbdirect: fix MR registration for coalesced SG lists Qingfang Deng <qingfang.deng(a)linux.dev> flow_dissector: do not dissect PPPoE PFC frames Sean Christopherson <seanjc(a)google.com> KVM: x86: Fix shadow paging use-after-free due to unexpected GFN DaeMyung Kang <charsyam(a)gmail.com> ksmbd: rewrite stop_sessions() with restartable iteration Johan Hovold <johan(a)kernel.org> spi: rockchip: fix controller deregistration Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7925: fix incorrect TLV length in CLC command Mark Brown <broonie(a)kernel.org> ASoC: SOF: Don't allow pointer operations on unconfigured streams Sina Hassani <sina(a)openai.com> iommufd: Fix a race with concurrent allocation and unmap David Carlier <devnexen(a)gmail.com> tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() Shivam Kalra <shivamkalra98(a)zohomail.in> ACPI: video: force native backlight on HP OMEN 16 (8A44) Jinjie Ruan <ruanjinjie(a)huawei.com> ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug Jan Schär <jan(a)jschaer.ch> ACPI: video: Add backlight=native quirk for Dell OptiPlex 7770 AIO Guangshuo Li <lgs201920130244(a)gmail.com> ACPI: scan: Use acpi_dev_put() in object add error paths Breno Leitao <leitao(a)debian.org> ACPI: arm64: cpuidle: Tolerate platforms with no deep PSCI idle states Rajat Gupta <rajgupt(a)qti.qualcomm.com> fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free Corey Minyard <corey(a)minyard.net> ipmi:si: Return state to normal if message allocation fails Corey Minyard <corey(a)minyard.net> ipmi: Check event message buffer response for bad data Corey Minyard <corey(a)minyard.net> ipmi: Add limits to event and receive message requests Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() ------------- Diffstat: .../ABI/{obsolete => removed}/sysfs-selinux-user | 0 Makefile | 6 +- arch/arm64/include/asm/kvm_host.h | 2 +- arch/arm64/kernel/ptrace.c | 4 +- arch/arm64/kernel/signal.c | 54 +++- arch/arm64/kvm/arm.c | 4 + arch/arm64/kvm/config.c | 17 +- arch/arm64/kvm/hyp/nvhe/pkvm.c | 38 ++- arch/arm64/kvm/hyp/nvhe/setup.c | 8 +- arch/arm64/kvm/vgic/vgic-mmio-v2.c | 2 +- arch/arm64/kvm/vgic/vgic-mmio-v3.c | 2 +- arch/loongarch/Kbuild | 2 +- arch/loongarch/include/asm/asm-prototypes.h | 20 ++ arch/loongarch/include/asm/kvm_host.h | 3 - arch/loongarch/include/asm/linkage.h | 2 +- arch/loongarch/kvm/Makefile | 3 +- arch/loongarch/kvm/exit.c | 1 + arch/loongarch/kvm/interrupt.c | 14 ++ arch/loongarch/kvm/main.c | 35 +-- arch/loongarch/kvm/mmu.c | 2 +- arch/loongarch/kvm/switch.S | 22 +- arch/loongarch/kvm/timer.c | 10 +- arch/loongarch/kvm/vm.c | 2 +- arch/loongarch/pci/acpi.c | 5 + arch/loongarch/pci/pci.c | 3 + arch/powerpc/kexec/Makefile | 2 +- arch/powerpc/platforms/pseries/papr-hvpipe.c | 122 +++++---- arch/powerpc/sysdev/xive/common.c | 16 +- arch/riscv/kvm/vcpu_vector.c | 5 +- arch/s390/kernel/debug.c | 8 + arch/x86/events/core.c | 13 +- arch/x86/events/intel/core.c | 50 +++- arch/x86/events/perf_event.h | 10 + arch/x86/include/asm/efi.h | 3 +- arch/x86/include/asm/msr-index.h | 3 +- arch/x86/kernel/cpu/amd.c | 3 + arch/x86/kernel/e820.c | 6 +- arch/x86/kvm/hyperv.c | 2 +- arch/x86/kvm/lapic.c | 8 +- arch/x86/kvm/mmu/mmu.c | 35 ++- arch/x86/mm/fault.c | 2 +- arch/x86/platform/efi/quirks.c | 13 +- block/blk-zoned.c | 151 +++++------ block/blk.h | 2 + block/ioctl.c | 24 +- drivers/accel/ivpu/ivpu_drv.c | 21 ++ drivers/acpi/arm64/cpuidle.c | 10 +- drivers/acpi/cppc_acpi.c | 6 +- drivers/acpi/power.c | 2 +- drivers/acpi/scan.c | 2 +- drivers/acpi/video_detect.c | 16 ++ drivers/android/binder/range_alloc/array.rs | 1 - drivers/bluetooth/btmtk.c | 15 +- drivers/bluetooth/virtio_bt.c | 39 ++- drivers/char/ipmi/ipmi_si_intf.c | 70 ++++-- drivers/char/ipmi/ipmi_ssif.c | 23 +- drivers/clk/clk-rk808.c | 2 +- drivers/clk/imx/clk-imx8-acm.c | 3 +- drivers/clk/microchip/clk-mpfs-ccc.c | 6 +- drivers/cpuidle/cpuidle-powernv.c | 5 +- drivers/cpuidle/cpuidle-pseries.c | 5 +- drivers/crypto/caam/caamalg_qi2.c | 4 +- drivers/crypto/caam/caamhash.c | 4 +- .../crypto/intel/qat/qat_common/adf_accel_engine.c | 7 + .../qat/qat_common/icp_qat_fw_loader_handle.h | 1 + drivers/crypto/intel/qat/qat_common/qat_hal.c | 27 +- drivers/extcon/extcon-ptn5150.c | 14 ++ drivers/gpio/gpiolib-of.c | 9 +- drivers/hv/Kconfig | 2 +- drivers/hwmon/corsair-psu.c | 4 +- drivers/hwmon/ltc2992.c | 41 ++- drivers/infiniband/hw/hns/hns_roce_qp.c | 7 + drivers/infiniband/hw/ionic/ionic_ibdev.c | 2 +- drivers/infiniband/hw/mana/cq.c | 5 +- drivers/infiniband/hw/mana/qp.c | 16 +- drivers/infiniband/hw/mlx4/srq.c | 4 +- drivers/infiniband/hw/mlx5/main.c | 1 + drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 4 +- drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c | 2 +- drivers/infiniband/sw/rxe/rxe_recv.c | 11 + drivers/infiniband/sw/rxe/rxe_resp.c | 14 +- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 7 + drivers/iommu/intel/nested.c | 6 +- drivers/iommu/iommufd/eventq.c | 5 +- drivers/iommu/iommufd/io_pagetable.c | 10 + drivers/md/dm-ioctl.c | 6 +- drivers/md/dm-verity-fec.c | 113 ++++----- drivers/md/dm-verity-fec.h | 3 +- drivers/md/persistent-data/dm-btree-remove.c | 8 + drivers/md/raid10.c | 2 + drivers/mmc/core/card.h | 11 + drivers/mmc/core/mmc.c | 12 + drivers/mmc/core/queue.c | 9 +- drivers/mmc/core/quirks.h | 12 + drivers/mtd/spi-nor/debugfs.c | 4 +- drivers/net/ethernet/ibm/ibmveth.c | 22 ++ drivers/net/ethernet/ibm/ibmveth.h | 1 + drivers/net/ethernet/intel/ice/ice_sf_eth.c | 2 + .../ethernet/marvell/octeon_ep_vf/octep_vf_rx.c | 36 ++- drivers/net/ethernet/mellanox/mlx4/srq.c | 13 +- drivers/net/ethernet/stmicro/stmmac/chain_mode.c | 2 +- drivers/net/ethernet/stmicro/stmmac/common.h | 2 +- drivers/net/ethernet/stmicro/stmmac/ring_mode.c | 2 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 41 +-- drivers/net/ethernet/wangxun/libwx/wx_hw.c | 7 +- drivers/net/ethernet/wangxun/libwx/wx_vf_common.c | 4 +- drivers/net/wireless/ath/ath5k/base.c | 3 +- drivers/net/wireless/broadcom/b43/xmit.c | 3 +- drivers/net/wireless/broadcom/b43legacy/xmit.c | 3 +- .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 6 +- drivers/net/wireless/mediatek/mt76/mt7921/main.c | 7 +- drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | 3 + drivers/net/wireless/mediatek/mt76/mt7925/mac.c | 6 +- drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 4 +- drivers/net/wireless/rsi/rsi_common.h | 5 +- drivers/net/wwan/t7xx/t7xx_modem_ops.c | 20 +- drivers/net/wwan/t7xx/t7xx_port_ctrl_msg.c | 18 +- drivers/net/wwan/t7xx/t7xx_port_proxy.h | 2 +- drivers/nvme/host/apple.c | 6 +- drivers/nvme/target/core.c | 2 +- drivers/nvme/target/tcp.c | 26 ++ drivers/parisc/lasi.c | 12 +- drivers/pci/pci.c | 7 +- drivers/pci/pcie/aer.c | 2 - drivers/pci/pcie/aspm.c | 17 +- drivers/pci/setup-res.c | 2 + drivers/platform/chrome/cros_typec_altmode.c | 1 + drivers/pmdomain/core.c | 10 +- drivers/pmdomain/mediatek/mtk-pm-domains.c | 10 +- drivers/power/supply/max17042_battery.c | 2 +- drivers/remoteproc/imx_rproc.c | 2 +- drivers/remoteproc/ti_k3_common.c | 2 +- drivers/scsi/mpt3sas/mpt3sas_scsih.c | 14 +- drivers/spi/spi-microchip-core-qspi.c | 103 ++++++-- drivers/spi/spi-microchip-core-spi.c | 4 +- drivers/spi/spi-rockchip.c | 4 +- drivers/spi/spi-s3c64xx.c | 5 - drivers/spi/spi-sun4i.c | 10 +- drivers/spi/spi-sun6i.c | 8 +- drivers/spi/spi-synquacer.c | 8 +- drivers/spi/spi-tegra114.c | 8 +- drivers/spi/spi-tegra20-sflash.c | 8 +- drivers/spi/spi-ti-qspi.c | 14 +- drivers/spi/spi-topcliff-pch.c | 11 +- drivers/spi/spi-zynq-qspi.c | 15 +- drivers/spi/spi-zynqmp-gqspi.c | 4 +- drivers/staging/rtl8723bs/os_dep/osdep_service.c | 3 +- drivers/staging/vme_user/vme_fake.c | 2 + drivers/target/target_core_configfs.c | 2 +- drivers/thermal/sprd_thermal.c | 4 +- drivers/thermal/thermal_core.c | 6 +- drivers/usb/class/usblp.c | 3 +- drivers/usb/common/ulpi.c | 5 +- drivers/usb/dwc3/core.c | 12 +- drivers/usb/gadget/udc/omap_udc.c | 4 - drivers/usb/serial/option.c | 4 + drivers/usb/typec/tcpm/tcpm.c | 27 +- drivers/video/fbdev/core/fbcon_rotate.c | 5 +- drivers/video/fbdev/udlfb.c | 31 ++- fs/btrfs/inode.c | 8 + fs/btrfs/ioctl.c | 5 +- fs/btrfs/space-info.c | 6 +- fs/f2fs/data.c | 28 ++- fs/f2fs/extent_cache.c | 17 +- fs/f2fs/f2fs.h | 5 + fs/f2fs/inline.c | 22 +- fs/f2fs/inode.c | 2 +- fs/f2fs/node.c | 95 +++---- fs/f2fs/super.c | 11 + fs/f2fs/sysfs.c | 10 +- fs/hfsplus/bfind.c | 51 ++++ fs/hfsplus/catalog.c | 4 +- fs/hfsplus/dir.c | 2 +- fs/hfsplus/hfsplus_fs.h | 9 + fs/hfsplus/super.c | 6 +- fs/isofs/export.c | 2 +- fs/isofs/rock.c | 9 + fs/notify/fsnotify.c | 2 +- fs/notify/mark.c | 18 +- fs/overlayfs/util.c | 2 +- fs/smb/client/cached_dir.c | 8 + fs/smb/client/cifsacl.c | 37 ++- fs/smb/client/smb2inode.c | 12 +- fs/smb/client/smb2misc.c | 3 +- fs/smb/client/smb2ops.c | 11 + fs/smb/client/smbdirect.c | 21 +- fs/smb/server/connection.c | 48 +++- fs/smb/server/connection.h | 1 + fs/tracefs/event_inode.c | 14 ++ fs/tracefs/inode.c | 6 +- fs/tracefs/internal.h | 3 + fs/udf/misc.c | 8 +- include/linux/fsnotify_backend.h | 1 + include/linux/if_vlan.h | 25 +- include/linux/mmc/card.h | 2 + include/linux/printk.h | 13 + include/linux/rseq.h | 2 + include/uapi/linux/io_uring.h | 3 +- include/uapi/linux/rseq.h | 5 +- include/video/udlfb.h | 1 + io_uring/kbuf.c | 8 +- io_uring/kbuf.h | 7 + io_uring/tw.c | 12 +- kernel/bpf/arena.c | 19 +- kernel/exit.c | 1 + kernel/rseq.c | 29 ++- kernel/sched/ext.c | 28 ++- kernel/sched/ext_idle.c | 12 +- kernel/trace/fprobe.c | 279 ++++++++++++--------- kernel/trace/trace_probe.c | 6 + kernel/trace/trace_probe.h | 4 +- kernel/tracepoint.c | 2 + lib/crc/Kconfig | 7 +- lib/crc/tests/crc_kunit.c | 28 ++- lib/crypto/mpi/mpicoder.c | 2 +- lib/scatterlist.c | 8 +- mm/damon/lru_sort.c | 85 ++++--- mm/damon/reclaim.c | 85 ++++--- mm/damon/stat.c | 30 ++- mm/damon/sysfs-schemes.c | 24 +- mm/hugetlb_cma.c | 1 + net/8021q/vlan_dev.c | 45 ++-- net/8021q/vlan_netlink.c | 10 +- net/8021q/vlanproc.c | 12 +- net/bluetooth/hci_conn.c | 19 +- net/bluetooth/hci_event.c | 29 ++- net/bluetooth/l2cap_sock.c | 9 + net/ceph/auth.c | 2 +- net/ceph/mon_client.c | 2 + net/core/flow_dissector.c | 13 +- net/core/netpoll.c | 23 +- net/core/rtnetlink.c | 1 + net/ipv4/ah4.c | 14 +- net/ipv6/ah6.c | 14 +- net/ipv6/ip6_gre.c | 5 +- net/ipv6/xfrm6_protocol.c | 4 +- net/mac80211/mlme.c | 9 +- net/mac80211/rx.c | 2 +- net/mac80211/util.c | 4 +- net/mptcp/fastopen.c | 4 +- net/mptcp/pm.c | 62 +++-- net/mptcp/pm_kernel.c | 14 +- net/mptcp/protocol.c | 3 +- net/mptcp/sockopt.c | 16 +- net/mptcp/subflow.c | 4 +- net/openvswitch/vport-netdev.c | 6 +- net/psp/psp_main.c | 42 +++- net/rds/message.c | 20 +- net/sched/sch_red.c | 2 +- net/unix/af_unix.c | 3 + net/vmw_vsock/hyperv_transport.c | 33 ++- net/xfrm/xfrm_state.c | 12 +- net/xfrm/xfrm_user.c | 1 + rust/kernel/drm/gem/mod.rs | 13 +- rust/pin-init/internal/src/init.rs | 184 +++++++------- rust/pin-init/src/__internal.rs | 28 ++- security/selinux/hooks.c | 38 ++- security/selinux/include/objsec.h | 4 +- security/selinux/include/security.h | 2 - security/selinux/selinuxfs.c | 196 +++------------ security/selinux/ss/services.c | 125 --------- sound/core/misc.c | 8 +- sound/core/oss/pcm_oss.c | 29 ++- sound/core/seq/seq_clientmgr.c | 2 +- sound/core/seq/seq_clientmgr.h | 5 +- sound/core/seq/seq_ump_client.c | 2 +- sound/firewire/tascam/tascam-hwdep.c | 1 + sound/hda/codecs/realtek/alc269.c | 19 ++ sound/hda/codecs/side-codecs/cs35l56_hda.c | 19 +- sound/soc/amd/yc/acp6x-mach.c | 14 ++ sound/soc/codecs/es8389.c | 2 +- sound/soc/fsl/fsl_easrc.c | 2 +- sound/soc/intel/boards/bytcr_wm5102.c | 1 + sound/soc/qcom/qdsp6/q6apm-dai.c | 1 + sound/soc/qcom/qdsp6/q6apm-lpass-dais.c | 2 +- sound/soc/qcom/qdsp6/q6apm.c | 3 + sound/soc/sof/compress.c | 3 + sound/usb/midi2.c | 9 +- sound/usb/misc/ua101.c | 7 + sound/usb/stream.c | 4 +- tools/arch/x86/include/asm/msr-index.h | 3 +- tools/testing/selftests/net/mptcp/mptcp_lib.sh | 16 +- tools/testing/selftests/net/mptcp/pm_netlink.sh | 20 +- tools/testing/selftests/rseq/Makefile | 21 +- tools/testing/selftests/rseq/check_optimized.c | 17 ++ tools/testing/selftests/rseq/legacy_check.c | 65 +++++ tools/testing/selftests/rseq/param_test.c | 25 +- tools/testing/selftests/rseq/rseq-abi.h | 7 +- tools/testing/selftests/rseq/rseq.c | 39 ++- tools/testing/selftests/rseq/rseq.h | 8 +- tools/testing/selftests/rseq/run_legacy_check.sh | 4 + tools/testing/selftests/rseq/run_param_test.sh | 39 +++ tools/testing/selftests/rseq/run_timeslice_test.sh | 14 ++ tools/testing/selftests/rseq/slice_test.c | 12 +- 294 files changed, 3041 insertions(+), 1615 deletions(-)

6 days, 4 hours

8
8
0 0

[PATCH 6.12 000/215] 6.12.86-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.12.86 release. There are 215 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 06 May 2026 13:50:52 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.86-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.12.86-rc1 Kai Ma <k4729.23098(a)gmail.com> netfilter: reject zero shift in nft_bitwise Andrea Mayer <andrea.mayer(a)uniroma2.it> net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels Deepanshu Kartikey <kartikey406(a)gmail.com> ALSA: caiaq: fix usb_dev refcount leak on probe failure Arjan van de Ven <arjan(a)linux.intel.com> drm/amdgpu: fix zero-size GDS range init on RDNA4 Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> ipv6: rpl: reserve mac_len headroom when recompressed SRH grows David Howells <dhowells(a)redhat.com> rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets Takashi Iwai <tiwai(a)suse.de> ALSA: caiaq: Don't abort when no input device is available Takashi Iwai <tiwai(a)suse.de> ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path Douglas Anderson <dianders(a)chromium.org> driver core: Add kernel-doc for DEV_FLAG_COUNT enum value Xiang Mei <xmei5(a)asu.edu> net: bonding: fix use-after-free in bond_xmit_broadcast() Yucheng Lu <kanolyc(a)gmail.com> crypto: authencesn - reject short ahash digests during instance creation Anthony Yznaga <anthony.yznaga(a)oracle.com> mm: prevent droppable mappings from being locked Johan Hovold <johan(a)kernel.org> spi: fix resource leaks on device setup failure Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Limit the total number of nodes Yuan Zhaoming <yuanzm2(a)lenovo.com> net: mctp: fix don't require received header reserved bits to be zero Zhengchuan Liang <zcliangcn(a)gmail.com> net: bridge: use a stable FDB dst snapshot in RCU readers Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Limit the maximum number of lookups Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Limit the maximum server registration per node David Howells <dhowells(a)redhat.com> rxrpc: Fix potential UAF after skb_unshare() failure Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: frequency: admv1013: fix NULL pointer dereference on str Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: frequency: admv1013: add dev variable Naman Jain <namjain(a)linux.microsoft.com> block: relax pgmap check in bio_add_page for compatible zone device pages Long Li <longli(a)microsoft.com> RDMA/mana_ib: Disable RX steering on RSS QP destroy Oliver Neukum <oneukum(a)suse.com> media: rc: igorplugusb: heed coherency rules Thorsten Blum <thorsten.blum(a)linux.dev> ALSA: aoa: Skip devices with no codecs in i2sbus_resume() Oliver Neukum <oneukum(a)suse.com> media: rc: ttusbir: respect DMA coherency rules Shigeru Yoshida <syoshida(a)redhat.com> mm/zsmalloc: copy KMSAN metadata in zs_page_migrate() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: aoa: i2sbus: clear stale prepared state Takashi Iwai <tiwai(a)suse.de> ALSA: aoa: Use guard() for mutex locks Usama Arif <usama.arif(a)linux.dev> mm: migrate: requeue destination folio on deferred split queue David Hildenbrand <david(a)redhat.com> mm/migrate: move movable_ops page handling out of move_to_new_folio() David Hildenbrand <david(a)redhat.com> mm/migrate: factor out movable_ops page handling into migrate_movable_ops_page() Daniel Hodges <git(a)danielhodges.dev> wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() Sean Wang <sean.wang(a)mediatek.com> wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling Sean Wang <sean.wang(a)mediatek.com> wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> thermal: core: Fix thermal zone governor cleanup issues DaeMyung Kang <charsyam(a)gmail.com> ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id() Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: replace connection list with hash table Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: use msleep instaed of schedule_timeout_interruptible() Chao Yu <chao(a)kernel.org> f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally Alistair Popple <apopple(a)nvidia.com> lib: test_hmm: evict device pages on file close to avoid use-after-free Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io() Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: validate the whole DACL before rewriting it in cifsacl Andrea Mayer <andrea.mayer(a)uniroma2.it> seg6: fix seg6 lwtunnel output redirect for L2 reduced encap mode Yang Xiuwei <yangxiuwei(a)kylinos.cn> scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails Keenan Dong <keenanat2000(a)gmail.com> rtmutex: Use waiter::task instead of current in remove_waiter() Tobias Gaertner <tob.gaertner(a)me.com> ntfs3: fix integer overflow in run_unpack() volume boundary check Tobias Gaertner <tob.gaertner(a)me.com> ntfs3: add buffer boundary checks to run_unpack() Steven Rostedt <rostedt(a)goodmis.org> ktest: Fix the month in the name of the failure directory Chen Zhao <chezhao(a)nvidia.com> IB/core: Fix zero dmac race in neighbor resolution Max Kellermann <max.kellermann(a)ionos.com> ceph: only d_add() negative dentries when they are unhashed Junrui Luo <moonafterrain(a)outlook.com> dm mirror: fix integer overflow in create_dirty_log() Gustavo A. R. Silva <gustavoars(a)kernel.org> crypto: nx - Fix packed layout in struct nx842_crypto_header Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-sha204a - Fix uninitialized data access on OTP read error Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-sha204a - Fix error codes in OTP reads Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-tdes - fix DMA sync direction Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> crypto: ccree - fix a memory leak in cc_mac_digest() Thomas Fourier <fourier.thomas(a)gmail.com> crypto: hisilicon - Fix dma_unmap_single() direction Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-ecc - Release client on allocation failure Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup Eric Biggers <ebiggers(a)kernel.org> crypto: arm64/aes - Fix 32-bit aes_mac_update() arg treated as 64-bit Johan Hovold <johan(a)kernel.org> can: ucan: fix devres lifetime Qiang Yu <qiang.yu(a)oss.qualcomm.com> bus: mhi: host: pci_generic: Switch to async power up to avoid boot delays Shuvam Pandey <shuvampandey1(a)gmail.com> Bluetooth: hci_event: fix potential UAF in SSP passkey handlers Cengiz Can <cengiz.can(a)canonical.com> apparmor: use target task's context in apparmor_getprocattr() Brian Mak <makb(a)juniper.net> mfd: core: Preserve OF node when ACPI handle is present Yiyang Chen <cyyzero16(a)gmail.com> taskstats: set version in TGID exit notifications Zhenzhong Wu <jt26wzz(a)gmail.com> tcp: call sk_data_ready() after listener migration Yi Cong <yicong(a)kylinos.cn> wifi: rtl8xxxu: fix potential use of uninitialized value Dave Hansen <dave.hansen(a)linux.intel.com> x86/cpu: Disable FRED when PTI is forced on Chia-Ming Chang <chiamingc(a)synology.com> inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails Aditya Garg <gargaditya08(a)live.com> HID: apple: ensure the keyboard backlight is off if suspending Arnd Bergmann <arnd(a)arndb.de> check-uapi: link into shared objects Junrui Luo <moonafterrain(a)outlook.com> md/raid5: validate payload size before accessing journal metadata Chia-Ming Chang <chiamingc(a)synology.com> md/raid5: fix soft lockup in retry_aligned_read() David (Ming Qiang) Wu <David.Wu3(a)amd.com> amdgpu/jpeg: fix deepsleep register for jpeg 5_0_0 and 5_0_2 Sanjaikumar V S <sanjaikumar.vs(a)dicortech.com> mtd: spi-nor: sst: Fix write enable before AAI sequence Sohei Koyama <skoyama(a)ddn.com> ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() Deepanshu Kartikey <kartikey406(a)gmail.com> ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access Rong Bao <rong.bao(a)csmantle.top> perf annotate: Use jump__delete when freeing LoongArch jumps Jens Axboe <axboe(a)kernel.dk> io_uring/poll: fix multishot recv missing EOF on wakeup race Sean Christopherson <seanjc(a)google.com> KVM: nSVM: Always intercept VMMCALL when L2 is active Kevin Cheng <chengkev(a)google.com> KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Add missing consistency check for nCR3 validity Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Add missing consistency check for EFER, CR0, CR4, and CS Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Clear tracking of L1->L2 NMI and soft IRQ on nested #VMEXIT Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Clear EVENTINJ fields in vmcb12 on nested #VMEXIT Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID) Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Always inject a #GP if mapping VMCB12 fails on nested VMRUN Yosry Ahmed <yosry.ahmed(a)linux.dev> KVM: nSVM: Use vcpu->arch.cr2 when updating vmcb12 on nested #VMEXIT Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode Sean Christopherson <seanjc(a)google.com> KVM: SVM: Explicitly mark vmcb01 dirty after modifying VMCB intercepts Kevin Cheng <chengkev(a)google.com> KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Sync NextRIP to cached vmcb12 after VMRUN of L2 Yosry Ahmed <yosry.ahmed(a)linux.dev> KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state Sean Christopherson <seanjc(a)google.com> KVM: x86: Defer non-architectural deliver of exception payload to userspace read Denis M. Karpov <komlomal(a)gmail.com> userfaultfd: allow registration of ranges below mmap_min_addr SeongJae Park <sj(a)kernel.org> mm/damon/core: use time_in_range_open() for damos quota window start Johan Hovold <johan(a)kernel.org> rtc: ntxec: fix OF node reference imbalance Jacqueline Wong <jacqwong(a)google.com> tpm: tpm_tis: stop transmit if retries are exhausted Jacqueline Wong <jacqwong(a)google.com> tpm: tpm_tis: add error logging for data transfer Gunnar Kudrjavets <gunnarku(a)amazon.com> tpm: Use kfree_sensitive() to free auth session in tpm_dev_release() Gunnar Kudrjavets <gunnarku(a)amazon.com> tpm: Fix auth session leak in tpm2_get_random() error path Viorel Suman (OSS) <viorel.suman(a)oss.nxp.com> pwm: imx-tpm: Count the number of enabled channels in probe Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos - rename first/last to first_desc/last_desc Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos - fix SEC1 32k ahash request limitation Thomas Zimmermann <tzimmermann(a)suse.de> firmware: google: framebuffer: Do not unregister platform device Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> xfs: fix a resource leak in xfs_alloc_buftarg() Francesco Dolcini <francesco.dolcini(a)toradex.com> arm64: dts: ti: am62-verdin: Enable pullup for eMMC data pins Shawn Lin <shawn.lin(a)rock-chips.com> mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration Bin Liu <b-liu(a)ti.com> mmc: block: use single block write in retry Ryan Roberts <ryan.roberts(a)arm.com> randomize_kstack: Maintain kstack_offset per task Sanman Pradhan <psanman(a)juniper.net> hwmon: (pt5161l) Fix bugs in pt5161l_read_block_data() Krzysztof Kozlowski <krzysztof.kozlowski(a)oss.qualcomm.com> power: supply: axp288_charger: Do not cancel work before initializing it Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Show CPU vulnerabilites correctly Arnd Bergmann <arnd(a)arndb.de> tpm: avoid -Wunused-but-set-variable Nathan Chancellor <nathan(a)kernel.org> extract-cert: Wrap key_pass with '#ifdef USE_PKCS11_ENGINE' Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() Ruide Cao <caoruide123(a)gmail.com> ipv4: icmp: validate reply type before using icmp_pointers hkbinbin <hkbinbinbin(a)gmail.com> RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv Luca Ceresoli <luca.ceresoli(a)bootlin.com> drm/arcpgu: fix device node leak Marek Vasut <marex(a)nabladev.com> net: ks8851: Avoid excess softirq scheduling Breno Leitao <leitao(a)debian.org> netconsole: avoid out-of-bounds access on empty string in trim_newline() Marek Vasut <marex(a)nabladev.com> net: ks8851: Reinstate disabling of BHs around IRQ handler Ruijie Li <ruijieli51(a)gmail.com> net/smc: avoid early lgr access in smc_clc_wait_msg Jiawen Wu <jiawenwu(a)trustnetic.com> net: txgbe: fix firmware version check Ao Zhou <draw51280(a)163.com> net: rds: fix MR cleanup on copy error Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Free the node during ctrl_cmd_bye() Robert Marko <robert.marko(a)sartura.hr> arm64: dts: marvell: uDPU: add ethernet aliases Yiyang Chen <cyyzero16(a)gmail.com> tools/accounting: handle truncated taskstats netlink messages David Howells <dhowells(a)redhat.com> rxrpc: Fix re-decryption of RESPONSE packets David Howells <dhowells(a)redhat.com> rxrpc: Fix rxkad crypto unalignment handling David Howells <dhowells(a)redhat.com> rxrpc: Fix memory leaks in rxkad_verify_response() Jonathan Santos <Jonathan.Santos(a)analog.com> iio: adc: ad7768-1: fix one-shot mode data acquisition Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: pcmtest: Fix resource leaks in module init error paths Guangshuo Li <lgs201920130244(a)gmail.com> ALSA: pcmtest: fix reference leak on failed device registration Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: 6fire: Fix input volume change detection Takashi Iwai <tiwai(a)suse.de> ALSA: caiaq: Handle probe errors properly Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: caiaq: Fix control_put() result and cache rollback Takashi Iwai <tiwai(a)suse.de> ALSA: core: Fix potential data race at fasync handling Jens Axboe <axboe(a)kernel.dk> io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE Longxuan Yu <ylong030(a)ucr.edu> io_uring/poll: fix signed comparison in io_poll_get_ownership() David Lechner <dlechner(a)baylibre.com> iio: adc: ti-ads7950: use iio_push_to_buffers_with_ts_unaligned() Pavel Begunkov <asml.silence(a)gmail.com> io_uring/timeout: check unused sqe fields Damien Le Moal <dlemoal(a)kernel.org> block: fix zone write plugs refcount handling in disk_zone_wplug_schedule_bio_work() Dawei Feng <dawei.feng(a)seu.edu.cn> rbd: fix null-ptr-deref when device_add_disk() fails Mickaël Salaün <mic(a)digikod.net> selftests/landlock: Fix format warning for __u64 in net_test Simon Liebold <simonlie(a)amazon.de> selftests/mqueue: Fix incorrectly named file Joseph Salisbury <joseph.salisbury(a)oracle.com> sched: Use u64 for bandwidth ratio calculations Ben Levinsky <ben.levinsky(a)amd.com> remoteproc: xlnx: Only access buffer information if IPI is buffered Helge Deller <deller(a)gmx.de> parisc: _llseek syscall is only available for 32-bit userspace Robert Beckett <bob.beckett(a)collabora.com> nvme: respect NVME_QUIRK_DISABLE_WRITE_ZEROES when wzsl is set Robert Beckett <bob.beckett(a)collabora.com> nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4 James Kim <james010kim(a)gmail.com> mtd: docg3: fix use-after-free in docg3_release() Marek Vasut <marex(a)nabladev.com> mfd: stpmic1: Attempt system shutdown twice in case PMIC is confused Josh Hunt <johunt(a)akamai.com> md/raid10: fix deadlock with check operation and nowait requests Zhang Yi <yi.zhang(a)huawei.com> jbd2: fix deadlock in jbd2_journal_cancel_revoke() Gao Xiang <xiang(a)kernel.org> erofs: fix the out-of-bounds nameoff handling for trailing dirents Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes Harin Lee <me(a)harin.net> ALSA: ctxfi: Add fallback to default RSR for S/PDIF Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: aoa: i2sbus: fix OF node lifetime handling Vasiliy Kovalev <kovalev(a)altlinux.org> ext2: reject inodes with zero i_nlink and valid mode in ext2_iget() Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Fix use-after-free in driver remove() Chen Ni <nichen(a)iscas.ac.cn> media: i2c: imx219: Check return value of devm_gpiod_get_optional() in imx219_probe() Josh Law <objecting(a)objecting.org> lib/ts_kmp: fix integer overflow in pattern length calculation Daniel Hodges <git(a)danielhodges.dev> PCI: epf-mhi: Return 0, not remaining timeout, when eDMA ops complete Rong Zhang <i(a)rong.moe> Revert "ALSA: usb: Increase volume range that triggers a warning" Koichiro Den <den(a)valinux.co.jp> PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-sha204a - Fix OTP sysfs read and error handling Fan Wu <fanwu01(a)zju.edu.cn> media: mtk-jpeg: fix use-after-free in release path due to uncancelled work Luxiao Xu <rakukuip(a)gmail.com> net: strparser: fix skb_head leak in strp_abort_strp() Zhengchuan Liang <zcliangcn(a)gmail.com> net: caif: clear client service pointer on teardown Ziqing Chen <chenziqing(a)xiaomi.com> ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() Ming Qian <ming.qian(a)oss.nxp.com> media: amphion: Fix race between m2m job_abort and device_run Sanman Pradhan <psanman(a)juniper.net> hwmon: (powerz) Fix missing usb_kill_urb() on signal interrupt Wentao Liang <vulab(a)iscas.ac.cn> of: unittest: fix use-after-free in testdrv_probe() Wentao Liang <vulab(a)iscas.ac.cn> of: unittest: fix use-after-free in of_unittest_changeset() Herbert Xu <herbert(a)gondor.apana.org.au> crypto: pcrypt - Fix handling of MAY_BACKLOG requests Jinjiang Tu <tujinjiang(a)huawei.com> mm/memory_hotplug: fix hwpoisoned large folio handling in do_migrate_range() Johan Hovold <johan(a)kernel.org> spi: ch341: fix memory leaks on probe failures Johan Hovold <johan(a)kernel.org> spi: imx: fix use-after-free on unbind Michael Bommarito <michael.bommarito(a)gmail.com> um: drivers: call kernel_strrchr() explicitly in cow_user.c Prasanna Kumar T S M <ptsm(a)linux.microsoft.com> vfio/cdx: Fix NULL pointer dereference in interrupt trigger path Alex Williamson <alex.williamson(a)nvidia.com> vfio/cdx: Serialize VFIO_DEVICE_SET_IRQS with a per-device mutex Fedor Pchelkin <pchelkin(a)ispras.ru> wifi: rtw88: check for PCI upstream bridge existence Sergey Senozhatsky <senozhatsky(a)chromium.org> zram: do not forget to endio for partial discard requests Heming Zhao <heming.zhao(a)suse.com> ocfs2: split transactions in dio completion to avoid credit exhaustion Douglas Anderson <dianders(a)chromium.org> device property: Make modifications of fwnode "flags" thread safe Jesse.Zhang <Jesse.Zhang(a)amd.com> drm/amdgpu: Limit BO list entry count to prevent resource exhaustion Tvrtko Ursulin <tvrtko.ursulin(a)igalia.com> drm/amdgpu: Use vmemdup_array_user in amdgpu_bo_create_list_entry_array Miguel Ojeda <ojeda(a)kernel.org> rust: init: fix `clippy::undocumented_unsafe_blocks` warnings Herbert Xu <herbert(a)gondor.apana.org.au> padata: Remove comment for reorder_work Herbert Xu <herbert(a)gondor.apana.org.au> padata: Fix pd UAF once and for all Anshuman Khandual <anshuman.khandual(a)arm.com> arm64/mm: Enable batched TLB flush in unmap_hotplug_range() Thomas Zimmermann <tzimmermann(a)suse.de> firmware: google: framebuffer: Do not mark framebuffer as busy Miguel Ojeda <ojeda(a)kernel.org> kbuild: rust: allow `clippy::uninlined_format_args` David Carlier <devnexen(a)gmail.com> drm/nouveau: fix nvkm_device leak on aperture removal failure Douglas Anderson <dianders(a)chromium.org> driver core: Don't let a device probe until it's ready Tyllis Xu <livelycarpet87(a)gmail.com> ibmasm: fix heap over-read in ibmasm_send_i2o_message() Tyllis Xu <livelycarpet87(a)gmail.com> ibmasm: fix OOB reads in command_file_write due to missing size checks Tyllis Xu <livelycarpet87(a)gmail.com> misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt() Weigang He <geoffreyhe2(a)gmail.com> greybus: gb-beagleplay: fix sleep in atomic context in hdlc_tx_frames() Pengpeng Hou <pengpeng(a)iscas.ac.cn> greybus: gb-beagleplay: bound bootloader receive buffering Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> leds: qcom-lpg: Check for array overflow when selecting the high resolution Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> drm/nouveau: fix u32 overflow in pushbuf reloc bounds check Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> LoongArch: Add spectre boundry for syscall dispatch table Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Evaluate packsize caps at the right place Xu Yang <xu.yang_2(a)nxp.com> usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change Xu Yang <xu.yang_2(a)nxp.com> usb: chipidea: otg: not wait vbus drop if use role_switch Michal Pecio <michal.pecio(a)gmail.com> usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Avoid false E-MU sample-rate notifications Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES ------------- Diffstat: Makefile | 5 +- arch/arm64/boot/dts/marvell/armada-3720-uDPU.dtsi | 5 + arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi | 20 +- arch/arm64/crypto/aes-modes.S | 4 +- arch/arm64/mm/mmu.c | 36 ++- arch/loongarch/kernel/cpu-probe.c | 7 + arch/loongarch/kernel/syscall.c | 3 +- arch/parisc/kernel/syscalls/syscall.tbl | 2 +- arch/um/drivers/cow_user.c | 8 +- arch/x86/kvm/hyperv.h | 8 - arch/x86/kvm/svm/hyperv.h | 9 +- arch/x86/kvm/svm/nested.c | 55 ++-- arch/x86/kvm/svm/svm.c | 32 +- arch/x86/kvm/svm/svm.h | 1 + arch/x86/kvm/x86.c | 62 ++-- arch/x86/mm/pti.c | 5 + block/bio-integrity.c | 2 + block/bio.c | 14 +- block/blk-zoned.c | 12 +- block/blk.h | 19 ++ certs/extract-cert.c | 6 +- crypto/authencesn.c | 5 + crypto/pcrypt.c | 7 +- drivers/base/core.c | 39 ++- drivers/base/dd.c | 20 ++ drivers/block/rbd.c | 6 +- drivers/block/zram/zram_drv.c | 3 +- drivers/bus/imx-weim.c | 2 +- drivers/bus/mhi/host/pci_generic.c | 2 +- drivers/char/tpm/tpm-chip.c | 2 +- drivers/char/tpm/tpm2-cmd.c | 6 +- drivers/char/tpm/tpm_tis_core.c | 11 +- drivers/crypto/atmel-aes.c | 2 +- drivers/crypto/atmel-ecc.c | 1 + drivers/crypto/atmel-i2c.c | 4 +- drivers/crypto/atmel-sha204a.c | 37 ++- drivers/crypto/atmel-tdes.c | 8 +- drivers/crypto/ccree/cc_hash.c | 1 + drivers/crypto/hisilicon/sec/sec_algs.c | 2 +- drivers/crypto/nx/nx-842.h | 4 +- drivers/crypto/talitos.c | 340 +++++++++++++-------- drivers/firmware/google/framebuffer-coreboot.c | 12 +- drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c | 43 ++- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 3 + drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c | 52 +++- drivers/gpu/drm/nouveau/nouveau_drm.c | 2 +- drivers/gpu/drm/nouveau/nouveau_gem.c | 2 +- drivers/gpu/drm/tiny/arcpgu.c | 3 +- drivers/greybus/gb-beagleplay.c | 112 ++++++- drivers/hid/hid-apple.c | 2 + drivers/hwmon/powerz.c | 11 +- drivers/hwmon/pt5161l.c | 4 +- drivers/i2c/i2c-core-of.c | 2 +- drivers/iio/adc/ad7768-1.c | 9 +- drivers/iio/adc/ti-ads7950.c | 11 +- drivers/iio/frequency/admv1013.c | 90 +++--- drivers/infiniband/core/addr.c | 3 + drivers/infiniband/hw/mana/qp.c | 15 + drivers/infiniband/sw/rxe/rxe_recv.c | 3 +- drivers/leds/rgb/leds-qcom-lpg.c | 7 +- drivers/md/dm-raid1.c | 6 +- drivers/md/raid10.c | 4 +- drivers/md/raid5-cache.c | 48 ++- drivers/md/raid5.c | 8 +- drivers/media/i2c/imx219.c | 3 + drivers/media/platform/amphion/vpu_v4l2.c | 9 +- .../media/platform/mediatek/jpeg/mtk_jpeg_core.c | 1 + drivers/media/rc/igorplugusb.c | 16 +- drivers/media/rc/ttusbir.c | 13 +- drivers/mfd/mfd-core.c | 12 +- drivers/mfd/stpmic1.c | 20 +- drivers/misc/ibmasm/ibmasmfs.c | 7 + drivers/misc/ibmasm/lowlevel.c | 12 +- drivers/misc/ibmasm/remote.c | 5 + drivers/mmc/core/block.c | 12 +- drivers/mmc/core/queue.h | 3 + drivers/mmc/host/sdhci-of-dwcmshc.c | 19 +- drivers/mtd/devices/docg3.c | 3 +- drivers/mtd/spi-nor/sst.c | 13 + drivers/net/bonding/bond_main.c | 12 +- drivers/net/can/usb/ucan.c | 2 +- drivers/net/ethernet/micrel/ks8851.h | 6 +- drivers/net/ethernet/micrel/ks8851_common.c | 69 ++--- drivers/net/ethernet/micrel/ks8851_par.c | 15 +- drivers/net/ethernet/micrel/ks8851_spi.c | 11 +- drivers/net/ethernet/microsoft/mana/mana_en.c | 11 +- drivers/net/ethernet/wangxun/txgbe/txgbe_main.c | 3 +- drivers/net/netconsole.c | 2 + drivers/net/phy/mdio_bus.c | 4 +- drivers/net/wireless/marvell/mwifiex/init.c | 2 +- drivers/net/wireless/mediatek/mt76/mt792x_regs.h | 4 + drivers/net/wireless/mediatek/mt76/mt792x_usb.c | 51 +++- drivers/net/wireless/realtek/rtl8xxxu/core.c | 28 +- drivers/net/wireless/realtek/rtw88/pci.c | 3 +- drivers/nvme/host/core.c | 2 +- drivers/nvme/host/pci.c | 2 + drivers/of/base.c | 2 +- drivers/of/dynamic.c | 2 +- drivers/of/platform.c | 2 +- drivers/of/unittest.c | 4 +- drivers/pci/endpoint/functions/pci-epf-mhi.c | 4 + drivers/pci/endpoint/functions/pci-epf-ntb.c | 56 +--- drivers/power/supply/axp288_charger.c | 19 +- drivers/pwm/pwm-imx-tpm.c | 9 +- drivers/remoteproc/xlnx_r5_remoteproc.c | 20 +- drivers/rtc/rtc-ntxec.c | 2 +- drivers/scsi/sd.c | 1 + drivers/spi/spi-ch341.c | 36 ++- drivers/spi/spi-imx.c | 4 + drivers/spi/spi.c | 63 ++-- drivers/thermal/thermal_core.c | 7 +- drivers/usb/chipidea/core.c | 45 +-- drivers/usb/chipidea/otg.c | 7 +- drivers/usb/host/xhci.c | 1 - drivers/vfio/cdx/intr.c | 13 +- drivers/vfio/cdx/main.c | 19 ++ drivers/vfio/cdx/private.h | 3 + fs/ceph/dir.c | 6 +- fs/erofs/dir.c | 28 +- fs/ext2/inode.c | 14 +- fs/ext4/xattr.c | 6 +- fs/f2fs/data.c | 4 +- fs/f2fs/f2fs.h | 2 +- fs/f2fs/segment.c | 6 +- fs/f2fs/super.c | 11 +- fs/jbd2/revoke.c | 8 +- fs/notify/inotify/inotify_user.c | 1 + fs/ntfs3/run.c | 18 +- fs/ocfs2/aops.c | 74 +++-- fs/smb/client/cifsacl.c | 116 +++++-- fs/smb/server/connection.c | 28 +- fs/smb/server/connection.h | 6 +- fs/smb/server/smb2pdu.c | 4 +- fs/smb/server/transport_rdma.c | 5 + fs/smb/server/transport_tcp.c | 25 +- fs/userfaultfd.c | 2 - fs/xfs/xfs_buf.c | 1 + include/linux/device.h | 45 +++ include/linux/fwnode.h | 44 ++- include/linux/hugetlb_inline.h | 4 +- include/linux/padata.h | 4 - include/linux/randomize_kstack.h | 26 +- include/linux/sched.h | 4 + include/linux/tpm_eventlog.h | 9 +- include/linux/usb.h | 3 +- include/net/mana/mana.h | 1 + include/net/mctp.h | 3 + include/trace/events/rxrpc.h | 6 +- init/main.c | 1 - io_uring/poll.c | 15 +- io_uring/timeout.c | 4 + kernel/fork.c | 2 + kernel/locking/rtmutex.c | 13 +- kernel/padata.c | 136 +++------ kernel/sched/core.c | 2 +- kernel/sched/rt.c | 2 +- kernel/sched/sched.h | 2 +- kernel/taskstats.c | 1 + lib/test_hmm.c | 86 +++--- lib/ts_kmp.c | 18 +- mm/damon/core.c | 3 +- mm/internal.h | 10 + mm/memory_hotplug.c | 10 +- mm/migrate.c | 152 +++++---- mm/mlock.c | 10 +- mm/mmap.c | 4 +- mm/zsmalloc.c | 1 + net/bluetooth/hci_event.c | 18 +- net/bridge/br_arp_nd_proxy.c | 8 +- net/bridge/br_fdb.c | 28 +- net/caif/cfsrvl.c | 14 +- net/ceph/auth.c | 2 +- net/ipv4/icmp.c | 5 +- net/ipv4/inet_connection_sock.c | 3 + net/ipv6/exthdrs.c | 9 +- net/ipv6/rpl_iptunnel.c | 9 + net/ipv6/seg6_iptunnel.c | 12 +- net/mctp/route.c | 8 +- net/netfilter/nft_bitwise.c | 3 +- net/qrtr/ns.c | 86 +++++- net/rds/rdma.c | 4 - net/rxrpc/ar-internal.h | 1 - net/rxrpc/call_event.c | 25 +- net/rxrpc/conn_event.c | 14 +- net/rxrpc/io_thread.c | 24 +- net/rxrpc/rxkad.c | 112 +++---- net/rxrpc/skbuff.c | 9 - net/smc/smc_clc.c | 4 +- net/strparser/strparser.c | 8 + rust/kernel/init/macros.rs | 7 +- scripts/check-uapi.sh | 7 +- security/apparmor/lsm.c | 16 +- sound/aoa/codecs/onyx.c | 104 ++----- sound/aoa/codecs/tas.c | 113 +++---- sound/aoa/core/gpio-feature.c | 20 +- sound/aoa/core/gpio-pmf.c | 26 +- sound/aoa/soundbus/i2sbus/core.c | 12 +- sound/aoa/soundbus/i2sbus/pcm.c | 143 ++++----- sound/core/control.c | 4 + sound/core/misc.c | 13 +- sound/core/seq/oss/seq_oss_rw.c | 6 +- sound/drivers/pcmtest.c | 19 +- sound/pci/ctxfi/ctatc.c | 3 +- sound/usb/6fire/control.c | 10 +- sound/usb/caiaq/control.c | 52 +++- sound/usb/caiaq/device.c | 35 ++- sound/usb/caiaq/input.c | 2 +- sound/usb/endpoint.c | 6 +- sound/usb/format.c | 2 +- sound/usb/mixer.c | 7 +- sound/usb/mixer_quirks.c | 12 +- tools/accounting/getdelays.c | 41 ++- tools/accounting/procacct.c | 40 ++- tools/perf/arch/loongarch/annotate/instructions.c | 1 + tools/perf/util/disasm.c | 1 + tools/testing/ktest/ktest.pl | 2 +- tools/testing/selftests/landlock/net_test.c | 2 +- .../testing/selftests/mqueue/{setting => settings} | 0 218 files changed, 2506 insertions(+), 1555 deletions(-)

1 week, 1 day

11
10
0 0

[PATCH 6.18 000/275] 6.18.27-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.18.27 release. There are 275 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 06 May 2026 13:50:54 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.27-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.18.27-rc1 Kai Ma <k4729.23098(a)gmail.com> netfilter: reject zero shift in nft_bitwise Andrea Mayer <andrea.mayer(a)uniroma2.it> net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels Harry Yoo (Oracle) <harry(a)kernel.org> mm/slab: return NULL early from kmalloc_nolock() in NMI on UP Harry Yoo (Oracle) <harry(a)kernel.org> mm/page_alloc: return NULL early from alloc_frozen_pages_nolock() in NMI on UP Marco Elver <elver(a)google.com> vmalloc: fix buffer overflow in vrealloc_node_align() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: aloop: Fix peer runtime UAF during format-change stop Deepanshu Kartikey <kartikey406(a)gmail.com> ALSA: caiaq: fix usb_dev refcount leak on probe failure Arjan van de Ven <arjan(a)linux.intel.com> drm/amdgpu: fix zero-size GDS range init on RDNA4 Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> ipv6: rpl: reserve mac_len headroom when recompressed SRH grows Takashi Iwai <tiwai(a)suse.de> ALSA: caiaq: Don't abort when no input device is available Takashi Iwai <tiwai(a)suse.de> ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path Douglas Anderson <dianders(a)chromium.org> driver core: Add kernel-doc for DEV_FLAG_COUNT enum value Yucheng Lu <kanolyc(a)gmail.com> crypto: authencesn - reject short ahash digests during instance creation Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Limit the total number of nodes Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Limit the maximum number of lookups Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Limit the maximum server registration per node Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: frequency: admv1013: fix NULL pointer dereference on str Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: frequency: admv1013: add dev variable Oliver Neukum <oneukum(a)suse.com> media: rc: igorplugusb: heed coherency rules Oliver Neukum <oneukum(a)suse.com> media: rc: ttusbir: respect DMA coherency rules Sean Wang <sean.wang(a)mediatek.com> wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling Sean Wang <sean.wang(a)mediatek.com> wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor Elson Serrao <elson.serrao(a)oss.qualcomm.com> phy: qcom: m31-eusb2: clear PLL_EN during init Ronak Raheja <ronak.raheja(a)oss.qualcomm.com> phy: qcom: m31-eusb2: Update init sequence to set PHY_ENABLE Alexander Usyskin <alexander.usyskin(a)intel.com> mei: me: add nova lake point H DID Alexander Usyskin <alexander.usyskin(a)intel.com> mei: me: use PCI_DEVICE_DATA macro Alistair Popple <apopple(a)nvidia.com> lib: test_hmm: evict device pages on file close to avoid use-after-free Ryan Roberts <ryan.roberts(a)arm.com> arm64: mm: Fix rodata=full block mapping support for realm guests Kevin Brodsky <kevin.brodsky(a)arm.com> arm64: mm: Simplify check in arch_kfence_init_pool() Anthony Yznaga <anthony.yznaga(a)oracle.com> mm: prevent droppable mappings from being locked Andrea Mayer <andrea.mayer(a)uniroma2.it> seg6: fix seg6 lwtunnel output redirect for L2 reduced encap mode Yang Xiuwei <yangxiuwei(a)kylinos.cn> scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails Andrea Righi <arighi(a)nvidia.com> sched_ext: Documentation: Clarify ops.dispatch() role in task lifecycle David Howells <dhowells(a)redhat.com> rxgk: Fix potential integer overflow in length check Keenan Dong <keenanat2000(a)gmail.com> rtmutex: Use waiter::task instead of current in remove_waiter() Tobias Gaertner <tob.gaertner(a)me.com> ntfs3: fix integer overflow in run_unpack() volume boundary check Tobias Gaertner <tob.gaertner(a)me.com> ntfs3: add buffer boundary checks to run_unpack() Tushar Sariya <tushar.97(a)hotmail.com> NFSv4.1: Apply session size limits on clone path Steven Rostedt <rostedt(a)goodmis.org> ktest: Fix the month in the name of the failure directory Chen Zhao <chezhao(a)nvidia.com> IB/core: Fix zero dmac race in neighbor resolution David Carlier <devnexen(a)gmail.com> gtp: disable BH before calling udp_tunnel_xmit_skb() Max Kellermann <max.kellermann(a)ionos.com> ceph: only d_add() negative dentries when they are unhashed Junrui Luo <moonafterrain(a)outlook.com> dm mirror: fix integer overflow in create_dirty_log() Gustavo A. R. Silva <gustavoars(a)kernel.org> crypto: nx - Fix packed layout in struct nx842_crypto_header Thorsten Blum <thorsten.blum(a)linux.dev> crypto: nx - fix context leak in nx842_crypto_free_ctx Thorsten Blum <thorsten.blum(a)linux.dev> crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-sha204a - Fix uninitialized data access on OTP read error Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-sha204a - Fix error codes in OTP reads Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-tdes - fix DMA sync direction Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> crypto: ccree - fix a memory leak in cc_mac_digest() Thomas Fourier <fourier.thomas(a)gmail.com> crypto: hisilicon - Fix dma_unmap_single() direction Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-ecc - Release client on allocation failure Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup Eric Biggers <ebiggers(a)kernel.org> crypto: arm64/aes - Fix 32-bit aes_mac_update() arg treated as 64-bit Giovanni Cabiddu <giovanni.cabiddu(a)intel.com> crypto: acomp - fix wrong pointer stored by acomp_save_req() Johan Hovold <johan(a)kernel.org> can: ucan: fix devres lifetime Qiang Yu <qiang.yu(a)oss.qualcomm.com> bus: mhi: host: pci_generic: Switch to async power up to avoid boot delays Shuvam Pandey <shuvampandey1(a)gmail.com> Bluetooth: hci_event: fix potential UAF in SSP passkey handlers Cengiz Can <cengiz.can(a)canonical.com> apparmor: use target task's context in apparmor_getprocattr() Brian Mak <makb(a)juniper.net> mfd: core: Preserve OF node when ACPI handle is present Gang Yan <yangang(a)kylinos.cn> mptcp: sync the msk->sndbuf at accept() time Yiyang Chen <cyyzero16(a)gmail.com> taskstats: set version in TGID exit notifications Zhenzhong Wu <jt26wzz(a)gmail.com> tcp: call sk_data_ready() after listener migration Yi Cong <yicong(a)kylinos.cn> wifi: rtl8xxxu: fix potential use of uninitialized value Rick Edgecombe <rick.p.edgecombe(a)intel.com> x86/shstk: Prevent deadlock during shstk sigreturn Dave Hansen <dave.hansen(a)linux.intel.com> x86/cpu: Disable FRED when PTI is forced on Chia-Ming Chang <chiamingc(a)synology.com> inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails Aditya Garg <gargaditya08(a)live.com> HID: apple: ensure the keyboard backlight is off if suspending Arnd Bergmann <arnd(a)arndb.de> check-uapi: link into shared objects Junrui Luo <moonafterrain(a)outlook.com> md/raid5: validate payload size before accessing journal metadata Chia-Ming Chang <chiamingc(a)synology.com> md/raid5: fix soft lockup in retry_aligned_read() Yu Kuai <yukuai(a)fnnas.com> md/md-llbitmap: raise barrier before state machine transition Yu Kuai <yukuai(a)fnnas.com> md/md-llbitmap: skip reading rdevs that are not in_sync David (Ming Qiang) Wu <David.Wu3(a)amd.com> amdgpu/jpeg: fix deepsleep register for jpeg 5_0_0 and 5_0_2 Miquel Raynal <miquel.raynal(a)bootlin.com> mtd: spinand: winbond: Declare the QE bit on W25NxxJW Sanjaikumar V S <sanjaikumar.vs(a)dicortech.com> mtd: spi-nor: sst: Fix write enable before AAI sequence Sohei Koyama <skoyama(a)ddn.com> ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() Deepanshu Kartikey <kartikey406(a)gmail.com> ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access Masami Hiramatsu (Google) <mhiramat(a)kernel.org> ring-buffer: Do not double count the reader_page Brian Ruley <brian.ruley(a)gehealthcare.com> ARM: 9472/1: fix race condition on PG_dcache_clean in __sync_icache_dcache() Rong Bao <rong.bao(a)csmantle.top> perf annotate: Use jump__delete when freeing LoongArch jumps Sean Christopherson <seanjc(a)google.com> KVM: nSVM: Always intercept VMMCALL when L2 is active Kevin Cheng <chengkev(a)google.com> KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Add missing consistency check for nCR3 validity Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Drop the non-architectural consistency check for NP_ENABLE Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Add missing consistency check for EFER, CR0, CR4, and CS Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Clear tracking of L1->L2 NMI and soft IRQ on nested #VMEXIT Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Clear EVENTINJ fields in vmcb12 on nested #VMEXIT Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID) Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Triple fault if mapping VMCB12 fails on nested #VMEXIT Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Refactor writing vmcb12 on nested #VMEXIT as a helper Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Refactor checking LBRV enablement in vmcb12 into a helper Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Always inject a #GP if mapping VMCB12 fails on nested VMRUN Yosry Ahmed <yosry(a)kernel.org> KVM: SVM: Add missing save/restore handling of LBR MSRs Yosry Ahmed <yosry(a)kernel.org> KVM: SVM: Switch svm_copy_lbrs() to a macro Sean Christopherson <seanjc(a)google.com> KVM: nSVM: Delay setting soft IRQ RIP tracking fields until vCPU run Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12 Yosry Ahmed <yosry.ahmed(a)linux.dev> KVM: nSVM: Use vcpu->arch.cr2 when updating vmcb12 on nested #VMEXIT Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Delay stuffing L2's current RIP into NextRIP until vCPU run Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode Sean Christopherson <seanjc(a)google.com> KVM: SVM: Explicitly mark vmcb01 dirty after modifying VMCB intercepts Kevin Cheng <chengkev(a)google.com> KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Sync NextRIP to cached vmcb12 after VMRUN of L2 Yosry Ahmed <yosry.ahmed(a)linux.dev> KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state Sean Christopherson <seanjc(a)google.com> KVM: x86: Defer non-architectural deliver of exception payload to userspace read Tao Cui <cuitao(a)kylinos.cn> LoongArch: KVM: Use CSR_CRMD_PLV in kvm_arch_vcpu_in_kernel() Denis M. Karpov <komlomal(a)gmail.com> userfaultfd: allow registration of ranges below mmap_min_addr SeongJae Park <sj(a)kernel.org> mm/damon/core: use time_in_range_open() for damos quota window start SeongJae Park <sj(a)kernel.org> mm/damon/core: validate damos_quota_goal->nid for node_mem_{used,free}_bp Jackie Liu <liuyun01(a)kylinos.cn> mm/damon/stat: fix memory leak on damon_start() failure in damon_stat_start() Jackie Liu <liuyun01(a)kylinos.cn> mm/mempolicy: fix memory leaks in weighted_interleave_auto_store() Uladzislau Rezki (Sony) <urezki(a)gmail.com> mm/vmalloc: take vmap_purge_lock in shrinker Johan Hovold <johan(a)kernel.org> rtc: ntxec: fix OF node reference imbalance Jacqueline Wong <jacqwong(a)google.com> tpm: tpm_tis: stop transmit if retries are exhausted Jacqueline Wong <jacqwong(a)google.com> tpm: tpm_tis: add error logging for data transfer Gunnar Kudrjavets <gunnarku(a)amazon.com> tpm: Use kfree_sensitive() to free auth session in tpm_dev_release() Gunnar Kudrjavets <gunnarku(a)amazon.com> tpm: Fix auth session leak in tpm2_get_random() error path Gunnar Kudrjavets <gunnarku(a)amazon.com> tpm2-sessions: Fix missing tpm_buf_destroy() in tpm2_read_public() Viorel Suman (OSS) <viorel.suman(a)oss.nxp.com> pwm: imx-tpm: Count the number of enabled channels in probe Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos - rename first/last to first_desc/last_desc Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos - fix SEC1 32k ahash request limitation Thomas Zimmermann <tzimmermann(a)suse.de> firmware: google: framebuffer: Do not unregister platform device Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> xfs: fix a resource leak in xfs_alloc_buftarg() Hans Holmberg <hans.holmberg(a)wdc.com> xfs: start gc on zonegc_low_space attribute updates Giovanni Cabiddu <giovanni.cabiddu(a)intel.com> crypto: qat - fix IRQ cleanup on 6xxx probe failure Francesco Dolcini <francesco.dolcini(a)toradex.com> arm64: dts: ti: am62-verdin: Enable pullup for eMMC data pins Shawn Lin <shawn.lin(a)rock-chips.com> mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration Bin Liu <b-liu(a)ti.com> mmc: block: use single block write in retry Ryan Roberts <ryan.roberts(a)arm.com> randomize_kstack: Maintain kstack_offset per task Sanman Pradhan <psanman(a)juniper.net> hwmon: (pt5161l) Fix bugs in pt5161l_read_block_data() Brahmajit Das <listout(a)listout.xyz> ASoC: Intel: avs: replace strcmp with sysfs_streq Tiezhu Yang <yangtiezhu(a)loongson.cn> drm/amd: Fix set but not used warnings Amir Goldstein <amir73il(a)gmail.com> fs: prepare for adding LSM blob to backing_file Sanman Pradhan <psanman(a)juniper.net> hwmon: (isl28022) Fix integer overflow in power calculation on 32-bit Krzysztof Kozlowski <krzysztof.kozlowski(a)oss.qualcomm.com> power: supply: axp288_charger: Do not cancel work before initializing it Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Show CPU vulnerabilites correctly Arnd Bergmann <arnd(a)arndb.de> tpm: avoid -Wunused-but-set-variable Nathan Chancellor <nathan(a)kernel.org> extract-cert: Wrap key_pass with '#ifdef USE_PKCS11_ENGINE' Johan Hovold <johan(a)kernel.org> spi: fix resource leaks on device setup failure Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() Ruide Cao <caoruide123(a)gmail.com> ipv4: icmp: validate reply type before using icmp_pointers hkbinbin <hkbinbinbin(a)gmail.com> RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/fprobe: Reject registration of a registered fprobe before init Marco Elver <elver(a)google.com> slub: fix data loss and overflow in krealloc() Luca Ceresoli <luca.ceresoli(a)bootlin.com> drm/arcpgu: fix device node leak Marek Vasut <marex(a)nabladev.com> net: ks8851: Avoid excess softirq scheduling Yuan Zhaoming <yuanzm2(a)lenovo.com> net: mctp: fix don't require received header reserved bits to be zero Breno Leitao <leitao(a)debian.org> netconsole: avoid out-of-bounds access on empty string in trim_newline() Zhengchuan Liang <zcliangcn(a)gmail.com> net: bridge: use a stable FDB dst snapshot in RCU readers Marek Vasut <marex(a)nabladev.com> net: ks8851: Reinstate disabling of BHs around IRQ handler Ruijie Li <ruijieli51(a)gmail.com> net/smc: avoid early lgr access in smc_clc_wait_msg Jiawen Wu <jiawenwu(a)trustnetic.com> net: txgbe: fix firmware version check Ao Zhou <draw51280(a)163.com> net: rds: fix MR cleanup on copy error Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Free the node during ctrl_cmd_bye() Robert Marko <robert.marko(a)sartura.hr> arm64: dts: marvell: uDPU: add ethernet aliases Jiawen Wu <jiawenwu(a)trustnetic.com> net: txgbe: fix RTNL assertion warning when remove module Yiyang Chen <cyyzero16(a)gmail.com> tools/accounting: handle truncated taskstats netlink messages Prasanna Kumar T S M <ptsm(a)linux.microsoft.com> EDAC/versalnet: Fix memory leak in remove and probe error paths David Howells <dhowells(a)redhat.com> rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets David Howells <dhowells(a)redhat.com> rxrpc: Fix re-decryption of RESPONSE packets David Howells <dhowells(a)redhat.com> rxrpc: Fix error handling in rxgk_extract_token() David Howells <dhowells(a)redhat.com> rxrpc: Fix rxkad crypto unalignment handling David Howells <dhowells(a)redhat.com> rxrpc: Fix conn-level packet handling to unshare RESPONSE packets David Howells <dhowells(a)redhat.com> rxrpc: Fix memory leaks in rxkad_verify_response() David Howells <dhowells(a)redhat.com> rxrpc: Fix potential UAF after skb_unshare() failure Jonathan Santos <Jonathan.Santos(a)analog.com> iio: adc: ad7768-1: remove switch to one-shot mode Jonathan Santos <Jonathan.Santos(a)analog.com> iio: adc: ad7768-1: fix one-shot mode data acquisition Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: pcmtest: Fix resource leaks in module init error paths Guangshuo Li <lgs201920130244(a)gmail.com> ALSA: pcmtest: fix reference leak on failed device registration Spencer Payton <spayton681(a)gmail.com> ALSA: hda/realtek - Add mute LED support for HP Victus 15-fa2xxx Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: 6fire: Fix input volume change detection Takashi Iwai <tiwai(a)suse.de> ALSA: caiaq: Handle probe errors properly Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: caiaq: Fix control_put() result and cache rollback Takashi Iwai <tiwai(a)suse.de> ALSA: core: Fix potential data race at fasync handling Jens Axboe <axboe(a)kernel.dk> io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE Longxuan Yu <ylong030(a)ucr.edu> io_uring/poll: fix signed comparison in io_poll_get_ownership() David Lechner <dlechner(a)baylibre.com> iio: adc: ti-ads7950: use iio_push_to_buffers_with_ts_unaligned() Naman Jain <namjain(a)linux.microsoft.com> block: relax pgmap check in bio_add_page for compatible zone device pages Pavel Begunkov <asml.silence(a)gmail.com> io_uring/timeout: check unused sqe fields Damien Le Moal <dlemoal(a)kernel.org> block: fix zone write plugs refcount handling in disk_zone_wplug_schedule_bio_work() Dawei Feng <dawei.feng(a)seu.edu.cn> rbd: fix null-ptr-deref when device_add_disk() fails Mickaël Salaün <mic(a)digikod.net> selftests/landlock: Skip stale records in audit_match_record() Mickaël Salaün <mic(a)digikod.net> selftests/landlock: Fix snprintf truncation checks in audit helpers Mickaël Salaün <mic(a)digikod.net> selftests/landlock: Fix format warning for __u64 in net_test Mickaël Salaün <mic(a)digikod.net> selftests/landlock: Drain stale audit records on init Mickaël Salaün <mic(a)digikod.net> landlock: Fix LOG_SUBDOMAINS_OFF inheritance across fork() Simon Liebold <simonlie(a)amazon.de> selftests/mqueue: Fix incorrectly named file Joseph Salisbury <joseph.salisbury(a)oracle.com> sched: Use u64 for bandwidth ratio calculations Tommaso Merciai <tommaso.merciai.xr(a)bp.renesas.com> reset: rzv2h-usb2phy: Keep PHY clock enabled for entire device lifetime Ben Levinsky <ben.levinsky(a)amd.com> remoteproc: xlnx: Only access buffer information if IPI is buffered Long Li <longli(a)microsoft.com> RDMA/mana_ib: Disable RX steering on RSS QP destroy Aksh Garg <a-garg7(a)ti.com> PCI: cadence: Use cdns_pcie_read_sz() for byte or word read access Helge Deller <deller(a)gmx.de> parisc: Drop ip_fast_csum() inline assembly implementation Helge Deller <deller(a)gmx.de> parisc: _llseek syscall is only available for 32-bit userspace Robert Beckett <bob.beckett(a)collabora.com> nvme: respect NVME_QUIRK_DISABLE_WRITE_ZEROES when wzsl is set Robert Beckett <bob.beckett(a)collabora.com> nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4 James Kim <james010kim(a)gmail.com> mtd: docg3: fix use-after-free in docg3_release() Thorsten Blum <thorsten.blum(a)linux.dev> mm/hugetlb: fix early boot crash on parameters without '=' separator SeongJae Park <sj(a)kernel.org> mm/damon/core: fix damon_call() vs kdamond_fn() exit race Hao Ge <hao.ge(a)linux.dev> mm/alloc_tag: clear codetag for pages allocated before page_ext initialization Marek Vasut <marex(a)nabladev.com> mfd: stpmic1: Attempt system shutdown twice in case PMIC is confused Jens Axboe <axboe(a)kernel.dk> io_uring/register: fix ring resizing with mixed/large SQEs/CQEs Josh Hunt <johunt(a)akamai.com> md/raid10: fix deadlock with check operation and nowait requests Sean Christopherson <seanjc(a)google.com> KVM: selftests: Fix reserved value WRMSR testcase for multi-feature MSRs Zhang Yi <yi.zhang(a)huawei.com> jbd2: fix deadlock in jbd2_journal_cancel_revoke() Corey Minyard <corey(a)minyard.net> ipmi:ssif: Clean up kthread on errors Gao Xiang <xiang(a)kernel.org> erofs: fix the out-of-bounds nameoff handling for trailing dirents Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes Harin Lee <me(a)harin.net> ALSA: ctxfi: Add fallback to default RSR for S/PDIF Thorsten Blum <thorsten.blum(a)linux.dev> ALSA: aoa: Skip devices with no codecs in i2sbus_resume() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: aoa: i2sbus: fix OF node lifetime handling Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: aoa: i2sbus: clear stale prepared state Shigeru Yoshida <syoshida(a)redhat.com> mm/zsmalloc: copy KMSAN metadata in zs_page_migrate() Vasiliy Kovalev <kovalev(a)altlinux.org> ext2: reject inodes with zero i_nlink and valid mode in ext2_iget() Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Fix use-after-free in driver remove() Chen Ni <nichen(a)iscas.ac.cn> media: i2c: imx219: Check return value of devm_gpiod_get_optional() in imx219_probe() Josh Law <objecting(a)objecting.org> lib/ts_kmp: fix integer overflow in pattern length calculation Daniel Hodges <git(a)danielhodges.dev> PCI: epf-mhi: Return 0, not remaining timeout, when eDMA ops complete Rong Zhang <i(a)rong.moe> Revert "ALSA: usb: Increase volume range that triggers a warning" Koichiro Den <den(a)valinux.co.jp> PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-sha204a - Fix OTP sysfs read and error handling Fan Wu <fanwu01(a)zju.edu.cn> media: mtk-jpeg: fix use-after-free in release path due to uncancelled work Luxiao Xu <rakukuip(a)gmail.com> net: strparser: fix skb_head leak in strp_abort_strp() Zhengchuan Liang <zcliangcn(a)gmail.com> net: caif: clear client service pointer on teardown Ziqing Chen <chenziqing(a)xiaomi.com> ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() Ming Qian <ming.qian(a)oss.nxp.com> media: amphion: Fix race between m2m job_abort and device_run Richard Zhu <hongxing.zhu(a)nxp.com> PCI: imx6: Skip waiting for L2/L3 Ready on i.MX6SX Felix Gu <ustc.gu(a)gmail.com> EDAC/versalnet: Fix device_node leak in mc_probe() Sanman Pradhan <psanman(a)juniper.net> hwmon: (powerz) Fix missing usb_kill_urb() on signal interrupt Wentao Liang <vulab(a)iscas.ac.cn> of: unittest: fix use-after-free in testdrv_probe() Wentao Liang <vulab(a)iscas.ac.cn> of: unittest: fix use-after-free in of_unittest_changeset() Swamil Jain <s-jain1(a)ti.com> dt-bindings: display: ti, am65x-dss: Fix AM62L DSS reg and clock constraints Herbert Xu <herbert(a)gondor.apana.org.au> crypto: pcrypt - Fix handling of MAY_BACKLOG requests Douya Le <ldy3087146292(a)gmail.com> crypto: algif_aead - snapshot IV for async AEAD requests Matthew Wilcox (Oracle) <willy(a)infradead.org> mm: call ->free_folio() directly in folio_unmap_invalidate() Johan Hovold <johan(a)kernel.org> spi: ch341: fix memory leaks on probe failures Johan Hovold <johan(a)kernel.org> spi: imx: fix use-after-free on unbind Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> thermal: core: Fix thermal zone governor cleanup issues Michael Bommarito <michael.bommarito(a)gmail.com> um: drivers: call kernel_strrchr() explicitly in cow_user.c Prasanna Kumar T S M <ptsm(a)linux.microsoft.com> vfio/cdx: Fix NULL pointer dereference in interrupt trigger path Alex Williamson <alex.williamson(a)nvidia.com> vfio/cdx: Serialize VFIO_DEVICE_SET_IRQS with a per-device mutex Alex Williamson <alex.williamson(a)nvidia.com> vfio/virtio: Convert list_lock from spinlock to mutex Manish Honap <mhonap(a)nvidia.com> vfio: selftests: Fix VLA initialisation in vfio_pci_irq_set() Daniel Hodges <git(a)danielhodges.dev> wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() Fedor Pchelkin <pchelkin(a)ispras.ru> wifi: rtw88: check for PCI upstream bridge existence Sergey Senozhatsky <senozhatsky(a)chromium.org> zram: do not forget to endio for partial discard requests Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: edt-ft5x06 - fix use-after-free in debugfs teardown Heming Zhao <heming.zhao(a)suse.com> ocfs2: split transactions in dio completion to avoid credit exhaustion Usama Arif <usama.arif(a)linux.dev> mm: migrate: requeue destination folio on deferred split queue Anshuman Khandual <anshuman.khandual(a)arm.com> arm64/mm: Enable batched TLB flush in unmap_hotplug_range() Thomas Zimmermann <tzimmermann(a)suse.de> firmware: google: framebuffer: Do not mark framebuffer as busy Lorenzo Stoakes (Oracle) <ljs(a)kernel.org> fs: afs: revert mmap_prepare() change Miguel Ojeda <ojeda(a)kernel.org> kbuild: rust: allow `clippy::uninlined_format_args` Danilo Krummrich <dakr(a)kernel.org> rust: dma: remove DMA_ATTR_NO_KERNEL_MAPPING from public attrs David Carlier <devnexen(a)gmail.com> drm/nouveau: fix nvkm_device leak on aperture removal failure Douglas Anderson <dianders(a)chromium.org> device property: Make modifications of fwnode "flags" thread safe Douglas Anderson <dianders(a)chromium.org> driver core: Don't let a device probe until it's ready Tyllis Xu <livelycarpet87(a)gmail.com> ibmasm: fix heap over-read in ibmasm_send_i2o_message() Tyllis Xu <livelycarpet87(a)gmail.com> ibmasm: fix OOB reads in command_file_write due to missing size checks Tyllis Xu <livelycarpet87(a)gmail.com> misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt() Weigang He <geoffreyhe2(a)gmail.com> greybus: gb-beagleplay: fix sleep in atomic context in hdlc_tx_frames() Pengpeng Hou <pengpeng(a)iscas.ac.cn> greybus: gb-beagleplay: bound bootloader receive buffering Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> leds: qcom-lpg: Check for array overflow when selecting the high resolution Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> drm/nouveau: fix u32 overflow in pushbuf reloc bounds check Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> LoongArch: Add spectre boundry for syscall dispatch table Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Evaluate packsize caps at the right place Xu Yang <xu.yang_2(a)nxp.com> usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change Xu Yang <xu.yang_2(a)nxp.com> usb: chipidea: otg: not wait vbus drop if use role_switch Michal Pecio <michal.pecio(a)gmail.com> usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Avoid false E-MU sample-rate notifications Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES ------------- Diffstat: .../bindings/display/ti/ti,am65x-dss.yaml | 70 +++-- Documentation/scheduler/sched-ext.rst | 14 +- Makefile | 5 +- arch/arm/mm/flush.c | 4 +- arch/arm64/boot/dts/marvell/armada-3720-uDPU.dtsi | 5 + arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi | 20 +- arch/arm64/crypto/aes-modes.S | 4 +- arch/arm64/include/asm/mmu.h | 2 + arch/arm64/mm/init.c | 9 +- arch/arm64/mm/mmu.c | 92 +++--- arch/loongarch/kernel/cpu-probe.c | 7 + arch/loongarch/kernel/syscall.c | 3 +- arch/loongarch/kvm/vcpu.c | 2 +- arch/parisc/Kconfig | 3 + arch/parisc/include/asm/checksum.h | 89 +----- arch/parisc/kernel/syscalls/syscall.tbl | 2 +- arch/parisc/lib/Makefile | 2 +- arch/parisc/lib/checksum.c | 99 ------ arch/um/drivers/cow_user.c | 8 +- arch/x86/Kconfig | 1 + arch/x86/kernel/shstk.c | 42 +-- arch/x86/kvm/hyperv.h | 8 - arch/x86/kvm/svm/hyperv.h | 9 +- arch/x86/kvm/svm/nested.c | 195 +++++++----- arch/x86/kvm/svm/svm.c | 139 +++++++-- arch/x86/kvm/svm/svm.h | 11 +- arch/x86/kvm/x86.c | 65 ++-- arch/x86/mm/pti.c | 5 + block/bio-integrity.c | 6 +- block/bio.c | 6 +- block/blk-zoned.c | 12 +- block/blk.h | 19 ++ certs/extract-cert.c | 6 +- crypto/acompress.c | 8 +- crypto/algif_aead.c | 10 +- crypto/authencesn.c | 5 + crypto/pcrypt.c | 7 +- drivers/base/core.c | 39 ++- drivers/base/dd.c | 20 ++ drivers/block/rbd.c | 6 +- drivers/block/zram/zram_drv.c | 3 +- drivers/bus/imx-weim.c | 2 +- drivers/bus/mhi/host/pci_generic.c | 2 +- drivers/char/ipmi/ipmi_ssif.c | 13 +- drivers/char/tpm/tpm-chip.c | 2 +- drivers/char/tpm/tpm2-cmd.c | 6 +- drivers/char/tpm/tpm2-sessions.c | 5 +- drivers/char/tpm/tpm_tis_core.c | 11 +- drivers/crypto/atmel-aes.c | 2 +- drivers/crypto/atmel-ecc.c | 1 + drivers/crypto/atmel-i2c.c | 4 +- drivers/crypto/atmel-sha204a.c | 37 ++- drivers/crypto/atmel-tdes.c | 8 +- drivers/crypto/ccree/cc_hash.c | 1 + drivers/crypto/hisilicon/sec/sec_algs.c | 2 +- drivers/crypto/intel/qat/qat_6xxx/adf_drv.c | 4 +- drivers/crypto/nx/nx-842.c | 10 +- drivers/crypto/nx/nx-842.h | 4 +- drivers/crypto/talitos.c | 340 +++++++++++++-------- drivers/edac/versalnet_edac.c | 6 +- drivers/firmware/google/framebuffer-coreboot.c | 12 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 3 + drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.h | 6 +- drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c | 52 +++- drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c | 9 +- drivers/gpu/drm/nouveau/nouveau_drm.c | 2 +- drivers/gpu/drm/nouveau/nouveau_gem.c | 2 +- drivers/gpu/drm/tiny/arcpgu.c | 3 +- drivers/greybus/gb-beagleplay.c | 112 ++++++- drivers/hid/hid-apple.c | 2 + drivers/hwmon/isl28022.c | 5 +- drivers/hwmon/powerz.c | 11 +- drivers/hwmon/pt5161l.c | 4 +- drivers/i2c/i2c-core-of.c | 2 +- drivers/iio/adc/ad7768-1.c | 16 +- drivers/iio/adc/ti-ads7950.c | 11 +- drivers/iio/frequency/admv1013.c | 90 +++--- drivers/infiniband/core/addr.c | 3 + drivers/infiniband/hw/mana/qp.c | 15 + drivers/infiniband/sw/rxe/rxe_recv.c | 3 +- drivers/input/touchscreen/edt-ft5x06.c | 3 + drivers/leds/rgb/leds-qcom-lpg.c | 7 +- drivers/md/dm-raid1.c | 6 +- drivers/md/md-llbitmap.c | 11 +- drivers/md/raid10.c | 4 +- drivers/md/raid5-cache.c | 48 ++- drivers/md/raid5.c | 8 +- drivers/media/i2c/imx219.c | 3 + drivers/media/platform/amphion/vpu_v4l2.c | 9 +- .../media/platform/mediatek/jpeg/mtk_jpeg_core.c | 1 + drivers/media/rc/igorplugusb.c | 16 +- drivers/media/rc/ttusbir.c | 13 +- drivers/mfd/mfd-core.c | 12 +- drivers/mfd/stpmic1.c | 20 +- drivers/misc/ibmasm/ibmasmfs.c | 7 + drivers/misc/ibmasm/lowlevel.c | 12 +- drivers/misc/ibmasm/remote.c | 5 + drivers/misc/mei/bus-fixup.c | 6 +- drivers/misc/mei/hw-me-regs.h | 163 +++++----- drivers/misc/mei/hw-me.h | 6 - drivers/misc/mei/pci-me.c | 163 +++++----- drivers/mmc/core/block.c | 12 +- drivers/mmc/core/queue.h | 3 + drivers/mmc/host/sdhci-of-dwcmshc.c | 19 +- drivers/mtd/devices/docg3.c | 3 +- drivers/mtd/nand/spi/winbond.c | 4 +- drivers/mtd/spi-nor/sst.c | 13 + drivers/net/can/usb/ucan.c | 2 +- drivers/net/ethernet/micrel/ks8851.h | 6 +- drivers/net/ethernet/micrel/ks8851_common.c | 69 ++--- drivers/net/ethernet/micrel/ks8851_par.c | 15 +- drivers/net/ethernet/micrel/ks8851_spi.c | 11 +- drivers/net/ethernet/microsoft/mana/mana_en.c | 11 +- drivers/net/ethernet/wangxun/txgbe/txgbe_main.c | 3 +- drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c | 2 + drivers/net/gtp.c | 2 + drivers/net/netconsole.c | 2 + drivers/net/phy/mdio_bus_provider.c | 4 +- drivers/net/wireless/marvell/mwifiex/init.c | 2 +- drivers/net/wireless/mediatek/mt76/mt792x_regs.h | 4 + drivers/net/wireless/mediatek/mt76/mt792x_usb.c | 51 +++- drivers/net/wireless/realtek/rtl8xxxu/core.c | 28 +- drivers/net/wireless/realtek/rtw88/pci.c | 3 +- drivers/nvme/host/core.c | 2 +- drivers/nvme/host/pci.c | 2 + drivers/of/base.c | 2 +- drivers/of/dynamic.c | 2 +- drivers/of/platform.c | 2 +- drivers/of/unittest.c | 4 +- drivers/pci/controller/cadence/pcie-cadence.h | 56 ++-- drivers/pci/controller/dwc/pci-imx6.c | 1 + drivers/pci/endpoint/functions/pci-epf-mhi.c | 4 + drivers/pci/endpoint/functions/pci-epf-ntb.c | 56 +--- drivers/phy/qualcomm/phy-qcom-m31-eusb2.c | 4 +- drivers/power/supply/axp288_charger.c | 19 +- drivers/pwm/pwm-imx-tpm.c | 9 +- drivers/remoteproc/xlnx_r5_remoteproc.c | 20 +- drivers/reset/reset-rzv2h-usb2phy.c | 64 ++-- drivers/rtc/rtc-ntxec.c | 2 +- drivers/scsi/sd.c | 1 + drivers/spi/spi-ch341.c | 36 ++- drivers/spi/spi-imx.c | 4 + drivers/spi/spi.c | 63 ++-- drivers/thermal/thermal_core.c | 7 +- drivers/usb/chipidea/core.c | 45 +-- drivers/usb/chipidea/otg.c | 7 +- drivers/usb/host/xhci.c | 1 - drivers/vfio/cdx/intr.c | 13 +- drivers/vfio/cdx/main.c | 19 ++ drivers/vfio/cdx/private.h | 3 + drivers/vfio/pci/virtio/common.h | 2 +- drivers/vfio/pci/virtio/migrate.c | 33 +- fs/afs/file.c | 12 +- fs/ceph/dir.c | 6 +- fs/erofs/dir.c | 28 +- fs/ext2/inode.c | 14 +- fs/ext4/xattr.c | 6 +- fs/file_table.c | 22 +- fs/jbd2/revoke.c | 8 +- fs/nfs/internal.h | 2 + fs/nfs/nfs4client.c | 4 +- fs/nfs/nfs4proc.c | 3 + fs/notify/inotify/inotify_user.c | 1 + fs/ntfs3/run.c | 18 +- fs/ocfs2/aops.c | 74 +++-- fs/userfaultfd.c | 2 - fs/xfs/xfs_buf.c | 1 + fs/xfs/xfs_sysfs.c | 7 +- fs/xfs/xfs_zone_alloc.h | 4 + fs/xfs/xfs_zone_gc.c | 17 ++ include/linux/alloc_tag.h | 2 + include/linux/damon.h | 1 + include/linux/device.h | 45 +++ include/linux/fwnode.h | 44 ++- include/linux/hugetlb_inline.h | 4 +- include/linux/pgalloc_tag.h | 2 +- include/linux/randomize_kstack.h | 26 +- include/linux/sched.h | 4 + include/linux/tpm_eventlog.h | 9 +- include/linux/usb.h | 3 +- include/net/mana/mana.h | 1 + include/net/mctp.h | 3 + include/trace/events/rxrpc.h | 6 +- init/main.c | 1 - io_uring/poll.c | 6 +- io_uring/register.c | 32 +- io_uring/timeout.c | 4 + kernel/fork.c | 2 + kernel/locking/rtmutex.c | 13 +- kernel/sched/core.c | 2 +- kernel/sched/rt.c | 2 +- kernel/sched/sched.h | 2 +- kernel/taskstats.c | 1 + kernel/trace/fprobe.c | 21 +- kernel/trace/ring_buffer.c | 13 +- lib/alloc_tag.c | 109 +++++++ lib/test_hmm.c | 86 +++--- lib/ts_kmp.c | 18 +- mm/damon/core.c | 60 ++-- mm/damon/stat.c | 5 +- mm/filemap.c | 3 +- mm/hugetlb.c | 3 + mm/internal.h | 11 +- mm/mempolicy.c | 23 +- mm/migrate.c | 17 ++ mm/mlock.c | 10 +- mm/page_alloc.c | 15 +- mm/slub.c | 29 +- mm/truncate.c | 6 +- mm/vma.c | 4 +- mm/vmalloc.c | 3 +- mm/zsmalloc.c | 1 + net/bluetooth/hci_event.c | 18 +- net/bridge/br_arp_nd_proxy.c | 8 +- net/bridge/br_fdb.c | 28 +- net/caif/cfsrvl.c | 14 +- net/ceph/auth.c | 2 +- net/ipv4/icmp.c | 5 +- net/ipv4/inet_connection_sock.c | 3 + net/ipv6/exthdrs.c | 9 +- net/ipv6/rpl_iptunnel.c | 9 + net/ipv6/seg6_iptunnel.c | 12 +- net/mctp/route.c | 8 +- net/mptcp/protocol.c | 2 +- net/netfilter/nft_bitwise.c | 3 +- net/qrtr/ns.c | 86 +++++- net/rds/rdma.c | 4 - net/rxrpc/ar-internal.h | 1 - net/rxrpc/call_event.c | 20 +- net/rxrpc/conn_event.c | 43 ++- net/rxrpc/io_thread.c | 24 +- net/rxrpc/rxgk_app.c | 3 +- net/rxrpc/rxgk_common.h | 1 + net/rxrpc/rxkad.c | 112 +++---- net/rxrpc/skbuff.c | 9 - net/smc/smc_clc.c | 4 +- net/strparser/strparser.c | 8 + rust/kernel/dma.rs | 3 - scripts/check-uapi.sh | 7 +- security/apparmor/lsm.c | 16 +- security/landlock/cred.c | 6 +- sound/aoa/soundbus/i2sbus/core.c | 12 +- sound/aoa/soundbus/i2sbus/pcm.c | 71 +++-- sound/core/control.c | 4 + sound/core/misc.c | 13 +- sound/core/seq/oss/seq_oss_rw.c | 6 +- sound/drivers/aloop.c | 43 ++- sound/drivers/pcmtest.c | 19 +- sound/hda/codecs/realtek/alc269.c | 1 + sound/pci/ctxfi/ctatc.c | 3 +- sound/soc/intel/avs/path.c | 2 +- sound/usb/6fire/control.c | 10 +- sound/usb/caiaq/control.c | 52 +++- sound/usb/caiaq/device.c | 35 ++- sound/usb/caiaq/input.c | 2 +- sound/usb/endpoint.c | 6 +- sound/usb/format.c | 2 +- sound/usb/mixer.c | 7 +- sound/usb/mixer_quirks.c | 12 +- tools/accounting/getdelays.c | 41 ++- tools/accounting/procacct.c | 40 ++- tools/perf/arch/loongarch/annotate/instructions.c | 1 + tools/perf/util/disasm.c | 1 + tools/testing/ktest/ktest.pl | 2 +- tools/testing/selftests/kvm/x86/msrs_test.c | 2 +- tools/testing/selftests/landlock/audit.h | 105 +++++-- tools/testing/selftests/landlock/audit_test.c | 124 ++++++-- tools/testing/selftests/landlock/net_test.c | 2 +- tools/testing/selftests/landlock/ptrace_test.c | 1 - .../selftests/landlock/scoped_abstract_unix_test.c | 1 - .../testing/selftests/mqueue/{setting => settings} | 0 tools/testing/selftests/vfio/lib/vfio_pci_device.c | 4 +- tools/testing/vma/vma_internal.h | 7 +- 274 files changed, 3267 insertions(+), 1877 deletions(-)

1 week, 6 days

10
10
0 0

[PATCH 7.0 000/307] 7.0.4-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 7.0.4 release. There are 307 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 06 May 2026 13:50:49 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.0.4-rc1.… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.0.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 7.0.4-rc1 Kai Ma <k4729.23098(a)gmail.com> netfilter: reject zero shift in nft_bitwise Andrea Mayer <andrea.mayer(a)uniroma2.it> net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels Harry Yoo (Oracle) <harry(a)kernel.org> mm/slab: return NULL early from kmalloc_nolock() in NMI on UP Harry Yoo (Oracle) <harry(a)kernel.org> mm/page_alloc: return NULL early from alloc_frozen_pages_nolock() in NMI on UP Marco Elver <elver(a)google.com> vmalloc: fix buffer overflow in vrealloc_node_align() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: aloop: Fix peer runtime UAF during format-change stop Deepanshu Kartikey <kartikey406(a)gmail.com> ALSA: caiaq: fix usb_dev refcount leak on probe failure Brajesh Gupta <brajesh.gupta(a)imgtec.com> drm/imagination: Fix segfault when updating ftrace mask Arjan van de Ven <arjan(a)linux.intel.com> drm/amdgpu: fix zero-size GDS range init on RDNA4 Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> ipv6: rpl: reserve mac_len headroom when recompressed SRH grows Takashi Iwai <tiwai(a)suse.de> ALSA: caiaq: Don't abort when no input device is available Takashi Iwai <tiwai(a)suse.de> ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path Douglas Anderson <dianders(a)chromium.org> driver core: Add kernel-doc for DEV_FLAG_COUNT enum value Yucheng Lu <kanolyc(a)gmail.com> crypto: authencesn - reject short ahash digests during instance creation Alexander Usyskin <alexander.usyskin(a)intel.com> mei: me: add nova lake point H DID Alexander Usyskin <alexander.usyskin(a)intel.com> mei: me: use PCI_DEVICE_DATA macro Lorenzo Stoakes (Oracle) <ljs(a)kernel.org> mm: avoid deadlock when holding rmap on mmap_prepare error Lorenzo Stoakes (Oracle) <ljs(a)kernel.org> mm: various small mmap_prepare cleanups Sean Wang <sean.wang(a)mediatek.com> wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling Sean Wang <sean.wang(a)mediatek.com> wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: frequency: admv1013: fix NULL pointer dereference on str Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: frequency: admv1013: add dev variable WANG Rui <r(a)hev.cc> perf loongarch: Fix build failure with CONFIG_LIBDW_DWARF_UNWIND Andrea Mayer <andrea.mayer(a)uniroma2.it> seg6: fix seg6 lwtunnel output redirect for L2 reduced encap mode Yang Xiuwei <yangxiuwei(a)kylinos.cn> scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails Andrea Righi <arighi(a)nvidia.com> sched_ext: Documentation: Clarify ops.dispatch() role in task lifecycle David Howells <dhowells(a)redhat.com> rxgk: Fix potential integer overflow in length check Keenan Dong <keenanat2000(a)gmail.com> rtmutex: Use waiter::task instead of current in remove_waiter() Tobias Gaertner <tob.gaertner(a)me.com> ntfs3: fix integer overflow in run_unpack() volume boundary check Tobias Gaertner <tob.gaertner(a)me.com> ntfs3: add buffer boundary checks to run_unpack() Tushar Sariya <tushar.97(a)hotmail.com> NFSv4.1: Apply session size limits on clone path Steven Rostedt <rostedt(a)goodmis.org> ktest: Fix the month in the name of the failure directory Chen Zhao <chezhao(a)nvidia.com> IB/core: Fix zero dmac race in neighbor resolution David Carlier <devnexen(a)gmail.com> gtp: disable BH before calling udp_tunnel_xmit_skb() Max Kellermann <max.kellermann(a)ionos.com> ceph: only d_add() negative dentries when they are unhashed Sam Edwards <cfsworks(a)gmail.com> ceph: fix num_ops off-by-one when crypto allocation fails Junrui Luo <moonafterrain(a)outlook.com> erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap() Junrui Luo <moonafterrain(a)outlook.com> dm mirror: fix integer overflow in create_dirty_log() Gustavo A. R. Silva <gustavoars(a)kernel.org> crypto: nx - Fix packed layout in struct nx842_crypto_header Thorsten Blum <thorsten.blum(a)linux.dev> crypto: nx - fix context leak in nx842_crypto_free_ctx Thorsten Blum <thorsten.blum(a)linux.dev> crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-sha204a - Fix uninitialized data access on OTP read error Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-sha204a - Fix error codes in OTP reads Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-tdes - fix DMA sync direction Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> crypto: ccree - fix a memory leak in cc_mac_digest() Thomas Fourier <fourier.thomas(a)gmail.com> crypto: hisilicon - Fix dma_unmap_single() direction Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-ecc - Release client on allocation failure Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup Eric Biggers <ebiggers(a)kernel.org> crypto: arm64/aes - Fix 32-bit aes_mac_update() arg treated as 64-bit Giovanni Cabiddu <giovanni.cabiddu(a)intel.com> crypto: acomp - fix wrong pointer stored by acomp_save_req() Johan Hovold <johan(a)kernel.org> can: ucan: fix devres lifetime Qiang Yu <qiang.yu(a)oss.qualcomm.com> bus: mhi: host: pci_generic: Switch to async power up to avoid boot delays Shuvam Pandey <shuvampandey1(a)gmail.com> Bluetooth: hci_event: fix potential UAF in SSP passkey handlers Cengiz Can <cengiz.can(a)canonical.com> apparmor: use target task's context in apparmor_getprocattr() Pierre Barre <pierre(a)barre.sh> 9p: fix access mode flags being ORed instead of replaced Brian Mak <makb(a)juniper.net> mfd: core: Preserve OF node when ACPI handle is present Gang Yan <yangang(a)kylinos.cn> mptcp: sync the msk->sndbuf at accept() time Yiyang Chen <cyyzero16(a)gmail.com> taskstats: set version in TGID exit notifications Zhenzhong Wu <jt26wzz(a)gmail.com> tcp: call sk_data_ready() after listener migration Yi Cong <yicong(a)kylinos.cn> wifi: rtl8xxxu: fix potential use of uninitialized value Rick Edgecombe <rick.p.edgecombe(a)intel.com> x86/shstk: Prevent deadlock during shstk sigreturn Dave Hansen <dave.hansen(a)linux.intel.com> x86/cpu: Disable FRED when PTI is forced on Chia-Ming Chang <chiamingc(a)synology.com> inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails Aditya Garg <gargaditya08(a)live.com> HID: apple: ensure the keyboard backlight is off if suspending Kairui Song <kasong(a)tencent.com> mm, swap: speed up hibernation allocation and writeout Arnd Bergmann <arnd(a)arndb.de> check-uapi: link into shared objects Junrui Luo <moonafterrain(a)outlook.com> md/raid5: validate payload size before accessing journal metadata Chia-Ming Chang <chiamingc(a)synology.com> md/raid5: fix soft lockup in retry_aligned_read() Yu Kuai <yukuai(a)fnnas.com> md/md-llbitmap: raise barrier before state machine transition Yu Kuai <yukuai(a)fnnas.com> md/md-llbitmap: skip reading rdevs that are not in_sync David (Ming Qiang) Wu <David.Wu3(a)amd.com> amdgpu/jpeg: fix deepsleep register for jpeg 5_0_0 and 5_0_2 Miquel Raynal <miquel.raynal(a)bootlin.com> mtd: spinand: winbond: Declare the QE bit on W25NxxJW Sanjaikumar V S <sanjaikumar.vs(a)dicortech.com> mtd: spi-nor: sst: Fix write enable before AAI sequence Seohyeon Maeng <bioloidgp(a)gmail.com> udf: fix partition descriptor append bookkeeping Sohei Koyama <skoyama(a)ddn.com> ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() Deepanshu Kartikey <kartikey406(a)gmail.com> ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access Masami Hiramatsu (Google) <mhiramat(a)kernel.org> ring-buffer: Do not double count the reader_page Brian Ruley <brian.ruley(a)gehealthcare.com> ARM: 9472/1: fix race condition on PG_dcache_clean in __sync_icache_dcache() Sean Christopherson <seanjc(a)google.com> KVM: nSVM: Always intercept VMMCALL when L2 is active Kevin Cheng <chengkev(a)google.com> KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Add missing consistency check for nCR3 validity Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Drop the non-architectural consistency check for NP_ENABLE Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Add missing consistency check for EFER, CR0, CR4, and CS Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Clear tracking of L1->L2 NMI and soft IRQ on nested #VMEXIT Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Clear EVENTINJ fields in vmcb12 on nested #VMEXIT Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID) Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Triple fault if mapping VMCB12 fails on nested #VMEXIT Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Refactor writing vmcb12 on nested #VMEXIT as a helper Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Refactor checking LBRV enablement in vmcb12 into a helper Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Always inject a #GP if mapping VMCB12 fails on nested VMRUN Yosry Ahmed <yosry(a)kernel.org> KVM: SVM: Add missing save/restore handling of LBR MSRs Yosry Ahmed <yosry(a)kernel.org> KVM: SVM: Switch svm_copy_lbrs() to a macro Sean Christopherson <seanjc(a)google.com> KVM: nSVM: Delay setting soft IRQ RIP tracking fields until vCPU run Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12 Marc Zyngier <maz(a)kernel.org> KVM: arm64: Account for RESx bits in __compute_fgt() Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Use vcpu->arch.cr2 when updating vmcb12 on nested #VMEXIT Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Delay stuffing L2's current RIP into NextRIP until vCPU run Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode Sean Christopherson <seanjc(a)google.com> KVM: SVM: Explicitly mark vmcb01 dirty after modifying VMCB intercepts Kevin Cheng <chengkev(a)google.com> KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Sync NextRIP to cached vmcb12 after VMRUN of L2 Yosry Ahmed <yosry(a)kernel.org> KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state Sean Christopherson <seanjc(a)google.com> KVM: x86: Defer non-architectural deliver of exception payload to userspace read Tao Cui <cuitao(a)kylinos.cn> LoongArch: KVM: Use CSR_CRMD_PLV in kvm_arch_vcpu_in_kernel() Denis M. Karpov <komlomal(a)gmail.com> userfaultfd: allow registration of ranges below mmap_min_addr SeongJae Park <sj(a)kernel.org> mm/damon/core: disallow non-power of two min_region_sz on damon_start() SeongJae Park <sj(a)kernel.org> mm/damon/core: disallow time-quota setting zero esz SeongJae Park <sj(a)kernel.org> mm/damon/core: use time_in_range_open() for damos quota window start SeongJae Park <sj(a)kernel.org> mm/damon/core: validate damos_quota_goal->nid for node_memcg_{used,free}_bp SeongJae Park <sj(a)kernel.org> mm/damon/core: validate damos_quota_goal->nid for node_mem_{used,free}_bp Jackie Liu <liuyun01(a)kylinos.cn> mm/damon/stat: fix memory leak on damon_start() failure in damon_stat_start() Jackie Liu <liuyun01(a)kylinos.cn> mm/mempolicy: fix memory leaks in weighted_interleave_auto_store() Chenghao Duan <duanchenghao(a)kylinos.cn> mm/memfd_luo: fix physical address conversion in put_folios cleanup Uladzislau Rezki (Sony) <urezki(a)gmail.com> mm/vmalloc: take vmap_purge_lock in shrinker Johan Hovold <johan(a)kernel.org> rtc: ntxec: fix OF node reference imbalance Jacqueline Wong <jacqwong(a)google.com> tpm: tpm_tis: stop transmit if retries are exhausted Jacqueline Wong <jacqwong(a)google.com> tpm: tpm_tis: add error logging for data transfer Gunnar Kudrjavets <gunnarku(a)amazon.com> tpm: Use kfree_sensitive() to free auth session in tpm_dev_release() Gunnar Kudrjavets <gunnarku(a)amazon.com> tpm: Fix auth session leak in tpm2_get_random() error path Gunnar Kudrjavets <gunnarku(a)amazon.com> tpm2-sessions: Fix missing tpm_buf_destroy() in tpm2_read_public() Viorel Suman (OSS) <viorel.suman(a)oss.nxp.com> pwm: imx-tpm: Count the number of enabled channels in probe Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos - rename first/last to first_desc/last_desc Paul Louvel <paul.louvel(a)bootlin.com> crypto: talitos - fix SEC1 32k ahash request limitation Krzysztof Kozlowski <krzysztof.kozlowski(a)oss.qualcomm.com> firmware: exynos-acpm: Drop fake 'const' on handle pointer Thomas Zimmermann <tzimmermann(a)suse.de> firmware: google: framebuffer: Do not unregister platform device Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> xfs: fix a resource leak in xfs_alloc_buftarg() Hans Holmberg <hans.holmberg(a)wdc.com> xfs: start gc on zonegc_low_space attribute updates Giovanni Cabiddu <giovanni.cabiddu(a)intel.com> crypto: qat - fix IRQ cleanup on 6xxx probe failure Francesco Dolcini <francesco.dolcini(a)toradex.com> arm64: dts: ti: am62-verdin: Enable pullup for eMMC data pins Shawn Lin <shawn.lin(a)rock-chips.com> mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration Bin Liu <b-liu(a)ti.com> mmc: block: use single block write in retry Ryan Roberts <ryan.roberts(a)arm.com> randomize_kstack: Maintain kstack_offset per task Sanman Pradhan <psanman(a)juniper.net> hwmon: (pt5161l) Fix bugs in pt5161l_read_block_data() Paul Moore <paul(a)paul-moore.com> selinux: fix overlayfs mmap() and mprotect() access checks Paul Moore <paul(a)paul-moore.com> lsm: add backing_file LSM hooks Amir Goldstein <amir73il(a)gmail.com> fs: prepare for adding LSM blob to backing_file Barnabás Pőcze <barnabas.pocze+renesas(a)ideasonboard.com> media: rzv2h-ivc: Fix AXIRX_VBLANK register write Daniel Scally <dan.scally+renesas(a)ideasonboard.com> media: rzv2h-ivc: Revise default VBLANK formula Thomas Weißschuh <linux(a)weissschuh.net> hwmon: (powerz) Avoid cacheline sharing for DMA buffer Sanman Pradhan <psanman(a)juniper.net> hwmon: (isl28022) Fix integer overflow in power calculation on 32-bit Krzysztof Kozlowski <krzysztof.kozlowski(a)oss.qualcomm.com> power: supply: axp288_charger: Do not cancel work before initializing it Thomas Zimmermann <tzimmermann(a)suse.de> fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Show CPU vulnerabilites correctly Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Make arch_irq_work_has_interrupt() true only if IPI HW exist Arnd Bergmann <arnd(a)arndb.de> tpm: avoid -Wunused-but-set-variable Nathan Chancellor <nathan(a)kernel.org> extract-cert: Wrap key_pass with '#ifdef USE_PKCS11_ENGINE' Daniel J Blueman <daniel(a)quora.org> apparmor: Fix string overrun due to missing termination Johan Hovold <johan(a)kernel.org> spi: fix resource leaks on device setup failure Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() Ruide Cao <caoruide123(a)gmail.com> ipv4: icmp: validate reply type before using icmp_pointers Petr Mladek <pmladek(a)suse.com> printf: Compile the kunit test with DISABLE_BRANCH_PROFILING DISABLE_BRANCH_PROFILING hkbinbin <hkbinbinbin(a)gmail.com> RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/fprobe: Reject registration of a registered fprobe before init Marco Elver <elver(a)google.com> slub: fix data loss and overflow in krealloc() Luca Ceresoli <luca.ceresoli(a)bootlin.com> drm/arcpgu: fix device node leak Marek Vasut <marex(a)nabladev.com> net: ks8851: Avoid excess softirq scheduling Yuan Zhaoming <yuanzm2(a)lenovo.com> net: mctp: fix don't require received header reserved bits to be zero Breno Leitao <leitao(a)debian.org> netconsole: avoid out-of-bounds access on empty string in trim_newline() Zhengchuan Liang <zcliangcn(a)gmail.com> net: bridge: use a stable FDB dst snapshot in RCU readers Marek Vasut <marex(a)nabladev.com> net: ks8851: Reinstate disabling of BHs around IRQ handler Ruijie Li <ruijieli51(a)gmail.com> net/smc: avoid early lgr access in smc_clc_wait_msg Jiawen Wu <jiawenwu(a)trustnetic.com> net: txgbe: fix firmware version check Ao Zhou <draw51280(a)163.com> net: rds: fix MR cleanup on copy error Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Limit the total number of nodes Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Free the node during ctrl_cmd_bye() Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Limit the maximum number of lookups Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Limit the maximum server registration per node Robert Marko <robert.marko(a)sartura.hr> arm64: dts: marvell: uDPU: add ethernet aliases Jiawen Wu <jiawenwu(a)trustnetic.com> net: txgbe: fix RTNL assertion warning when remove module Yiyang Chen <cyyzero16(a)gmail.com> tools/accounting: handle truncated taskstats netlink messages Prasanna Kumar T S M <ptsm(a)linux.microsoft.com> EDAC/versalnet: Fix memory leak in remove and probe error paths David Howells <dhowells(a)redhat.com> rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets David Howells <dhowells(a)redhat.com> rxrpc: Fix re-decryption of RESPONSE packets David Howells <dhowells(a)redhat.com> rxrpc: Fix error handling in rxgk_extract_token() David Howells <dhowells(a)redhat.com> rxrpc: Fix rxkad crypto unalignment handling David Howells <dhowells(a)redhat.com> rxrpc: Fix conn-level packet handling to unshare RESPONSE packets David Howells <dhowells(a)redhat.com> rxrpc: Fix memory leaks in rxkad_verify_response() David Howells <dhowells(a)redhat.com> rxrpc: Fix potential UAF after skb_unshare() failure Jonathan Santos <Jonathan.Santos(a)analog.com> iio: adc: ad7768-1: remove switch to one-shot mode Jonathan Santos <Jonathan.Santos(a)analog.com> iio: adc: ad7768-1: fix one-shot mode data acquisition Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: pcmtest: Fix resource leaks in module init error paths Guangshuo Li <lgs201920130244(a)gmail.com> ALSA: pcmtest: fix reference leak on failed device registration Spencer Payton <spayton681(a)gmail.com> ALSA: hda/realtek - Add mute LED support for HP Victus 15-fa2xxx Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: 6fire: Fix input volume change detection Takashi Iwai <tiwai(a)suse.de> ALSA: caiaq: Handle probe errors properly Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: caiaq: Fix control_put() result and cache rollback Takashi Iwai <tiwai(a)suse.de> ALSA: core: Fix potential data race at fasync handling Helge Deller <deller(a)gmx.de> module.lds.S: Fix modules on 32-bit parisc architecture Joe Lawrence <joe.lawrence(a)redhat.com> module.lds,codetag: force 0 sh_addr for sections Jens Axboe <axboe(a)kernel.dk> io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE Longxuan Yu <ylong030(a)ucr.edu> io_uring/poll: fix signed comparison in io_poll_get_ownership() Pavel Begunkov <asml.silence(a)gmail.com> io_uring/zcrx: fix user_struct uaf Jens Axboe <axboe(a)kernel.dk> io_uring/register: fix ring resizing with mixed/large SQEs/CQEs David Lechner <dlechner(a)baylibre.com> iio: adc: ti-ads7950: use iio_push_to_buffers_with_ts_unaligned() Naman Jain <namjain(a)linux.microsoft.com> block: relax pgmap check in bio_add_page for compatible zone device pages Pavel Begunkov <asml.silence(a)gmail.com> io_uring/timeout: check unused sqe fields Pavel Begunkov <asml.silence(a)gmail.com> io_uring/zcrx: return back two step unregistration Damien Le Moal <dlemoal(a)kernel.org> block: fix zone write plugs refcount handling in disk_zone_wplug_schedule_bio_work() Matthew Brost <matthew.brost(a)intel.com> mm/zone_device: do not touch device folio after calling ->folio_free() Dawei Feng <dawei.feng(a)seu.edu.cn> rbd: fix null-ptr-deref when device_add_disk() fails Mickaël Salaün <mic(a)digikod.net> selftests/landlock: Skip stale records in audit_match_record() Mickaël Salaün <mic(a)digikod.net> selftests/landlock: Fix snprintf truncation checks in audit helpers Mickaël Salaün <mic(a)digikod.net> selftests/landlock: Fix format warning for __u64 in net_test Mickaël Salaün <mic(a)digikod.net> selftests/landlock: Drain stale audit records on init Mickaël Salaün <mic(a)digikod.net> landlock: Allow TSYNC with LOG_SUBDOMAINS_OFF and fd=-1 Mickaël Salaün <mic(a)digikod.net> landlock: Fix LOG_SUBDOMAINS_OFF inheritance across fork() Simon Liebold <simonlie(a)amazon.de> selftests/mqueue: Fix incorrectly named file Joseph Salisbury <joseph.salisbury(a)oracle.com> sched: Use u64 for bandwidth ratio calculations Tommaso Merciai <tommaso.merciai.xr(a)bp.renesas.com> reset: rzv2h-usb2phy: Keep PHY clock enabled for entire device lifetime Ben Levinsky <ben.levinsky(a)amd.com> remoteproc: xlnx: Only access buffer information if IPI is buffered Long Li <longli(a)microsoft.com> RDMA/mana_ib: Disable RX steering on RSS QP destroy Rong Bao <rong.bao(a)csmantle.top> perf annotate: Use jump__delete when freeing LoongArch jumps Franz Schnyder <franz.schnyder(a)toradex.com> PCI: imx6: Fix reference clock source selection for i.MX95 Aksh Garg <a-garg7(a)ti.com> PCI: cadence: Use cdns_pcie_read_sz() for byte or word read access Helge Deller <deller(a)gmx.de> parisc: Drop ip_fast_csum() inline assembly implementation Helge Deller <deller(a)gmx.de> parisc: _llseek syscall is only available for 32-bit userspace Robert Beckett <bob.beckett(a)collabora.com> nvme: respect NVME_QUIRK_DISABLE_WRITE_ZEROES when wzsl is set Robert Beckett <bob.beckett(a)collabora.com> nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4 James Kim <james010kim(a)gmail.com> mtd: docg3: fix use-after-free in docg3_release() Thorsten Blum <thorsten.blum(a)linux.dev> mm/hugetlb: fix early boot crash on parameters without '=' separator SeongJae Park <sj(a)kernel.org> mm/damon/core: fix damos_walk() vs kdamond_fn() exit race SeongJae Park <sj(a)kernel.org> mm/damon/core: fix damon_call() vs kdamond_fn() exit race Hao Ge <hao.ge(a)linux.dev> mm/alloc_tag: clear codetag for pages allocated before page_ext initialization Marek Vasut <marex(a)nabladev.com> mfd: stpmic1: Attempt system shutdown twice in case PMIC is confused Michael Riesch <michael.riesch(a)collabora.com> media: rockchip: rkcif: comply with minimum number of buffers requirement Dan Carpenter <dan.carpenter(a)linaro.org> media: rockchip: rkcif: fix off by one bugs Oliver Neukum <oneukum(a)suse.com> media: rc: igorplugusb: heed coherency rules Josh Hunt <johunt(a)akamai.com> md/raid10: fix deadlock with check operation and nowait requests Sean Christopherson <seanjc(a)google.com> KVM: selftests: Fix reserved value WRMSR testcase for multi-feature MSRs Zhang Yi <yi.zhang(a)huawei.com> jbd2: fix deadlock in jbd2_journal_cancel_revoke() Corey Minyard <corey(a)minyard.net> ipmi:ssif: Clean up kthread on errors Gao Xiang <xiang(a)kernel.org> erofs: fix the out-of-bounds nameoff handling for trailing dirents Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes Harin Lee <me(a)harin.net> ALSA: ctxfi: Add fallback to default RSR for S/PDIF Thorsten Blum <thorsten.blum(a)linux.dev> ALSA: aoa: Skip devices with no codecs in i2sbus_resume() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: aoa: i2sbus: fix OF node lifetime handling Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: aoa: i2sbus: clear stale prepared state Shigeru Yoshida <syoshida(a)redhat.com> mm/zsmalloc: copy KMSAN metadata in zs_page_migrate() Vasiliy Kovalev <kovalev(a)altlinux.org> ext2: reject inodes with zero i_nlink and valid mode in ext2_iget() Manivannan Sadhasivam <manivannan.sadhasivam(a)oss.qualcomm.com> net: qrtr: ns: Fix use-after-free in driver remove() Chen Ni <nichen(a)iscas.ac.cn> media: i2c: imx219: Check return value of devm_gpiod_get_optional() in imx219_probe() Josh Law <objecting(a)objecting.org> lib/ts_kmp: fix integer overflow in pattern length calculation Daniel Hodges <git(a)danielhodges.dev> PCI: epf-mhi: Return 0, not remaining timeout, when eDMA ops complete Elson Serrao <elson.serrao(a)oss.qualcomm.com> phy: qcom: m31-eusb2: clear PLL_EN during init Rong Zhang <i(a)rong.moe> Revert "ALSA: usb: Increase volume range that triggers a warning" Koichiro Den <den(a)valinux.co.jp> PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-sha204a - Fix OTP sysfs read and error handling Fan Wu <fanwu01(a)zju.edu.cn> media: mtk-jpeg: fix use-after-free in release path due to uncancelled work Luxiao Xu <rakukuip(a)gmail.com> net: strparser: fix skb_head leak in strp_abort_strp() Zhengchuan Liang <zcliangcn(a)gmail.com> net: caif: clear client service pointer on teardown Ziqing Chen <chenziqing(a)xiaomi.com> ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() Ming Qian <ming.qian(a)oss.nxp.com> media: amphion: Fix race between m2m job_abort and device_run Richard Zhu <hongxing.zhu(a)nxp.com> PCI: imx6: Skip waiting for L2/L3 Ready on i.MX6SX Felix Gu <ustc.gu(a)gmail.com> EDAC/versalnet: Fix device_node leak in mc_probe() Sanman Pradhan <psanman(a)juniper.net> hwmon: (powerz) Fix missing usb_kill_urb() on signal interrupt Wentao Liang <vulab(a)iscas.ac.cn> of: unittest: fix use-after-free in testdrv_probe() Wentao Liang <vulab(a)iscas.ac.cn> of: unittest: fix use-after-free in of_unittest_changeset() Swamil Jain <s-jain1(a)ti.com> dt-bindings: display: ti, am65x-dss: Fix AM62L DSS reg and clock constraints Herbert Xu <herbert(a)gondor.apana.org.au> crypto: pcrypt - Fix handling of MAY_BACKLOG requests Douya Le <ldy3087146292(a)gmail.com> crypto: algif_aead - snapshot IV for async AEAD requests Johan Hovold <johan(a)kernel.org> spi: ch341: fix memory leaks on probe failures Johan Hovold <johan(a)kernel.org> spi: imx: fix use-after-free on unbind Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> thermal: core: Fix thermal zone governor cleanup issues Michael Bommarito <michael.bommarito(a)gmail.com> um: drivers: call kernel_strrchr() explicitly in cow_user.c Prasanna Kumar T S M <ptsm(a)linux.microsoft.com> vfio/cdx: Fix NULL pointer dereference in interrupt trigger path Alex Williamson <alex.williamson(a)nvidia.com> vfio/cdx: Serialize VFIO_DEVICE_SET_IRQS with a per-device mutex Alex Williamson <alex.williamson(a)nvidia.com> vfio/virtio: Convert list_lock from spinlock to mutex Michał Winiarski <michal.winiarski(a)intel.com> vfio/xe: Add a missing vfio_pci_core_release_dev() Manish Honap <mhonap(a)nvidia.com> vfio: selftests: Fix VLA initialisation in vfio_pci_irq_set() Daniel Hodges <git(a)danielhodges.dev> wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() Fedor Pchelkin <pchelkin(a)ispras.ru> wifi: rtw88: check for PCI upstream bridge existence Sergey Senozhatsky <senozhatsky(a)chromium.org> zram: do not forget to endio for partial discard requests Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: edt-ft5x06 - fix use-after-free in debugfs teardown Heming Zhao <heming.zhao(a)suse.com> ocfs2: split transactions in dio completion to avoid credit exhaustion Lance Yang <lance.yang(a)linux.dev> mm: fix deferred split queue races during migration Anthony Yznaga <anthony.yznaga(a)oracle.com> mm: prevent droppable mappings from being locked Usama Arif <usama.arif(a)linux.dev> mm: migrate: requeue destination folio on deferred split queue Ryan Roberts <ryan.roberts(a)arm.com> arm64: mm: Fix rodata=full block mapping support for realm guests Anshuman Khandual <anshuman.khandual(a)arm.com> arm64/mm: Enable batched TLB flush in unmap_hotplug_range() Alistair Popple <apopple(a)nvidia.com> lib: test_hmm: evict device pages on file close to avoid use-after-free Thomas Zimmermann <tzimmermann(a)suse.de> firmware: google: framebuffer: Do not mark framebuffer as busy Lorenzo Stoakes (Oracle) <ljs(a)kernel.org> fs: afs: revert mmap_prepare() change Miguel Ojeda <ojeda(a)kernel.org> kbuild: rust: allow `clippy::uninlined_format_args` Danilo Krummrich <dakr(a)kernel.org> rust: dma: remove DMA_ATTR_NO_KERNEL_MAPPING from public attrs David Carlier <devnexen(a)gmail.com> drm/nouveau: fix nvkm_device leak on aperture removal failure Douglas Anderson <dianders(a)chromium.org> device property: Make modifications of fwnode "flags" thread safe Douglas Anderson <dianders(a)chromium.org> driver core: Don't let a device probe until it's ready Thomas Weißschuh <linux(a)weissschuh.net> sysfs: attribute_group: Respect is_visible_const() when changing owner Tyllis Xu <livelycarpet87(a)gmail.com> ibmasm: fix heap over-read in ibmasm_send_i2o_message() Tyllis Xu <livelycarpet87(a)gmail.com> ibmasm: fix OOB reads in command_file_write due to missing size checks Tyllis Xu <livelycarpet87(a)gmail.com> misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt() Weigang He <geoffreyhe2(a)gmail.com> greybus: gb-beagleplay: fix sleep in atomic context in hdlc_tx_frames() Pengpeng Hou <pengpeng(a)iscas.ac.cn> greybus: gb-beagleplay: bound bootloader receive buffering Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> leds: qcom-lpg: Check for array overflow when selecting the high resolution Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> drm/nouveau: fix u32 overflow in pushbuf reloc bounds check Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> LoongArch: Add spectre boundry for syscall dispatch table Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Evaluate packsize caps at the right place Xu Yang <xu.yang_2(a)nxp.com> usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change Xu Yang <xu.yang_2(a)nxp.com> usb: chipidea: otg: not wait vbus drop if use role_switch Michal Pecio <michal.pecio(a)gmail.com> usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable() Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: Avoid false E-MU sample-rate notifications Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES ------------- Diffstat: .../bindings/display/ti/ti,am65x-dss.yaml | 70 ++-- Documentation/scheduler/sched-ext.rst | 14 +- Makefile | 5 +- arch/Kconfig | 7 + arch/arm/mm/flush.c | 4 +- arch/arm64/boot/dts/marvell/armada-3720-uDPU.dtsi | 5 + arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi | 20 +- arch/arm64/crypto/aes-modes.S | 4 +- arch/arm64/include/asm/mmu.h | 2 + arch/arm64/kvm/config.c | 4 +- arch/arm64/mm/init.c | 9 +- arch/arm64/mm/mmu.c | 81 +++-- arch/loongarch/include/asm/irq_work.h | 2 +- arch/loongarch/kernel/cpu-probe.c | 7 + arch/loongarch/kernel/syscall.c | 3 +- arch/loongarch/kvm/vcpu.c | 2 +- arch/parisc/Kconfig | 4 + arch/parisc/include/asm/checksum.h | 89 +---- arch/parisc/kernel/syscalls/syscall.tbl | 2 +- arch/parisc/lib/Makefile | 2 +- arch/parisc/lib/checksum.c | 99 ------ arch/um/drivers/cow_user.c | 8 +- arch/x86/Kconfig | 1 + arch/x86/kernel/shstk.c | 42 +-- arch/x86/kvm/hyperv.h | 8 - arch/x86/kvm/svm/hyperv.h | 9 +- arch/x86/kvm/svm/nested.c | 201 +++++++----- arch/x86/kvm/svm/svm.c | 150 +++++++-- arch/x86/kvm/svm/svm.h | 17 +- arch/x86/kvm/x86.c | 65 ++-- arch/x86/mm/pti.c | 5 + block/bio-integrity.c | 6 +- block/bio.c | 6 +- block/blk-zoned.c | 12 +- block/blk.h | 19 ++ certs/extract-cert.c | 6 +- crypto/acompress.c | 8 +- crypto/algif_aead.c | 10 +- crypto/authencesn.c | 5 + crypto/pcrypt.c | 7 +- drivers/base/core.c | 39 ++- drivers/base/dd.c | 20 ++ drivers/block/rbd.c | 6 +- drivers/block/zram/zram_drv.c | 3 +- drivers/bus/imx-weim.c | 2 +- drivers/bus/mhi/host/pci_generic.c | 2 +- drivers/char/ipmi/ipmi_ssif.c | 13 +- drivers/char/tpm/tpm-chip.c | 2 +- drivers/char/tpm/tpm2-cmd.c | 6 +- drivers/char/tpm/tpm2-sessions.c | 5 +- drivers/char/tpm/tpm_tis_core.c | 11 +- drivers/clk/samsung/clk-acpm.c | 4 +- drivers/crypto/atmel-aes.c | 2 +- drivers/crypto/atmel-ecc.c | 1 + drivers/crypto/atmel-i2c.c | 4 +- drivers/crypto/atmel-sha204a.c | 37 ++- drivers/crypto/atmel-tdes.c | 8 +- drivers/crypto/ccree/cc_hash.c | 1 + drivers/crypto/hisilicon/sec/sec_algs.c | 2 +- drivers/crypto/intel/qat/qat_6xxx/adf_drv.c | 4 +- drivers/crypto/nx/nx-842.c | 10 +- drivers/crypto/nx/nx-842.h | 4 +- drivers/crypto/talitos.c | 340 ++++++++++++-------- drivers/edac/versalnet_edac.c | 6 +- drivers/firmware/google/framebuffer-coreboot.c | 12 +- drivers/firmware/samsung/exynos-acpm-dvfs.c | 4 +- drivers/firmware/samsung/exynos-acpm-dvfs.h | 4 +- drivers/firmware/samsung/exynos-acpm-pmic.c | 10 +- drivers/firmware/samsung/exynos-acpm-pmic.h | 10 +- drivers/firmware/samsung/exynos-acpm.c | 16 +- drivers/firmware/samsung/exynos-acpm.h | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 3 + drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c | 52 ++- drivers/gpu/drm/imagination/pvr_fw_trace.c | 2 +- drivers/gpu/drm/nouveau/nouveau_drm.c | 2 +- drivers/gpu/drm/nouveau/nouveau_gem.c | 2 +- drivers/gpu/drm/tiny/arcpgu.c | 3 +- drivers/greybus/gb-beagleplay.c | 112 ++++++- drivers/hid/hid-apple.c | 2 + drivers/hwmon/isl28022.c | 5 +- drivers/hwmon/powerz.c | 16 +- drivers/hwmon/pt5161l.c | 4 +- drivers/i2c/i2c-core-of.c | 2 +- drivers/iio/adc/ad7768-1.c | 16 +- drivers/iio/adc/ti-ads7950.c | 11 +- drivers/iio/frequency/admv1013.c | 90 +++--- drivers/infiniband/core/addr.c | 3 + drivers/infiniband/hw/mana/qp.c | 15 + drivers/infiniband/sw/rxe/rxe_recv.c | 3 +- drivers/input/touchscreen/edt-ft5x06.c | 3 + drivers/leds/rgb/leds-qcom-lpg.c | 7 +- drivers/md/dm-raid1.c | 6 +- drivers/md/md-llbitmap.c | 11 +- drivers/md/raid10.c | 4 +- drivers/md/raid5-cache.c | 48 ++- drivers/md/raid5.c | 8 +- drivers/media/i2c/imx219.c | 3 + drivers/media/platform/amphion/vpu_v4l2.c | 9 +- .../media/platform/mediatek/jpeg/mtk_jpeg_core.c | 1 + .../platform/renesas/rzv2h-ivc/rzv2h-ivc-video.c | 9 +- .../media/platform/renesas/rzv2h-ivc/rzv2h-ivc.h | 2 +- .../platform/rockchip/rkcif/rkcif-capture-mipi.c | 10 +- .../media/platform/rockchip/rkcif/rkcif-stream.c | 44 +-- drivers/media/rc/igorplugusb.c | 16 +- drivers/mfd/mfd-core.c | 12 +- drivers/mfd/sec-acpm.c | 10 +- drivers/mfd/stpmic1.c | 20 +- drivers/misc/ibmasm/ibmasmfs.c | 7 + drivers/misc/ibmasm/lowlevel.c | 12 +- drivers/misc/ibmasm/remote.c | 5 + drivers/misc/mei/bus-fixup.c | 6 +- drivers/misc/mei/hw-me-regs.h | 163 +++++----- drivers/misc/mei/hw-me.h | 6 - drivers/misc/mei/pci-me.c | 163 +++++----- drivers/mmc/core/block.c | 12 +- drivers/mmc/core/queue.h | 3 + drivers/mmc/host/sdhci-of-dwcmshc.c | 19 +- drivers/mtd/devices/docg3.c | 3 +- drivers/mtd/nand/spi/winbond.c | 4 +- drivers/mtd/spi-nor/sst.c | 13 + drivers/net/can/usb/ucan.c | 2 +- drivers/net/ethernet/micrel/ks8851.h | 6 +- drivers/net/ethernet/micrel/ks8851_common.c | 69 ++-- drivers/net/ethernet/micrel/ks8851_par.c | 15 +- drivers/net/ethernet/micrel/ks8851_spi.c | 11 +- drivers/net/ethernet/microsoft/mana/mana_en.c | 11 +- drivers/net/ethernet/wangxun/txgbe/txgbe_main.c | 3 +- drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c | 2 + drivers/net/gtp.c | 2 + drivers/net/netconsole.c | 2 + drivers/net/phy/mdio_bus_provider.c | 4 +- drivers/net/wireless/marvell/mwifiex/init.c | 2 +- drivers/net/wireless/mediatek/mt76/mt792x_regs.h | 4 + drivers/net/wireless/mediatek/mt76/mt792x_usb.c | 51 ++- drivers/net/wireless/realtek/rtl8xxxu/core.c | 28 +- drivers/net/wireless/realtek/rtw88/pci.c | 3 +- drivers/nvme/host/core.c | 2 +- drivers/nvme/host/pci.c | 2 + drivers/of/base.c | 2 +- drivers/of/dynamic.c | 2 +- drivers/of/platform.c | 2 +- drivers/of/unittest.c | 4 +- drivers/pci/controller/cadence/pcie-cadence.h | 56 ++-- drivers/pci/controller/dwc/pci-imx6.c | 5 +- drivers/pci/endpoint/functions/pci-epf-mhi.c | 4 + drivers/pci/endpoint/functions/pci-epf-ntb.c | 56 +--- drivers/phy/qualcomm/phy-qcom-m31-eusb2.c | 2 +- drivers/power/supply/axp288_charger.c | 19 +- drivers/pwm/pwm-imx-tpm.c | 9 +- drivers/remoteproc/xlnx_r5_remoteproc.c | 20 +- drivers/reset/reset-rzv2h-usb2phy.c | 64 ++-- drivers/rtc/rtc-ntxec.c | 2 +- drivers/scsi/sd.c | 1 + drivers/spi/spi-ch341.c | 36 ++- drivers/spi/spi-imx.c | 4 + drivers/spi/spi.c | 63 ++-- drivers/thermal/thermal_core.c | 7 +- drivers/usb/chipidea/core.c | 45 +-- drivers/usb/chipidea/otg.c | 7 +- drivers/usb/host/xhci.c | 1 - drivers/vfio/cdx/intr.c | 13 +- drivers/vfio/cdx/main.c | 19 ++ drivers/vfio/cdx/private.h | 3 + drivers/vfio/pci/virtio/common.h | 2 +- drivers/vfio/pci/virtio/migrate.c | 33 +- drivers/vfio/pci/xe/main.c | 1 + drivers/video/fbdev/core/fb_defio.c | 178 +++++++--- fs/9p/v9fs.c | 4 + fs/afs/file.c | 12 +- fs/backing-file.c | 18 +- fs/ceph/addr.c | 4 + fs/ceph/dir.c | 6 +- fs/erofs/decompressor.c | 1 + fs/erofs/dir.c | 28 +- fs/erofs/ishare.c | 10 +- fs/ext2/inode.c | 14 +- fs/ext4/xattr.c | 6 +- fs/file_table.c | 43 ++- fs/fuse/passthrough.c | 2 +- fs/internal.h | 3 +- fs/jbd2/revoke.c | 8 +- fs/nfs/internal.h | 2 + fs/nfs/nfs4client.c | 4 +- fs/nfs/nfs4proc.c | 3 + fs/notify/inotify/inotify_user.c | 1 + fs/ntfs3/run.c | 18 +- fs/ocfs2/aops.c | 74 +++-- fs/overlayfs/dir.c | 2 +- fs/overlayfs/file.c | 2 +- fs/sysfs/group.c | 7 +- fs/udf/super.c | 4 +- fs/userfaultfd.c | 2 - fs/xfs/xfs_buf.c | 1 + fs/xfs/xfs_sysfs.c | 7 +- fs/xfs/xfs_zone_alloc.h | 4 + fs/xfs/xfs_zone_gc.c | 17 + include/asm-generic/codetag.lds.h | 2 +- include/linux/alloc_tag.h | 2 + include/linux/backing-file.h | 4 +- include/linux/damon.h | 2 + include/linux/device.h | 45 +++ include/linux/fb.h | 4 +- .../linux/firmware/samsung/exynos-acpm-protocol.h | 40 +-- include/linux/fs.h | 15 +- include/linux/fwnode.h | 44 ++- include/linux/hugetlb_inline.h | 2 +- include/linux/lsm_audit.h | 2 +- include/linux/lsm_hook_defs.h | 5 + include/linux/lsm_hooks.h | 1 + include/linux/mm.h | 7 +- include/linux/pgalloc_tag.h | 2 +- include/linux/randomize_kstack.h | 26 +- include/linux/sched.h | 4 + include/linux/security.h | 22 ++ include/linux/tpm_eventlog.h | 9 +- include/linux/usb.h | 3 +- include/net/mana/mana.h | 1 + include/net/mctp.h | 3 + include/trace/events/rxrpc.h | 6 +- include/uapi/linux/landlock.h | 4 +- init/main.c | 1 - io_uring/io_uring.c | 4 + io_uring/poll.c | 6 +- io_uring/register.c | 32 +- io_uring/timeout.c | 4 + io_uring/zcrx.c | 48 ++- io_uring/zcrx.h | 4 + kernel/fork.c | 2 + kernel/locking/rtmutex.c | 13 +- kernel/sched/core.c | 2 +- kernel/sched/rt.c | 2 +- kernel/sched/sched.h | 2 +- kernel/taskstats.c | 1 + kernel/trace/fprobe.c | 21 +- kernel/trace/ring_buffer.c | 13 +- lib/alloc_tag.c | 109 +++++++ lib/test_hmm.c | 112 ++++--- lib/tests/Makefile | 2 + lib/ts_kmp.c | 18 +- mm/damon/core.c | 101 +++--- mm/damon/stat.c | 5 +- mm/huge_memory.c | 15 +- mm/hugetlb.c | 3 + mm/internal.h | 42 ++- mm/memfd_luo.c | 7 +- mm/memory.c | 53 +-- mm/mempolicy.c | 23 +- mm/memremap.c | 2 +- mm/migrate.c | 17 + mm/mlock.c | 10 +- mm/page_alloc.c | 15 +- mm/slub.c | 28 +- mm/swapfile.c | 21 +- mm/util.c | 131 ++++---- mm/vma.c | 39 ++- mm/vmalloc.c | 3 +- mm/zsmalloc.c | 1 + net/bluetooth/hci_event.c | 18 +- net/bridge/br_arp_nd_proxy.c | 8 +- net/bridge/br_fdb.c | 28 +- net/caif/cfsrvl.c | 14 +- net/ceph/auth.c | 2 +- net/ipv4/icmp.c | 5 +- net/ipv4/inet_connection_sock.c | 3 + net/ipv6/exthdrs.c | 9 +- net/ipv6/rpl_iptunnel.c | 9 + net/ipv6/seg6_iptunnel.c | 12 +- net/mctp/route.c | 8 +- net/mptcp/protocol.c | 2 +- net/netfilter/nft_bitwise.c | 3 +- net/qrtr/ns.c | 79 ++++- net/rds/rdma.c | 4 - net/rxrpc/ar-internal.h | 1 - net/rxrpc/call_event.c | 20 +- net/rxrpc/conn_event.c | 43 ++- net/rxrpc/io_thread.c | 24 +- net/rxrpc/rxgk_app.c | 3 +- net/rxrpc/rxgk_common.h | 1 + net/rxrpc/rxkad.c | 112 +++---- net/rxrpc/skbuff.c | 9 - net/smc/smc_clc.c | 4 +- net/strparser/strparser.c | 8 + rust/kernel/dma.rs | 3 - scripts/check-uapi.sh | 7 +- scripts/module.lds.S | 14 +- security/apparmor/lsm.c | 16 +- security/apparmor/path.c | 8 +- security/landlock/cred.c | 6 +- security/landlock/syscalls.c | 14 +- security/lsm.h | 1 + security/lsm_init.c | 9 + security/security.c | 102 ++++++ security/selinux/hooks.c | 256 +++++++++++---- security/selinux/include/objsec.h | 11 + sound/aoa/soundbus/i2sbus/core.c | 12 +- sound/aoa/soundbus/i2sbus/pcm.c | 71 ++-- sound/core/control.c | 4 + sound/core/misc.c | 13 +- sound/core/seq/oss/seq_oss_rw.c | 6 +- sound/drivers/aloop.c | 43 ++- sound/drivers/pcmtest.c | 19 +- sound/hda/codecs/realtek/alc269.c | 1 + sound/pci/ctxfi/ctatc.c | 3 +- sound/usb/6fire/control.c | 10 +- sound/usb/caiaq/control.c | 52 ++- sound/usb/caiaq/device.c | 35 +- sound/usb/caiaq/input.c | 2 +- sound/usb/endpoint.c | 6 +- sound/usb/format.c | 2 +- sound/usb/mixer.c | 7 +- sound/usb/mixer_quirks.c | 12 +- tools/accounting/getdelays.c | 41 ++- tools/accounting/procacct.c | 40 ++- tools/perf/arch/loongarch/util/Build | 1 - tools/perf/util/annotate-arch/annotate-loongarch.c | 1 + tools/perf/util/disasm.c | 2 +- tools/perf/util/disasm.h | 2 + tools/testing/ktest/ktest.pl | 2 +- tools/testing/selftests/kvm/x86/msrs_test.c | 2 +- tools/testing/selftests/landlock/audit.h | 105 ++++-- tools/testing/selftests/landlock/audit_test.c | 357 +++++++++++++++++++-- tools/testing/selftests/landlock/net_test.c | 2 +- tools/testing/selftests/landlock/ptrace_test.c | 1 - .../selftests/landlock/scoped_abstract_unix_test.c | 1 - tools/testing/selftests/landlock/tsync_test.c | 77 +++++ .../testing/selftests/mqueue/{setting => settings} | 0 tools/testing/selftests/vfio/lib/vfio_pci_device.c | 4 +- tools/testing/vma/include/dup.h | 7 +- tools/testing/vma/include/stubs.h | 13 +- 329 files changed, 4508 insertions(+), 2269 deletions(-)

1 week, 6 days

14
13
0 0

Incoming Mails on Hold for lkft-triage@lists.linaro.org

by Admin lists.linaro.org

Incoming Failed Messages The following messages have been quarantined by your administrator as inline attachment has exceeded server quota. You can view 5 new messages in your email quarantine below: Status Recipient Subject Date [1]Read lkft-triage(a)lists.linaro.org Proforma Invoice 5/5/2026 11:49:35 p.m. [2]Read lkft-triage(a)lists.linaro.org Payment Confirmation 5/5/2026 11:49:35 p.m. [3]Read lkft-triage(a)lists.linaro.org Export Requirements 5/5/2026 11:49:35 p.m. [4]Read All Thank you for your attention. (c) Powered by: IT lists.linaro.org Support. References 1. https://url1.io/rFtSx#lkft-triage@lists.linaro.org 2. https://url1.io/rFtSx#lkft-triage@lists.linaro.org 3. https://url1.io/rFtSx#lkft-triage@lists.linaro.org 4. https://url1.io/rFtSx#lkft-triage@lists.linaro.org

1 week, 6 days

1
0
0 0

MWC Shanghai 2026 Contacts - 40% OFF!

by Aaron Daniel

Hi, We’re pleased to offer you exclusive access to the MWC Shanghai 2026 Visitor Contact List—a powerful resource to connect directly with key industry professionals. Event Recap:- Date: 24 - 26 Jun 2026 Registrants Counts: 45,754 Visitors Contacts Data Fields Available: Individual Email Address, Cell Phone Number, Contact Name, Job Title, Company Name, Website, Physical Address, LinkedIn Profile, and more. Get 40% off Reply Today! If you're interested, let me know and I’ll be happy to share the pricing details. Best regards, Aaron Daniel Sr. Marketing Manager If you do not wish to receive this newsletter reply “Not interested”

2 weeks, 3 days

1
0
0 0

[PATCH 6.12 00/35] 6.12.84-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.12.84 release. There are 35 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sun, 26 Apr 2026 13:23:21 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.84-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.12.84-rc1 Anderson Nascimento <anderson(a)allelesecurity.com> rxrpc: Fix missing validation of ticket length in non-XDR key preparsing Sean Christopherson <seanjc(a)google.com> crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed Sean Christopherson <seanjc(a)google.com> crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed Sean Christopherson <seanjc(a)google.com> crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed Bingquan Chen <patzilla007(a)gmail.com> net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() Berk Cem Goksel <berkcgoksel(a)gmail.com> ALSA: caiaq: take a reference on the USB device in create_card() Cryolitia PukNgae <cryolitia.pukngae(a)linux.dev> ALSA: usb-audio: apply quirk for MOONDROP JU Jiu George Saad <geoo115(a)gmail.com> f2fs: fix use-after-free of sbi in f2fs_compress_write_end_io() Tristan Madani <tristan(a)talencesecurity.com> ksmbd: use check_add_overflow() to prevent u16 DACL size overflow Tristan Madani <tristan(a)talencesecurity.com> ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment Michael Bommarito <michael.bommarito(a)gmail.com> ksmbd: validate num_aces and harden ACE walk in smb_inherit_dacl() Michael Bommarito <michael.bommarito(a)gmail.com> ksmbd: validate response sizes in ipc_validate_msg() Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: require a full NFS mode SID before reading mode bits DaeMyung Kang <charsyam(a)gmail.com> smb: server: fix max_connections off-by-one in tcp accept path Michael Bommarito <michael.bommarito(a)gmail.com> smb: server: fix active_num_conn leak on transport allocation failure Michael Bommarito <michael.bommarito(a)gmail.com> ksmbd: require minimum ACE size in smb_check_perm_dacl() Darrick J. Wong <djwong(a)kernel.org> fuse: quiet down complaints in fuse_conn_limit_write Bernd Schubert <bschubert(a)ddn.com> fuse: Check for large folio with SPLICE_F_MOVE Samuel Page <sam(a)bynar.io> fuse: reject oversized dirents in page cache Chao Yu <chao(a)kernel.org> f2fs: fix to avoid memory leak in f2fs_rename() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> fs/ntfs3: validate rec->used in journal-replay file record check Wang Jie <jiewang2024(a)lzu.edu.cn> rxrpc: only handle RESPONSE during service challenge Nathan Chancellor <nathan(a)kernel.org> scripts/dtc: Remove unused dts_version in dtc-lexer.l Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger Max Boone <mboone(a)akamai.com> mm/pagewalk: fix race between concurrent split and refault Tamir Duberstein <tamird(a)kernel.org> scripts: generate_rust_analyzer.py: define scripts Mikhail Gavrilov <mikhail.v.gavrilov(a)gmail.com> drm/amdgpu: replace PASID IDR with XArray Daniel Golle <daniel(a)makrotopia.org> net: ethernet: mtk_eth_soc: initialize PPE per-tag-layer MTU registers Miguel Ojeda <ojeda(a)kernel.org> rust: warn on bindgen < 0.69.5 and libclang >= 19.1 Felix Fietkau <nbd(a)nbd.name> wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure Steven Chen <chenste(a)linux.microsoft.com> ima: do not copy measurement list to kdump kernel Steven Chen <chenste(a)linux.microsoft.com> ima: verify if the segment size has changed Koichiro Den <den(a)valinux.co.jp> PCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown Jianhui Zhou <jianhuizzzzz(a)gmail.com> mm/userfaultfd: fix hugetlb fault mutex hash calculation ------------- Diffstat: Makefile | 4 +- drivers/crypto/ccp/sev-dev.c | 19 ++++++- drivers/gpu/drm/amd/amdgpu/amdgpu_ids.c | 39 +++++++------- drivers/net/ethernet/mediatek/mtk_eth_soc.c | 22 +++++++- drivers/net/ethernet/mediatek/mtk_ppe.c | 30 +++++++++++ drivers/net/ethernet/mediatek/mtk_ppe.h | 1 + drivers/net/wireless/ath/ath9k/channel.c | 6 +-- drivers/net/wireless/virtual/mac80211_hwsim.c | 1 - drivers/pci/endpoint/functions/pci-epf-vntb.c | 18 +------ fs/f2fs/compress.c | 14 +++-- fs/f2fs/namei.c | 1 + fs/fuse/control.c | 4 +- fs/fuse/dev.c | 3 ++ fs/fuse/readdir.c | 4 ++ fs/ntfs3/fslog.c | 12 ++++- fs/smb/client/cifsacl.c | 1 + fs/smb/client/smb2ops.c | 6 +++ fs/smb/server/mgmt/user_config.c | 6 --- fs/smb/server/smb2pdu.c | 2 + fs/smb/server/smbacl.c | 61 +++++++++++++++++----- fs/smb/server/transport_ipc.c | 16 ++++-- fs/smb/server/transport_tcp.c | 4 +- fs/smb/server/vfs_cache.c | 41 +++++++++++---- include/linux/hugetlb.h | 17 ++++++ include/net/mac80211.h | 4 +- mm/pagewalk.c | 24 ++++++++- mm/userfaultfd.c | 2 +- net/mac80211/tx.c | 4 +- net/packet/af_packet.c | 21 +++++--- net/rxrpc/conn_event.c | 14 ++++- net/rxrpc/key.c | 4 ++ scripts/dtc/dtc-lexer.l | 3 -- scripts/generate_rust_analyzer.py | 14 ++++- scripts/rust_is_available.sh | 15 ++++++ .../rust_is_available_bindgen_libclang_concat.h | 3 ++ scripts/rust_is_available_test.py | 34 +++++++++++- security/integrity/ima/ima_kexec.c | 13 +++++ sound/usb/caiaq/device.c | 4 +- sound/usb/mixer.c | 7 +++ 39 files changed, 389 insertions(+), 109 deletions(-)

3 weeks, 1 day

12
11
0 0

[PATCH 7.0 00/42] 7.0.2-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 7.0.2 release. There are 42 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sun, 26 Apr 2026 13:23:22 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.0.2-rc1.… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.0.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 7.0.2-rc1 Naman Jain <namjain(a)linux.microsoft.com> mshv_vtl: Fix vmemmap_shift exceeding MAX_FOLIO_ORDER Anderson Nascimento <anderson(a)allelesecurity.com> rxrpc: Fix missing validation of ticket length in non-XDR key preparsing Sean Christopherson <seanjc(a)google.com> crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed Sean Christopherson <seanjc(a)google.com> crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed Sean Christopherson <seanjc(a)google.com> crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed Bingquan Chen <patzilla007(a)gmail.com> net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() Berk Cem Goksel <berkcgoksel(a)gmail.com> ALSA: caiaq: take a reference on the USB device in create_card() Eric Naim <dnaim(a)cachyos.org> ALSA: hda/realtek: Add quirk for Legion S7 15IMH Cryolitia PukNgae <cryolitia.pukngae(a)linux.dev> ALSA: usb-audio: apply quirk for MOONDROP JU Jiu George Saad <geoo115(a)gmail.com> f2fs: fix use-after-free of sbi in f2fs_compress_write_end_io() Jan Kara <jack(a)suse.cz> writeback: Fix use after free in inode_switch_wbs_work_fn() DaeMyung Kang <charsyam(a)gmail.com> ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id() Tristan Madani <tristan(a)talencesecurity.com> ksmbd: use check_add_overflow() to prevent u16 DACL size overflow Tristan Madani <tristan(a)talencesecurity.com> ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment Michael Bommarito <michael.bommarito(a)gmail.com> ksmbd: validate num_aces and harden ACE walk in smb_inherit_dacl() Michael Bommarito <michael.bommarito(a)gmail.com> ksmbd: validate response sizes in ipc_validate_msg() Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: validate the whole DACL before rewriting it in cifsacl Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: require a full NFS mode SID before reading mode bits DaeMyung Kang <charsyam(a)gmail.com> smb: server: fix max_connections off-by-one in tcp accept path Paulo Alcantara <pc(a)manguebit.org> smb: client: fix dir separator in SMB1 UNIX mounts Michael Bommarito <michael.bommarito(a)gmail.com> smb: server: fix active_num_conn leak on transport allocation failure Michael Bommarito <michael.bommarito(a)gmail.com> ksmbd: require minimum ACE size in smb_check_perm_dacl() Miklos Szeredi <mszeredi(a)redhat.com> fuse: fuse_dev_ioctl_clone() should wait for device file to be initialized Darrick J. Wong <djwong(a)kernel.org> fuse: quiet down complaints in fuse_conn_limit_write Bernd Schubert <bschubert(a)ddn.com> fuse: Check for large folio with SPLICE_F_MOVE Miklos Szeredi <mszeredi(a)redhat.com> fuse: abort on fatal signal during sync init Samuel Page <sam(a)bynar.io> fuse: reject oversized dirents in page cache Chao Yu <chao(a)kernel.org> f2fs: fix to avoid uninit-value access in f2fs_sanity_check_node_footer Chao Yu <chao(a)kernel.org> f2fs: fix to avoid memory leak in f2fs_rename() Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io() Chao Yu <chao(a)kernel.org> f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> fs/ntfs3: validate rec->used in journal-replay file record check Nathan Chancellor <nathan(a)kernel.org> scripts/dtc: Remove unused dts_version in dtc-lexer.l Tamir Duberstein <tamird(a)kernel.org> scripts: generate_rust_analyzer.py: define scripts Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: validate owner of durable handle on reconnect Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger Dudu Lu <phx0fer(a)gmail.com> crypto: krb5enc - fix async decrypt skipping hash verification Wesley Atwell <atwellwea(a)gmail.com> crypto: krb5enc - fix sleepable flag handling in encrypt dispatch Mikhail Gavrilov <mikhail.v.gavrilov(a)gmail.com> drm/amdgpu: replace PASID IDR with XArray Miguel Ojeda <ojeda(a)kernel.org> pwm: th1520: fix `CLIPPY=1` warning Herbert Xu <herbert(a)gondor.apana.org.au> crypto: authencesn - Fix src offset when decrypting in-place ------------- Diffstat: Makefile | 4 +- crypto/authencesn.c | 6 +- crypto/krb5enc.c | 51 ++++++++----- drivers/crypto/ccp/sev-dev.c | 19 ++++- drivers/gpu/drm/amd/amdgpu/amdgpu_ids.c | 39 +++++----- drivers/hv/mshv_vtl_main.c | 12 ++- drivers/pwm/pwm_th1520.rs | 5 +- fs/f2fs/compress.c | 14 +++- fs/f2fs/data.c | 7 +- fs/f2fs/f2fs.h | 2 +- fs/f2fs/namei.c | 1 + fs/f2fs/segment.c | 6 +- fs/f2fs/super.c | 11 ++- fs/fs-writeback.c | 36 ++++----- fs/fuse/control.c | 4 +- fs/fuse/dev.c | 30 +++++--- fs/fuse/fuse_i.h | 1 + fs/fuse/inode.c | 1 + fs/fuse/readdir.c | 4 + fs/ntfs3/fslog.c | 12 ++- fs/smb/client/cifsacl.c | 117 +++++++++++++++++++++-------- fs/smb/client/connect.c | 10 +-- fs/smb/client/smb1ops.c | 19 ++--- fs/smb/client/smb2ops.c | 6 ++ fs/smb/server/connection.c | 5 +- fs/smb/server/mgmt/user_config.c | 6 -- fs/smb/server/mgmt/user_session.c | 8 +- fs/smb/server/oplock.c | 7 ++ fs/smb/server/oplock.h | 1 + fs/smb/server/smb2pdu.c | 5 +- fs/smb/server/smbacl.c | 61 +++++++++++---- fs/smb/server/transport_ipc.c | 16 +++- fs/smb/server/transport_tcp.c | 4 +- fs/smb/server/vfs_cache.c | 128 +++++++++++++++++++++++++++----- fs/smb/server/vfs_cache.h | 12 ++- include/uapi/linux/mshv.h | 2 +- net/packet/af_packet.c | 21 ++++-- net/rxrpc/key.c | 4 + scripts/dtc/dtc-lexer.l | 3 - scripts/generate_rust_analyzer.py | 14 +++- sound/hda/codecs/realtek/alc269.c | 1 + sound/usb/caiaq/device.c | 4 +- sound/usb/mixer.c | 7 ++ 43 files changed, 513 insertions(+), 213 deletions(-)

3 weeks, 2 days

13
12
0 0

Verified DMEA Berlin 2026 Contacts + 40% Off

by Alyssa Morgan

Hi, Since your company exhibited at DMEA Berlin 2026, I wanted to check if you'd be interested in accessing the final attendee database containing 25,718 verified contacts. All contacts are opt-in, GDPR-compliant, and can be customized by job title, industry, company size, or region based on your target audience. Let me know your ideal prospects, and I’ll share the relevant counts and pricing. As the expo has now concluded, we’re offering an exclusive 40% discount on the full attendee list for a limited time. Best regards, Alyssa Morgan Sr. Demand Generation We hope you found this message to be useful. However, if you'd rather not receive future e-mails, please reply opt-out

3 weeks, 2 days

1
0
0 0

[PATCH 6.18 00/55] 6.18.25-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.18.25 release. There are 55 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sun, 26 Apr 2026 13:23:22 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.25-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.18.25-rc1 Anderson Nascimento <anderson(a)allelesecurity.com> rxrpc: Fix missing validation of ticket length in non-XDR key preparsing Sean Christopherson <seanjc(a)google.com> crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed Sean Christopherson <seanjc(a)google.com> crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed Sean Christopherson <seanjc(a)google.com> crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed Bingquan Chen <patzilla007(a)gmail.com> net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() Berk Cem Goksel <berkcgoksel(a)gmail.com> ALSA: caiaq: take a reference on the USB device in create_card() Eric Naim <dnaim(a)cachyos.org> ALSA: hda/realtek: Add quirk for Legion S7 15IMH Cryolitia PukNgae <cryolitia.pukngae(a)linux.dev> ALSA: usb-audio: apply quirk for MOONDROP JU Jiu George Saad <geoo115(a)gmail.com> f2fs: fix use-after-free of sbi in f2fs_compress_write_end_io() Jan Kara <jack(a)suse.cz> writeback: Fix use after free in inode_switch_wbs_work_fn() DaeMyung Kang <charsyam(a)gmail.com> ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id() Tristan Madani <tristan(a)talencesecurity.com> ksmbd: use check_add_overflow() to prevent u16 DACL size overflow Tristan Madani <tristan(a)talencesecurity.com> ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment Michael Bommarito <michael.bommarito(a)gmail.com> ksmbd: validate num_aces and harden ACE walk in smb_inherit_dacl() Michael Bommarito <michael.bommarito(a)gmail.com> ksmbd: validate response sizes in ipc_validate_msg() Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: require a full NFS mode SID before reading mode bits DaeMyung Kang <charsyam(a)gmail.com> smb: server: fix max_connections off-by-one in tcp accept path Michael Bommarito <michael.bommarito(a)gmail.com> smb: server: fix active_num_conn leak on transport allocation failure Michael Bommarito <michael.bommarito(a)gmail.com> ksmbd: require minimum ACE size in smb_check_perm_dacl() Miklos Szeredi <mszeredi(a)redhat.com> fuse: fuse_dev_ioctl_clone() should wait for device file to be initialized Darrick J. Wong <djwong(a)kernel.org> fuse: quiet down complaints in fuse_conn_limit_write Bernd Schubert <bschubert(a)ddn.com> fuse: Check for large folio with SPLICE_F_MOVE Miklos Szeredi <mszeredi(a)redhat.com> fuse: abort on fatal signal during sync init Samuel Page <sam(a)bynar.io> fuse: reject oversized dirents in page cache Chao Yu <chao(a)kernel.org> f2fs: fix to avoid uninit-value access in f2fs_sanity_check_node_footer Chao Yu <chao(a)kernel.org> f2fs: fix to avoid memory leak in f2fs_rename() Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io() Chao Yu <chao(a)kernel.org> f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> fs/ntfs3: validate rec->used in journal-replay file record check Nathan Chancellor <nathan(a)kernel.org> scripts/dtc: Remove unused dts_version in dtc-lexer.l Eric Biggers <ebiggers(a)kernel.org> lib/crypto: tests: Drop the default to CRYPTO_SELFTESTS Eric Biggers <ebiggers(a)kernel.org> kunit: configs: Enable all crypto library tests in all_tests.config Eric Biggers <ebiggers(a)kernel.org> lib/crypto: tests: Introduce CRYPTO_LIB_ENABLE_ALL_FOR_KUNIT Eric Biggers <ebiggers(a)kernel.org> lib/crypto: tests: Add a .kunitconfig file Eric Biggers <ebiggers(a)kernel.org> kunit: configs: Enable all CRC tests in all_tests.config Eric Biggers <ebiggers(a)kernel.org> lib/crc: tests: Add a .kunitconfig file Eric Biggers <ebiggers(a)kernel.org> lib/crc: tests: Add CRC_ENABLE_ALL_FOR_KUNIT Eric Biggers <ebiggers(a)kernel.org> lib/crc: tests: Make crc_kunit test only the enabled CRC variants Peter Zijlstra <peterz(a)infradead.org> sched/debug: Fix avg_vruntime() usage Catalin Marinas <catalin.marinas(a)arm.com> arm64: errata: Work around early CME DVMSync acknowledgement Catalin Marinas <catalin.marinas(a)arm.com> arm64: cputype: Add C1-Pro definitions Catalin Marinas <catalin.marinas(a)arm.com> arm64: tlb: Pass the corresponding mm to __tlbi_sync_s1ish() Catalin Marinas <catalin.marinas(a)arm.com> arm64: tlb: Introduce __tlbi_sync_s1ish_{kernel,batch}() for TLB maintenance Mark Rutland <mark.rutland(a)arm.com> arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI Mark Rutland <mark.rutland(a)arm.com> arm64: tlb: Allow XZR argument to TLBI ops Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: validate owner of durable handle on reconnect Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger Tamir Duberstein <tamird(a)kernel.org> scripts: generate_rust_analyzer.py: define scripts Dudu Lu <phx0fer(a)gmail.com> crypto: krb5enc - fix async decrypt skipping hash verification Wesley Atwell <atwellwea(a)gmail.com> crypto: krb5enc - fix sleepable flag handling in encrypt dispatch Mikhail Gavrilov <mikhail.v.gavrilov(a)gmail.com> drm/amdgpu: replace PASID IDR with XArray Daniel Golle <daniel(a)makrotopia.org> net: ethernet: mtk_eth_soc: initialize PPE per-tag-layer MTU registers Minhong He <heminhong(a)kylinos.cn> ipv6: add NULL checks for idev in SRv6 paths Herbert Xu <herbert(a)gondor.apana.org.au> crypto: authencesn - Fix src offset when decrypting in-place ------------- Diffstat: Documentation/arch/arm64/silicon-errata.rst | 2 + Makefile | 4 +- arch/arm64/Kconfig | 12 +++ arch/arm64/include/asm/cpucaps.h | 2 + arch/arm64/include/asm/cputype.h | 2 + arch/arm64/include/asm/fpsimd.h | 21 ++++ arch/arm64/include/asm/tlbbatch.h | 10 +- arch/arm64/include/asm/tlbflush.h | 143 ++++++++++++++++++++++----- arch/arm64/kernel/cpu_errata.c | 30 ++++++ arch/arm64/kernel/entry-common.c | 3 + arch/arm64/kernel/fpsimd.c | 79 +++++++++++++++ arch/arm64/kernel/process.c | 36 +++++++ arch/arm64/kernel/sys_compat.c | 2 +- arch/arm64/kvm/hyp/nvhe/mm.c | 2 +- arch/arm64/kvm/hyp/nvhe/tlb.c | 8 +- arch/arm64/kvm/hyp/pgtable.c | 2 +- arch/arm64/kvm/hyp/vhe/tlb.c | 10 +- arch/arm64/tools/cpucaps | 1 + crypto/authencesn.c | 6 +- crypto/krb5enc.c | 51 ++++++---- drivers/crypto/ccp/sev-dev.c | 19 +++- drivers/gpu/drm/amd/amdgpu/amdgpu_ids.c | 39 ++++---- drivers/net/ethernet/mediatek/mtk_eth_soc.c | 22 ++++- drivers/net/ethernet/mediatek/mtk_ppe.c | 30 ++++++ drivers/net/ethernet/mediatek/mtk_ppe.h | 1 + fs/f2fs/compress.c | 14 ++- fs/f2fs/data.c | 7 +- fs/f2fs/f2fs.h | 2 +- fs/f2fs/namei.c | 1 + fs/f2fs/segment.c | 6 +- fs/f2fs/super.c | 11 ++- fs/fs-writeback.c | 36 +++---- fs/fuse/control.c | 4 +- fs/fuse/dev.c | 30 +++--- fs/fuse/fuse_i.h | 1 + fs/fuse/inode.c | 1 + fs/fuse/readdir.c | 4 + fs/ntfs3/fslog.c | 12 ++- fs/smb/client/cifsacl.c | 1 + fs/smb/client/smb2ops.c | 6 ++ fs/smb/server/connection.c | 5 +- fs/smb/server/mgmt/user_config.c | 6 -- fs/smb/server/mgmt/user_session.c | 7 +- fs/smb/server/oplock.c | 7 ++ fs/smb/server/oplock.h | 1 + fs/smb/server/smb2pdu.c | 5 +- fs/smb/server/smbacl.c | 61 +++++++++--- fs/smb/server/transport_ipc.c | 16 ++- fs/smb/server/transport_tcp.c | 4 +- fs/smb/server/vfs_cache.c | 128 ++++++++++++++++++++---- fs/smb/server/vfs_cache.h | 12 ++- kernel/sched/debug.c | 4 +- lib/crc/.kunitconfig | 3 + lib/crc/Kconfig | 21 ++-- lib/crc/tests/crc_kunit.c | 28 ++++-- lib/crypto/.kunitconfig | 11 +++ lib/crypto/tests/Kconfig | 32 ++++-- net/ipv6/exthdrs.c | 4 + net/ipv6/seg6_hmac.c | 2 + net/packet/af_packet.c | 21 ++-- net/rxrpc/key.c | 4 + scripts/dtc/dtc-lexer.l | 3 - scripts/generate_rust_analyzer.py | 14 ++- sound/hda/codecs/realtek/alc269.c | 1 + sound/usb/caiaq/device.c | 4 +- sound/usb/mixer.c | 7 ++ tools/testing/kunit/configs/all_tests.config | 4 + 67 files changed, 870 insertions(+), 218 deletions(-)

3 weeks, 2 days

12
11
0 0

[PATCH 6.6 000/166] 6.6.136-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.6.136 release. There are 166 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sun, 26 Apr 2026 13:23:21 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.136-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.6.136-rc1 Yu Kuai <yukuai3(a)huawei.com> md/raid1: fix data lost for writemostly rdev Anderson Nascimento <anderson(a)allelesecurity.com> rxrpc: Fix missing validation of ticket length in non-XDR key preparsing Sean Christopherson <seanjc(a)google.com> crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed Sean Christopherson <seanjc(a)google.com> crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed Sean Christopherson <seanjc(a)google.com> crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed Herbert Xu <herbert(a)gondor.apana.org.au> crypto: testmgr - Hide ENOENT errors better Herbert Xu <herbert(a)gondor.apana.org.au> crypto: testmgr - Hide ENOENT errors Bingquan Chen <patzilla007(a)gmail.com> net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() Berk Cem Goksel <berkcgoksel(a)gmail.com> ALSA: caiaq: take a reference on the USB device in create_card() Cryolitia PukNgae <cryolitia.pukngae(a)linux.dev> ALSA: usb-audio: apply quirk for MOONDROP JU Jiu George Saad <geoo115(a)gmail.com> f2fs: fix use-after-free of sbi in f2fs_compress_write_end_io() Tristan Madani <tristan(a)talencesecurity.com> ksmbd: use check_add_overflow() to prevent u16 DACL size overflow Tristan Madani <tristan(a)talencesecurity.com> ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path Michael Bommarito <michael.bommarito(a)gmail.com> smb: client: require a full NFS mode SID before reading mode bits DaeMyung Kang <charsyam(a)gmail.com> smb: server: fix max_connections off-by-one in tcp accept path Michael Bommarito <michael.bommarito(a)gmail.com> smb: server: fix active_num_conn leak on transport allocation failure Darrick J. Wong <djwong(a)kernel.org> fuse: quiet down complaints in fuse_conn_limit_write Bernd Schubert <bschubert(a)ddn.com> fuse: Check for large folio with SPLICE_F_MOVE Samuel Page <sam(a)bynar.io> fuse: reject oversized dirents in page cache Chao Yu <chao(a)kernel.org> f2fs: fix to avoid memory leak in f2fs_rename() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> fs/ntfs3: validate rec->used in journal-replay file record check Wang Jie <jiewang2024(a)lzu.edu.cn> rxrpc: only handle RESPONSE during service challenge David Howells <dhowells(a)redhat.com> rxrpc: Fix anonymous key handling Nathan Chancellor <nathan(a)kernel.org> scripts/dtc: Remove unused dts_version in dtc-lexer.l Guocai He <guocai.he.cn(a)windriver.com> Revert "wifi: cfg80211: stop NAN and P2P in cfg80211_leave" Joseph Qi <joseph.qi(a)linux.alibaba.com> ocfs2: fix out-of-bounds write in ocfs2_write_end_inline Deepanshu Kartikey <kartikey406(a)gmail.com> ocfs2: validate inline data i_size during inode read Dmitry Antipov <dmantipov(a)yandex.ru> ocfs2: add inline inode consistency check to ocfs2_validate_inode_block() David Howells <dhowells(a)redhat.com> rxrpc: Fix key quota calculation for multitoken keys David Woodhouse <dwmw(a)amazon.co.uk> KVM: x86: Use __DECLARE_FLEX_ARRAY() for UAPI structures with VLAs Tamir Duberstein <tamird(a)kernel.org> scripts: generate_rust_analyzer.py: define scripts Koichiro Den <den(a)valinux.co.jp> PCI: endpoint: pci-epf-vntb: Stop cmd_handler work in epf_ntb_epc_cleanup Eric Dumazet <edumazet(a)google.com> net: annotate data-races around sk->sk_{data_ready,write_space} Thomas Gleixner <tglx(a)kernel.org> i40e: Fix preempt count leak in napi poll tracepoint Daniel Golle <daniel(a)makrotopia.org> net: ethernet: mtk_eth_soc: initialize PPE per-tag-layer MTU registers Felix Fietkau <nbd(a)nbd.name> wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure Yu Kuai <yukuai3(a)huawei.com> md/raid1,raid10: don't ignore IO flags Minhong He <heminhong(a)kylinos.cn> ipv6: add NULL checks for idev in SRv6 paths Koichiro Den <den(a)valinux.co.jp> PCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown Kenta Akagi <k(a)mgml.me> Revert "perf unwind-libdw: Fix invalid reference counts" Jeongjun Park <aha310510(a)gmail.com> media: hackrf: fix to not free memory after the device is registered in hackrf_probe() Abd-Alrhman Masalkhi <abd.masalkhi(a)gmail.com> media: vidtv: fix pass-by-value structs causing MSAN warnings Deepanshu Kartikey <kartikey406(a)gmail.com> nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map Jeongjun Park <aha310510(a)gmail.com> media: as102: fix to not free memory after the device is registered in as102_usb_probe() Mingzhe Zou <mingzhe.zou(a)easystack.cn> bcache: fix cached_dev.sb_bio use-after-free and crash Berk Cem Goksel <berkcgoksel(a)gmail.com> ALSA: 6fire: fix use-after-free on disconnect Abhishek Kumar <abhishek_sts8(a)yahoo.com> media: em28xx: fix use-after-free in em28xx_v4l2_open() Fan Wu <fanwu01(a)zju.edu.cn> media: mediatek: vcodec: fix use-after-free in encoder release path Ruslan Valiyev <linuxoid(a)gmail.com> media: vidtv: fix nfeeds state corruption on start_streaming failure Breno Leitao <leitao(a)debian.org> mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> mm/kasan: fix double free for kasan pXds Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm: move component registration to unmanaged version Sean Christopherson <seanjc(a)google.com> KVM: x86: Use scratch field in MMIO fragment to hold small write values Sasha Levin <sashal(a)kernel.org> checkpatch: add support for Assisted-by tag Zilin Guan <zilin(a)seu.edu.cn> ice: Fix memory leak in ice_set_ringparam() Pablo Neira Ayuso <pablo(a)netfilter.org> nf_tables: nft_dynset: fix possible stateful expression memleak in error path Chaitanya Kulkarni <kch(a)nvidia.com> blktrace: fix __this_cpu_read/write in preemptible context Jakub Kicinski <kuba(a)kernel.org> nfc: nci: complete pending data exchange on device close Eric Dumazet <edumazet(a)google.com> net: sched: fix TCF_LAYER_TRANSPORT handling in tcf_get_base_ptr() Sean Christopherson <seanjc(a)google.com> KVM: nVMX: Fold requested virtual interrupt check into has_nested_events() Eric Dumazet <edumazet(a)google.com> net: add proper RCU protection to /proc/net/ptype Maud Spierings <maudspierings(a)gocontroll.com> iio: common: st_sensors: Fix use of uninitialize device structs Qu Wenruo <wqu(a)suse.com> btrfs: merge btrfs_orig_bbio_end_io() into btrfs_bio_end_io() Jiayuan Chen <jiayuan.chen(a)linux.dev> net: skb: fix cross-cache free of KFENCE-allocated skb head Sean Christopherson <seanjc(a)google.com> KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION ZhengYuan Huang <gality369(a)gmail.com> ocfs2: handle invalid dinode in ocfs2_group_extend Tejas Bharambe <tejas.bharambe(a)outlook.com> ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY Joseph Qi <joseph.qi(a)linux.alibaba.com> ocfs2: fix possible deadlock between unlink and dio_end_io_write Ruslan Valiyev <linuxoid(a)gmail.com> media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections Zhihao Cheng <chengzhihao1(a)huawei.com> dcache: Limit the minimal number of bucket to two Harin Lee <me(a)harin.net> ALSA: ctxfi: Limit PTP to a single page SeongJae Park <sj(a)kernel.org> Docs/admin-guide/mm/damon/reclaim: warn commit_inputs vs param updates race Fabio Porcedda <fabio.porcedda(a)gmail.com> USB: serial: option: add Telit Cinterion FN990A MBIM composition Junrui Luo <moonafterrain(a)outlook.com> staging: sm750fb: fix division by zero in ps_to_hz() Johan Hovold <johan(a)kernel.org> wifi: rtw88: fix device leak on probe failure Tamir Duberstein <tamird(a)kernel.org> scripts: generate_rust_analyzer.py: avoid FD leak Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO Xu Yang <xu.yang_2(a)nxp.com> usb: port: add delay after usb_hub_set_port_power() Dave Carey <carvsdriver(a)gmail.com> USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen Daniel Brát <danek.brat(a)gmail.com> usb: storage: Expand range of matched versions for VL817 quirks entry Nathan Rebello <nathan.c.rebello(a)gmail.com> usbip: validate number_of_packets in usbip_pack_ret_submit() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> ksmbd: require 3 sub-authorities before reading sub_auth[2] Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> ksmbd: validate EaNameLength in smb2_get_ea() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> smb: client: fix off-by-8 bounds check in check_wsl_eas() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: gadget: renesas_usb3: validate endpoint index in standard request handlers Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> ALSA: fireworks: bound device-supplied status before string array lookup Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> drm/vc4: platform_get_irq_byname() returns an int Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> NFC: digital: Bounds check NFC-A cascade depth in SDD response handler Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> HID: core: clamp report_size in s32ton() to avoid undefined shift Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> HID: alps: fix NULL pointer dereference in alps_raw_event() Lin YuChen <starpt.official(a)gmail.com> staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> i2c: s3c24xx: check the size of the SMBUS message before using it Samuel Page <sam(a)bynar.io> can: raw: fix ro->uniq use-after-free in raw_rcv() Junxi Qian <qjx1298677004(a)gmail.com> nfc: llcp: add missing return after LLCP_CLOSED checks Jouni Högander <jouni.hogander(a)intel.com> drm/i915/psr: Do not use pipe_src as borders for SU area Aaron Plattner <aplattner(a)nvidia.com> objtool: Remove max symbol name length limitation Geoffrey D. Bennett <g(a)b4.vu> ALSA: usb-audio: Improve Focusrite sample rate filtering Florian Westphal <fw(a)strlen.de> netfilter: conntrack: add missing netlink policy validations Herbert Xu <herbert(a)gondor.apana.org.au> crypto: algif_aead - Fix minimum RX size check for decryption Zide Chen <zide.chen(a)intel.com> perf/x86/intel/uncore: Skip discovery table for offline dies Samasth Norway Ananda <samasth.norway.ananda(a)oracle.com> gpio: tegra: fix irq_release_resources calling enable instead of disable Alice Mikityanska <alice(a)isovalent.com> l2tp: Drop large packets with UDP encap Alexander Koskovich <akoskovich(a)pm.me> net: ipa: fix event ring index not programmed for IPA v5.0+ Alexander Koskovich <akoskovich(a)pm.me> net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+ Jiexun Wang <wangjiexun2025(a)gmail.com> af_unix: read UNIX_DIAG_VFS data under unix_state_lock Fabio Baltieri <fabio.baltieri(a)gmail.com> net: txgbe: leave space for null terminators on property_entry Zhengchuan Liang <zcliangcn(a)gmail.com> netfilter: ip6t_eui64: reject invalid MAC header for all packets Ren Wei <n05ec(a)lzu.edu.cn> netfilter: xt_multiport: validate range encoding in checkentry Xiang Mei <xmei5(a)asu.edu> netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator Weiming Shi <bestswngs(a)gmail.com> ipvs: fix NULL deref in ip_vs_add_service error path Daniel Golle <daniel(a)makrotopia.org> selftests: net: bridge_vlan_mcast: wait for h1 before querier check Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> xfrm_user: fix info leak in build_mapping() Steffen Klassert <steffen.klassert(a)secunet.com> xfrm: Wait for RCU readers during policy netns exit Maciej Fijalkowski <maciej.fijalkowski(a)intel.com> xsk: validate MTU against usable frame size on bind Maciej Fijalkowski <maciej.fijalkowski(a)intel.com> xsk: fix XDP_UMEM_SG_FLAG issues Maciej Fijalkowski <maciej.fijalkowski(a)intel.com> xsk: respect tailroom for ZC setups Maciej Fijalkowski <maciej.fijalkowski(a)intel.com> xsk: tighten UMEM headroom validation to account for tailroom and min frame Agalakov Daniil <ade(a)amicon.ru> e1000: check return value of e1000_read_eeprom Michal Schmidt <mschmidt(a)redhat.com> ixgbevf: add missing negotiate_features op to Hyper-V ops table Pengpeng Hou <pengpeng(a)iscas.ac.cn> tracing/probe: reject non-closed empty immediate strings Jon Hunter <jonathanh(a)nvidia.com> dt-bindings: net: Fix Tegra234 MGBE PTP clock Jon Hunter <jonathanh(a)nvidia.com> net: stmmac: Fix PTP ref clock for Tegra234 Pengpeng Hou <pengpeng(a)iscas.ac.cn> nfc: s3fwrn5: allocate rx skb before consuming bytes Yiqi Sun <sunyiqixm(a)gmail.com> ipv4: icmp: fix null-ptr-deref in icmp_build_probe() Eric Dumazet <edumazet(a)google.com> net: lapbether: handle NETDEV_PRE_TYPE_CHANGE Ruide Cao <caoruide123(a)gmail.com> net: sched: act_csum: validate nested VLAN headers Nicholas Carlini <nicholas(a)carlini.com> eventpoll: defer struct eventpoll free to RCU grace period Maíra Canal <mcanal(a)igalia.com> drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock Maíra Canal <mcanal(a)igalia.com> drm/vc4: Fix a memory leak in hang state error path Maíra Canal <mcanal(a)igalia.com> drm/vc4: Fix memory leak of BO array in hang state Maíra Canal <mcanal(a)igalia.com> drm/vc4: Release runtime PM reference after binding V3D Long Li <longli(a)microsoft.com> PCI: hv: Set default NUMA node to 0 for devices without affinity info Sebastian Krzyszkowiak <sebastian.krzyszkowiak(a)puri.sm> arm64: dts: imx8mq: Set the correct gpu_ahb clock frequency Potin Lai <potin.lai.pt(a)gmail.com> soc: aspeed: socinfo: Mask table entries for accurate SoC ID matching Tomasz Merta <tomasz.merta(a)arrow.com> ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J Pengpeng Hou <pengpeng(a)iscas.ac.cn> wifi: brcmfmac: validate bsscfg indices in IF events Arthur Husband <artmoty(a)gmail.com> ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585 Benoît Sevens <bsevens(a)google.com> HID: roccat: fix use-after-free in roccat_report_event songxiebing <songxiebing(a)kylinos.cn> ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IAH10 leo vriska <leo(a)60228.dev> HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3 Mario Limonciello <mario.limonciello(a)amd.com> platform/x86/amd: pmc: Add Thinkpad L14 Gen3 to quirk_s2idle_bug Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> pinctrl: intel: Fix the revision for new features (1kOhm PD, HW debouncer) Gilson Marquato Júnior <gilsonmandalogo(a)hotmail.com> ASoC: amd: yc: Add DMI entry for HP Laptop 15-fc0xxx Fredric Cover <FredTheDude(a)proton.me> fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath Phil Willoughby <willerz(a)gmail.com> ALSA: usb-audio: Fix quirk flags for NeuralDSP Quad Cortex Kuninori Morimoto <kuninori.morimoto.gx(a)renesas.com> ASoC: soc-core: call missing INIT_LIST_HEAD() for card_aux_list Pengpeng Hou <pengpeng(a)iscas.ac.cn> wifi: wl1251: validate packet IDs before indexing tx_frames Dustin L. Howett <dustin(a)howett.net> ALSA: hda/realtek: add quirk for Framework F111:000F Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry César Montoya <sprit152009(a)gmail.com> ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx Goldwyn Rodrigues <rgoldwyn(a)suse.de> btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file() Wenyuan Li <2063309626(a)qq.com> can: mcp251x: add error handling for power enable in open and resume Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: SOF: topology: reject invalid vendor array size in token parser Zhang Heng <zhangheng(a)kylinos.cn> ASoC: amd: yc: Add DMI quirk for Thin A15 B7VF Arnd Bergmann <arnd(a)arndb.de> ALSA: asihpi: avoid write overflow check warning Arnd Bergmann <arnd(a)arndb.de> media: rkvdec: reduce stack usage in rkvdec_init_v4l2_vp9_count_tbl() Matthew Schwartz <matthew.schwartz(a)linux.dev> ALSA: hda/realtek: Add quirk for ASUS ROG Flow Z13-KJP GZ302EAC Andrii Kovalchuk <coderpy4(a)proton.me> ALSA: hda/realtek: Add HP ENVY Laptop 13-ba0xxx quirk Vee Satayamas <vsatayamas(a)gmail.com> ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK BM1403CDA Jacob Moroni <jmoroni(a)google.com> RDMA/irdma: Fix double free related to rereg_user_mr ------------- Diffstat: Documentation/admin-guide/mm/damon/reclaim.rst | 4 + .../bindings/net/nvidia,tegra234-mgbe.yaml | 4 +- Makefile | 4 +- arch/arm64/boot/dts/freescale/imx8mq.dtsi | 2 +- arch/x86/events/intel/uncore_discovery.c | 2 +- arch/x86/include/asm/kvm-x86-ops.h | 1 - arch/x86/include/asm/kvm_host.h | 1 - arch/x86/include/uapi/asm/kvm.h | 12 +-- arch/x86/kvm/svm/sev.c | 11 ++- arch/x86/kvm/vmx/nested.c | 4 + arch/x86/kvm/vmx/vmx.c | 21 ------ arch/x86/kvm/x86.c | 24 +++--- crypto/algif_aead.c | 2 +- crypto/testmgr.c | 24 +++++- drivers/ata/ahci.c | 14 ++++ drivers/crypto/ccp/sev-dev.c | 19 ++++- drivers/gpio/gpio-tegra.c | 2 +- drivers/gpu/drm/i915/display/intel_psr.c | 18 +++-- drivers/gpu/drm/vc4/vc4_bo.c | 3 + drivers/gpu/drm/vc4/vc4_gem.c | 19 +++-- drivers/gpu/drm/vc4/vc4_hdmi.c | 14 +++- drivers/gpu/drm/vc4/vc4_v3d.c | 1 + drivers/hid/hid-alps.c | 3 + drivers/hid/hid-core.c | 3 + drivers/hid/hid-ids.h | 3 + drivers/hid/hid-quirks.c | 1 + drivers/hid/hid-roccat.c | 2 + drivers/i2c/busses/i2c-s3c2410.c | 7 +- drivers/iio/accel/st_accel_core.c | 10 +-- drivers/iio/common/st_sensors/st_sensors_core.c | 36 +++++---- drivers/iio/common/st_sensors/st_sensors_trigger.c | 20 +++-- drivers/infiniband/hw/irdma/verbs.c | 1 + drivers/md/bcache/super.c | 7 ++ drivers/md/raid1.c | 6 +- drivers/md/raid10.c | 7 -- .../mediatek/vcodec/encoder/mtk_vcodec_enc_drv.c | 9 +++ drivers/media/test-drivers/vidtv/vidtv_bridge.c | 4 +- drivers/media/test-drivers/vidtv/vidtv_channel.c | 4 + drivers/media/test-drivers/vidtv/vidtv_mux.c | 4 +- drivers/media/test-drivers/vidtv/vidtv_ts.c | 48 ++++++------ drivers/media/test-drivers/vidtv/vidtv_ts.h | 4 +- drivers/media/usb/as102/as102_usb_drv.c | 2 + drivers/media/usb/em28xx/em28xx-video.c | 14 +++- drivers/media/usb/hackrf/hackrf.c | 7 +- drivers/net/can/spi/mcp251x.c | 29 ++++++-- drivers/net/ethernet/intel/e1000/e1000_ethtool.c | 8 +- drivers/net/ethernet/intel/i40e/i40e_trace.h | 2 +- drivers/net/ethernet/intel/ice/ice_ethtool.c | 11 ++- drivers/net/ethernet/intel/ixgbevf/vf.c | 7 ++ drivers/net/ethernet/mediatek/mtk_eth_soc.c | 22 +++++- drivers/net/ethernet/mediatek/mtk_ppe.c | 30 ++++++++ drivers/net/ethernet/mediatek/mtk_ppe.h | 1 + drivers/net/ethernet/stmicro/stmmac/dwmac-tegra.c | 19 ++++- drivers/net/ethernet/wangxun/txgbe/txgbe_type.h | 8 +- drivers/net/ipa/reg/gsi_reg-v5.0.c | 9 ++- drivers/net/usb/cdc-phonet.c | 7 +- drivers/net/wan/lapbether.c | 13 ++-- drivers/net/wireless/ath/ath9k/channel.c | 6 +- .../wireless/broadcom/brcm80211/brcmfmac/fweh.c | 5 ++ drivers/net/wireless/realtek/rtw88/usb.c | 3 +- drivers/net/wireless/ti/wl1251/tx.c | 8 +- drivers/net/wireless/virtual/mac80211_hwsim.c | 1 - drivers/nfc/s3fwrn5/uart.c | 10 ++- drivers/pci/controller/pci-hyperv.c | 8 ++ drivers/pci/endpoint/functions/pci-epf-vntb.c | 19 +---- drivers/pinctrl/intel/pinctrl-intel.c | 2 +- drivers/platform/x86/amd/pmc/pmc-quirks.c | 9 +++ drivers/soc/aspeed/aspeed-socinfo.c | 2 +- drivers/staging/media/rkvdec/rkvdec-vp9.c | 3 +- drivers/staging/rtl8723bs/core/rtw_security.c | 2 +- drivers/staging/sm750fb/sm750.c | 3 + drivers/usb/class/cdc-acm.c | 53 +++++++++++-- drivers/usb/core/port.c | 1 + drivers/usb/gadget/function/f_ncm.c | 4 +- drivers/usb/gadget/function/f_phonet.c | 9 +++ drivers/usb/gadget/udc/renesas_usb3.c | 7 +- drivers/usb/serial/option.c | 2 + drivers/usb/storage/unusual_devs.h | 7 +- drivers/usb/usbip/usbip_common.c | 12 +++ drivers/video/fbdev/tdfxfb.c | 3 + drivers/video/fbdev/udlfb.c | 3 + fs/btrfs/bio.c | 29 +++----- fs/dcache.c | 4 +- fs/eventpoll.c | 6 +- fs/f2fs/compress.c | 14 +++- fs/f2fs/namei.c | 1 + fs/fuse/control.c | 4 +- fs/fuse/dev.c | 3 + fs/fuse/readdir.c | 4 + fs/nilfs2/dat.c | 3 + fs/ntfs3/fslog.c | 12 ++- fs/ocfs2/aops.c | 3 +- fs/ocfs2/inode.c | 31 ++++++++ fs/ocfs2/mmap.c | 7 +- fs/ocfs2/ocfs2_trace.h | 10 +-- fs/ocfs2/resize.c | 10 ++- fs/smb/client/cifsacl.c | 1 + fs/smb/client/fs_context.c | 4 + fs/smb/client/smb2inode.c | 2 +- fs/smb/client/smb2ops.c | 6 ++ fs/smb/server/connection.c | 1 + fs/smb/server/smb2pdu.c | 9 ++- fs/smb/server/smbacl.c | 19 +++-- fs/smb/server/transport_tcp.c | 4 +- include/linux/kvm_host.h | 3 +- include/net/mac80211.h | 4 + include/net/netfilter/nf_tables.h | 2 + include/net/pkt_cls.h | 2 + include/net/xdp_sock.h | 2 +- include/net/xdp_sock_drv.h | 23 +++++- include/trace/events/btrfs.h | 11 ++- include/uapi/linux/kvm.h | 11 +-- kernel/trace/blktrace.c | 4 +- kernel/trace/trace_probe.c | 2 +- mm/backing-dev.c | 5 +- mm/kasan/init.c | 8 +- net/can/raw.c | 11 ++- net/core/net-procfs.c | 49 ++++++++---- net/core/skbuff.c | 5 +- net/core/skmsg.c | 14 ++-- net/ipv4/icmp.c | 7 ++ net/ipv4/tcp.c | 4 +- net/ipv4/tcp_bpf.c | 2 +- net/ipv4/tcp_input.c | 14 ++-- net/ipv4/tcp_minisocks.c | 2 +- net/ipv4/udp.c | 3 +- net/ipv4/udp_bpf.c | 2 +- net/ipv6/exthdrs.c | 4 + net/ipv6/netfilter/ip6t_eui64.c | 3 +- net/ipv6/seg6_hmac.c | 2 + net/l2tp/l2tp_core.c | 5 ++ net/mac80211/tx.c | 4 +- net/netfilter/ipvs/ip_vs_ctl.c | 1 - net/netfilter/nf_conntrack_netlink.c | 2 +- net/netfilter/nf_conntrack_proto_sctp.c | 3 +- net/netfilter/nf_tables_api.c | 4 +- net/netfilter/nfnetlink_log.c | 8 +- net/netfilter/nft_dynset.c | 10 ++- net/netfilter/nft_set_pipapo_avx2.c | 20 ++--- net/netfilter/xt_multiport.c | 34 ++++++++- net/nfc/digital_technology.c | 6 ++ net/nfc/llcp_core.c | 2 + net/nfc/nci/core.c | 9 +++ net/packet/af_packet.c | 21 ++++-- net/rxrpc/conn_event.c | 14 +++- net/rxrpc/key.c | 9 ++- net/rxrpc/sendmsg.c | 2 +- net/sched/act_csum.c | 6 +- net/sched/em_cmp.c | 5 +- net/sched/em_nbyte.c | 2 + net/sched/em_text.c | 11 ++- net/unix/af_unix.c | 8 +- net/unix/diag.c | 21 ++++-- net/wireless/core.c | 4 +- net/xdp/xdp_umem.c | 3 +- net/xdp/xsk.c | 4 +- net/xdp/xsk_buff_pool.c | 32 +++++++- net/xfrm/xfrm_policy.c | 2 + net/xfrm/xfrm_user.c | 1 + scripts/checkpatch.pl | 10 +++ scripts/dtc/dtc-lexer.l | 3 - scripts/generate_rust_analyzer.py | 17 ++++- sound/firewire/fireworks/fireworks_command.c | 5 +- sound/pci/asihpi/hpimsgx.c | 6 +- sound/pci/ctxfi/ctvmem.h | 2 +- sound/pci/hda/patch_realtek.c | 5 ++ sound/soc/amd/yc/acp6x-mach.c | 21 ++++++ sound/soc/qcom/qdsp6/q6apm.c | 14 +++- sound/soc/soc-core.c | 1 + sound/soc/sof/topology.c | 2 +- sound/soc/stm/stm32_sai_sub.c | 3 + sound/usb/6fire/chip.c | 17 +++-- sound/usb/caiaq/device.c | 4 +- sound/usb/format.c | 86 +++++++++++++++++++--- sound/usb/mixer.c | 7 ++ sound/usb/quirks.c | 2 + tools/objtool/elf.c | 14 ++-- tools/perf/util/unwind-libdw.c | 7 +- .../selftests/net/forwarding/bridge_vlan_mcast.sh | 1 + 179 files changed, 1172 insertions(+), 450 deletions(-)

3 weeks, 2 days

11
10
0 0

[PATCH 6.19 000/220] 6.19.14-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.19.14 release. There are 220 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 22 Apr 2026 15:38:52 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.19.14-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.19.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.19.14-rc1 Leon Romanovsky <leon(a)kernel.org> dma-mapping: handle DMA_ATTR_CPU_CACHE_CLEAN in trace output Leon Romanovsky <leon(a)kernel.org> dma-debug: Allow multiple invocations of overlapping entries Jianhui Zhou <jianhuizzzzz(a)gmail.com> mm/userfaultfd: fix hugetlb fault mutex hash calculation Jeongjun Park <aha310510(a)gmail.com> media: hackrf: fix to not free memory after the device is registered in hackrf_probe() Abd-Alrhman Masalkhi <abd.masalkhi(a)gmail.com> media: vidtv: fix pass-by-value structs causing MSAN warnings Deepanshu Kartikey <kartikey406(a)gmail.com> nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map Jeongjun Park <aha310510(a)gmail.com> media: as102: fix to not free memory after the device is registered in as102_usb_probe() Shardul Bankar <shardul.b(a)mpiricsoftware.com> wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit Mingzhe Zou <mingzhe.zou(a)easystack.cn> bcache: fix cached_dev.sb_bio use-after-free and crash Berk Cem Goksel <berkcgoksel(a)gmail.com> ALSA: 6fire: fix use-after-free on disconnect Sanman Pradhan <psanman(a)juniper.net> hwmon: (powerz) Fix use-after-free on USB disconnect Abhishek Kumar <abhishek_sts8(a)yahoo.com> media: em28xx: fix use-after-free in em28xx_v4l2_open() Fan Wu <fanwu01(a)zju.edu.cn> media: mediatek: vcodec: fix use-after-free in encoder release path Ruslan Valiyev <linuxoid(a)gmail.com> media: vidtv: fix nfeeds state corruption on start_streaming failure Breno Leitao <leitao(a)debian.org> mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> mm/kasan: fix double free for kasan pXds Srinivas Kandagatla <srinivas.kandagatla(a)oss.qualcomm.com> ASoC: qcom: q6apm: move component registration to unmanaged version Sean Christopherson <seanjc(a)google.com> KVM: x86: Use scratch field in MMIO fragment to hold small write values Linus Torvalds <torvalds(a)linux-foundation.org> x86-64/arm64/powerpc: clean up and rename __copy_from_user_flushcache Linus Torvalds <torvalds(a)linux-foundation.org> x86: rename and clean up __copy_from_user_inatomic_nocache() Linus Torvalds <torvalds(a)linux-foundation.org> x86-64: rename misleadingly named '__copy_user_nocache()' function Sasha Levin <sashal(a)kernel.org> checkpatch: add support for Assisted-by tag Joseph Qi <joseph.qi(a)linux.alibaba.com> ocfs2: fix out-of-bounds write in ocfs2_write_end_inline Deepanshu Kartikey <kartikey406(a)gmail.com> ocfs2: validate inline data i_size during inode read David Woodhouse <dwmw(a)amazon.co.uk> KVM: x86: Use __DECLARE_FLEX_ARRAY() for UAPI structures with VLAs Sean Christopherson <seanjc(a)google.com> KVM: Remove subtle "struct kvm_stats_desc" pseudo-overlay Paul Chaignon <paul.chaignon(a)gmail.com> selftests/bpf: Test refinement of single-value tnum Matthew Wilcox (Oracle) <willy(a)infradead.org> mm: call ->free_folio() directly in folio_unmap_invalidate() Sean Christopherson <seanjc(a)google.com> KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION Sean Christopherson <seanjc(a)google.com> KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish Sean Christopherson <seanjc(a)google.com> KVM: SEV: Disallow LAUNCH_FINISH if vCPUs are actively being created Sean Christopherson <seanjc(a)google.com> KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm->lock Sean Christopherson <seanjc(a)google.com> KVM: SEV: Reject attempts to sync VMSA of an already-launched/encrypted vCPU Sean Christopherson <seanjc(a)google.com> KVM: selftests: Remove duplicate LAUNCH_UPDATE_VMSA call in SEV-ES migrate test Koichiro Den <den(a)valinux.co.jp> PCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown Koichiro Den <den(a)valinux.co.jp> PCI: endpoint: pci-epf-vntb: Stop cmd_handler work in epf_ntb_epc_cleanup ZhengYuan Huang <gality369(a)gmail.com> ocfs2: handle invalid dinode in ocfs2_group_extend Tejas Bharambe <tejas.bharambe(a)outlook.com> ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY Joseph Qi <joseph.qi(a)linux.alibaba.com> ocfs2: fix possible deadlock between unlink and dio_end_io_write Ruslan Valiyev <linuxoid(a)gmail.com> media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections Ryan Roberts <ryan.roberts(a)arm.com> arm64: mm: Handle invalid large leaf mappings correctly Michał Winiarski <michal.winiarski(a)intel.com> vfio/xe: Reorganize the init to decouple migration from reset Zhihao Cheng <chengzhihao1(a)huawei.com> dcache: Limit the minimal number of bucket to two Harin Lee <me(a)harin.net> ALSA: ctxfi: Limit PTP to a single page SeongJae Park <sj(a)kernel.org> Docs/admin-guide/mm/damon/reclaim: warn commit_inputs vs param updates race Fabio Porcedda <fabio.porcedda(a)gmail.com> USB: serial: option: add Telit Cinterion FN990A MBIM composition Alistair Popple <apopple(a)nvidia.com> selftests/mm: hmm-tests: don't hardcode THP size to 2MB Junrui Luo <moonafterrain(a)outlook.com> staging: sm750fb: fix division by zero in ps_to_hz() Johan Hovold <johan(a)kernel.org> wifi: rtw88: fix device leak on probe failure Tamir Duberstein <tamird(a)kernel.org> scripts: generate_rust_analyzer.py: avoid FD leak Benjamin Berg <benjamin.berg(a)intel.com> scripts/gdb/symbols: handle module path parameters Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO Xu Yang <xu.yang_2(a)nxp.com> usb: port: add delay after usb_hub_set_port_power() Michael Zimmermann <sigmaepsilon92(a)gmail.com> usb: gadget: f_hid: don't call cdev_init while cdev in use Dave Carey <carvsdriver(a)gmail.com> USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen Daniel Brát <danek.brat(a)gmail.com> usb: storage: Expand range of matched versions for VL817 quirks entry Alexey Charkov <alchark(a)flipper.net> usb: typec: fusb302: Switch to threaded IRQ handler Nathan Rebello <nathan.c.rebello(a)gmail.com> usbip: validate number_of_packets in usbip_pack_ret_submit() Stefan Metzmacher <metze(a)samba.org> smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() Stefan Metzmacher <metze(a)samba.org> smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> ksmbd: require 3 sub-authorities before reading sub_auth[2] Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> ksmbd: validate EaNameLength in smb2_get_ea() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> smb: client: fix OOB reads parsing symlink error response Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> smb: client: fix off-by-8 bounds check in check_wsl_eas() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: gadget: renesas_usb3: validate endpoint index in standard request handlers Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> ALSA: fireworks: bound device-supplied status before string array lookup Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> ALSA: usx2y: us144mkii: fix NULL deref on missing interface 0 Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> bnge: return after auxiliary_device_uninit() in error path Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> drm/vc4: platform_get_irq_byname() returns an int Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> NFC: digital: Bounds check NFC-A cascade depth in SDD response handler Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> HID: core: clamp report_size in s32ton() to avoid undefined shift Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> HID: alps: fix NULL pointer dereference in alps_raw_event() Lin YuChen <starpt.official(a)gmail.com> staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> i2c: s3c24xx: check the size of the SMBUS message before using it Samuel Page <sam(a)bynar.io> can: raw: fix ro->uniq use-after-free in raw_rcv() Junxi Qian <qjx1298677004(a)gmail.com> nfc: llcp: add missing return after LLCP_CLOSED checks Herbert Xu <herbert(a)gondor.apana.org.au> crypto: algif_aead - Fix minimum RX size check for decryption Herbert Xu <herbert(a)gondor.apana.org.au> crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl Thomas Gleixner <tglx(a)kernel.org> clockevents: Prevent timer interrupt starvation Peter Zijlstra <peterz(a)infradead.org> sched/deadline: Use revised wakeup rule for dl_server Zide Chen <zide.chen(a)intel.com> perf/x86/intel/uncore: Fix die ID init and look up bugs Zide Chen <zide.chen(a)intel.com> perf/x86/intel/uncore: Skip discovery table for offline dies Douya Le <ldy3087146292(a)gmail.com> crypto: af_alg - limit RX SG extraction by receive buffer budget Samasth Norway Ananda <samasth.norway.ananda(a)oracle.com> gpio: tegra: fix irq_release_resources calling enable instead of disable Alice Mikityanska <alice(a)isovalent.com> l2tp: Drop large packets with UDP encap Alexander Koskovich <akoskovich(a)pm.me> net: ipa: fix event ring index not programmed for IPA v5.0+ Alexander Koskovich <akoskovich(a)pm.me> net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+ Li RongQing <lirongqing(a)baidu.com> devlink: Fix incorrect skb socket family dumping Jiexun Wang <wangjiexun2025(a)gmail.com> af_unix: read UNIX_DIAG_VFS data under unix_state_lock Fabio Baltieri <fabio.baltieri(a)gmail.com> net: txgbe: leave space for null terminators on property_entry Justin Iurman <justin.iurman(a)gmail.com> net: ioam6: fix OOB and missing lock Felix Gu <ustc.gu(a)gmail.com> net: mdio: realtek-rtl9300: use scoped device_for_each_child_node loop Syed Saba Kareem <Syed.SabaKareem(a)amd.com> ASoC: amd: acp: update DMI quirk and add ACP DMIC for Lenovo platforms Richard Fitzgerald <rf(a)opensource.cirrus.com> ASoC: SDCA: Unregister IRQ handlers on module remove Maciej Strozek <mstrozek(a)opensource.cirrus.com> ASoC: SDCA: Fix overwritten var within for loop Florian Westphal <fw(a)strlen.de> netfilter: nfnetlink_queue: make hash table per queue Scott Mitchell <scott.k.mitch1(a)gmail.com> netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation Zhengchuan Liang <zcliangcn(a)gmail.com> netfilter: ip6t_eui64: reject invalid MAC header for all packets Ren Wei <n05ec(a)lzu.edu.cn> netfilter: xt_multiport: validate range encoding in checkentry Xiang Mei <xmei5(a)asu.edu> netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator Weiming Shi <bestswngs(a)gmail.com> ipvs: fix NULL deref in ip_vs_add_service error path Daniel Golle <daniel(a)makrotopia.org> selftests: net: bridge_vlan_mcast: wait for h1 before querier check Vinay Belgaumkar <vinay.belgaumkar(a)intel.com> drm/xe: Fix bug in idledly unit conversion Cezary Rojewski <cezary.rojewski(a)intel.com> ASoC: Intel: avs: Fix memory leak in avs_register_i2s_test_boards() Francesco Lavra <flavra(a)baylibre.com> pinctrl: mcp23s08: Disable all pin interrupts during probe Zhengchuan Liang <zcliangcn(a)gmail.com> net: af_key: zero aligned sockaddr tail in PF_KEY exports Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> xfrm_user: fix info leak in build_mapping() Kotlyarov Mihail <mihailkotlyarow(a)gmail.com> xfrm: fix refcount leak in xfrm_migrate_policy_find Steffen Klassert <steffen.klassert(a)secunet.com> xfrm: Wait for RCU readers during policy netns exit Stefano Garzarella <sgarzare(a)redhat.com> vsock/test: fix send_buf()/recv_buf() EINTR handling Maciej Fijalkowski <maciej.fijalkowski(a)intel.com> xsk: validate MTU against usable frame size on bind Maciej Fijalkowski <maciej.fijalkowski(a)intel.com> xsk: fix XDP_UMEM_SG_FLAG issues Maciej Fijalkowski <maciej.fijalkowski(a)intel.com> xsk: respect tailroom for ZC setups Maciej Fijalkowski <maciej.fijalkowski(a)intel.com> xsk: tighten UMEM headroom validation to account for tailroom and min frame Agalakov Daniil <ade(a)amicon.ru> e1000: check return value of e1000_read_eeprom Michal Schmidt <mschmidt(a)redhat.com> ixgbevf: add missing negotiate_features op to Hyper-V ops table Aleksandr Loktionov <aleksandr.loktionov(a)intel.com> ixgbe: stop re-reading flash on every get_drvinfo for e610 Kohei Enju <kohei(a)enjuk.jp> ice: ptp: don't WARN when controlling PF is unavailable Maciej Strozek <mstrozek(a)opensource.cirrus.com> ASoC: SOF: Intel: fix iteration in is_endpoint_present() Maciej Strozek <mstrozek(a)opensource.cirrus.com> ASoC: SOF: Intel: Fix endpoint index if endpoints are missing Charles Keepax <ckeepax(a)opensource.cirrus.com> ASoC: SDCA: Fix errors in IRQ cleanup Charles Keepax <ckeepax(a)opensource.cirrus.com> ASoC: SDCA: Add ASoC jack hookup in class driver Pengpeng Hou <pengpeng(a)iscas.ac.cn> tracing/probe: reject non-closed empty immediate strings Stanislav Kinsburskii <skinsburskii(a)linux.microsoft.com> mshv: Fix infinite fault loop on permission-denied GPA intercepts Sahil Chandna <sahilchandna(a)linux.microsoft.com> PCI: hv: Fix double ida_free in hv_pci_probe error path Jon Hunter <jonathanh(a)nvidia.com> dt-bindings: net: Fix Tegra234 MGBE PTP clock Jon Hunter <jonathanh(a)nvidia.com> net: stmmac: Fix PTP ref clock for Tegra234 Pengpeng Hou <pengpeng(a)iscas.ac.cn> nfc: s3fwrn5: allocate rx skb before consuming bytes Chris J Arges <carges(a)cloudflare.com> net: increase IP_TUNNEL_RECURSION_LIMIT to 5 Yiqi Sun <sunyiqixm(a)gmail.com> ipv4: icmp: fix null-ptr-deref in icmp_build_probe() Fernando Fernandez Mancera <fmancera(a)suse.de> ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() Fernando Fernandez Mancera <fmancera(a)suse.de> ipv4: nexthop: avoid duplicate NHA_HW_STATS_ENABLE on nexthop group dump Nikolaos Gkarlis <nickgarlis(a)gmail.com> rtnetlink: add missing netlink_ns_capable() check for peer netns Zijing Yin <yzjaurora(a)gmail.com> bridge: guard local VLAN-0 FDB helpers against NULL vlan group Eric Dumazet <edumazet(a)google.com> ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() Lorenzo Bianconi <lorenzo(a)kernel.org> net: airoha: Fix memory leak in airoha_qdma_rx_process() Eric Dumazet <edumazet(a)google.com> net: lapbether: handle NETDEV_PRE_TYPE_CHANGE Arnd Bergmann <arnd(a)arndb.de> net: fec: make FIXED_PHY dependency unconditional Ruide Cao <caoruide123(a)gmail.com> net: sched: act_csum: validate nested VLAN headers Nicholas Carlini <nicholas(a)carlini.com> eventpoll: defer struct eventpoll free to RCU grace period Maíra Canal <mcanal(a)igalia.com> drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock Maíra Canal <mcanal(a)igalia.com> drm/vc4: Fix a memory leak in hang state error path Maíra Canal <mcanal(a)igalia.com> drm/vc4: Fix memory leak of BO array in hang state Maíra Canal <mcanal(a)igalia.com> drm/vc4: Release runtime PM reference after binding V3D NeilBrown <neilb(a)ownmail.net> cachefiles: fix incorrect dentry refcount in cachefiles_cull() Mikhail Gavrilov <mikhail.v.gavrilov(a)gmail.com> dma-debug: suppress cacheline overlap warning when arch has no DMA alignment requirement Michael S. Tsirkin <mst(a)redhat.com> dma-debug: track cache clean flag in entries Michael S. Tsirkin <mst(a)redhat.com> dma-mapping: add DMA_ATTR_CPU_CACHE_CLEAN Keenan Dong <keenanat2000(a)gmail.com> xfrm: account XFRMA_IF_ID in aevent size calculation Maximilian Pezzullo <maximilianpezzullo(a)gmail.com> HID: amd_sfh: don't log error when device discovery fails with -EOPNOTSUPP Long Li <longli(a)microsoft.com> PCI: hv: Set default NUMA node to 0 for devices without affinity info Mihai Sain <mihai.sain(a)microchip.com> ARM: dts: microchip: sam9x7: fix gpio-lines count for pioB Felix Gu <ustc.gu(a)gmail.com> soc: microchip: mpfs-mss-top-sysreg: Fix resource leak on driver unbind Felix Gu <ustc.gu(a)gmail.com> soc: microchip: mpfs-control-scb: Fix resource leak on driver unbind Artem Bityutskiy <artem.bityutskiy(a)linux.intel.com> tools/power turbostat: Fix delimiter bug in print functions Loic Poulain <loic.poulain(a)oss.qualcomm.com> arm64: dts: qcom: monaco: Reserve full Gunyah metadata region Artem Bityutskiy <artem.bityutskiy(a)linux.intel.com> tools/power turbostat: Fix --show/--hide for individual cpuidle counters Artem Bityutskiy <artem.bityutskiy(a)linux.intel.com> tools/power turbostat: Fix incorrect format variable Serhii Pievniev <spevnev16(a)gmail.com> tools/power/turbostat: Fix microcode patch level output for AMD/Hygon Len Brown <len.brown(a)intel.com> tools/power turbostat: Fix swidle header vs data display Mukesh Ojha <mukesh.ojha(a)oss.qualcomm.com> soc: qcom: pd-mapper: Fix element length in servreg_loc_pfr_req_ei Loic Poulain <loic.poulain(a)oss.qualcomm.com> arm64: dts: qcom: monaco: Fix UART10 pinconf Markus Niebel <Markus.Niebel(a)ew.tq-group.com> arm64: dts: imx93-tqma9352: improve eMMC pad configuration Markus Niebel <Markus.Niebel(a)ew.tq-group.com> arm64: dts: imx91-tqma9131: improve eMMC pad configuration Luke Wang <ziniu.wang_1(a)nxp.com> arm64: dts: imx93-9x9-qsb: change usdhc tuning step for eMMC and SD Sebastian Krzyszkowiak <sebastian.krzyszkowiak(a)puri.sm> arm64: dts: imx8mq: Set the correct gpu_ahb clock frequency Ravi Hothi <ravi.hothi(a)oss.qualcomm.com> arm64: dts: qcom: qcm6490-idp: Fix WCD9370 reset GPIO polarity Daniel J Blueman <daniel(a)quora.org> arm64: dts: qcom: hamoa/x1: fix idle exit latency Potin Lai <potin.lai.pt(a)gmail.com> soc: aspeed: socinfo: Mask table entries for accurate SoC ID matching Tomasz Merta <tomasz.merta(a)arrow.com> ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J Linus Torvalds <torvalds(a)linux-foundation.org> x86: shadow stacks: proper error handling for mmap lock John Pavlick <jspavlick(a)posteo.net> net: sfp: add quirks for Hisense and HSGQ GPON ONT SFP modules Pengpeng Hou <pengpeng(a)iscas.ac.cn> wifi: brcmfmac: validate bsscfg indices in IF events Arthur Husband <artmoty(a)gmail.com> ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585 Benoît Sevens <bsevens(a)google.com> HID: roccat: fix use-after-free in roccat_report_event songxiebing <songxiebing(a)kylinos.cn> ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IAH10 leo vriska <leo(a)60228.dev> HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3 Even Xu <even.xu(a)intel.com> HID: Intel-thc-hid: Intel-quickspi: Add NVL Device IDs Mario Limonciello <mario.limonciello(a)amd.com> platform/x86/amd: pmc: Add Thinkpad L14 Gen3 to quirk_s2idle_bug Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> pinctrl: intel: Fix the revision for new features (1kOhm PD, HW debouncer) Alexander Savenko <alex.sav4387(a)gmail.com> ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IMH9 Gilson Marquato Júnior <gilsonmandalogo(a)hotmail.com> ASoC: amd: yc: Add DMI entry for HP Laptop 15-fc0xxx Fredric Cover <FredTheDude(a)proton.me> fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath Donet Tom <donettom(a)linux.ibm.com> drm/amdkfd: Fix queue preemption/eviction failures by aligning control stack size to GPU page size songxiebing <songxiebing(a)kylinos.cn> ALSA: hda/realtek: Add quirk for Lenovo Yoga Slim 7 14AKP10 Phil Willoughby <willerz(a)gmail.com> ALSA: usb-audio: Fix quirk flags for NeuralDSP Quad Cortex Takashi Iwai <tiwai(a)suse.de> ALSA: hda/realtek: Add quirk for Samsung Book2 Pro 360 (NP950QED) Kuninori Morimoto <kuninori.morimoto.gx(a)renesas.com> ASoC: soc-core: call missing INIT_LIST_HEAD() for card_aux_list Pengpeng Hou <pengpeng(a)iscas.ac.cn> wifi: wl1251: validate packet IDs before indexing tx_frames Dustin L. Howett <dustin(a)howett.net> ALSA: hda/realtek: add quirk for Framework F111:000F Kailang Yang <kailang(a)realtek.com> ALSA: hda/realtek - Fixed Speaker Mute LED for HP EliteBoard G1a platform Florian Westphal <fw(a)strlen.de> netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry Kshamendra Kumar Mishra <kshamendrakumarmishra(a)gmail.com> ALSA: hda/realtek: add HP Laptop 15-fd0xxx mute LED quirk Joel Fernandes <joelagnelf(a)nvidia.com> srcu: Use irq_work to start GP in tiny SRCU Donet Tom <donettom(a)linux.ibm.com> drm/amdgpu: Handle GPU page faults correctly on non-4K page systems Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: ctnetlink: ensure safe access to master conntrack César Montoya <sprit152009(a)gmail.com> ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx Goldwyn Rodrigues <rgoldwyn(a)suse.de> btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file() Krishna Chomal <krishna.chomal108(a)gmail.com> platform/x86: hp-wmi: Add support for Omen 16-wf1xxx (8C76) Filipe Manana <fdmanana(a)suse.com> btrfs: fix zero size inode with non-zero size after log replay Matthew Schwartz <matthew.schwartz(a)linux.dev> platform/x86: asus-nb-wmi: add DMI quirk for ASUS ROG Flow Z13-KJP GZ302EAC Frank Zhang <rmxpzlb(a)gmail.com> ALSA:usb:qcom: add AUXILIARY_BUS to Kconfig dependencies Hasun Park <hasunpark(a)gmail.com> ASoC: amd: acp: add ASUS HN7306EA quirk for legacy SDW machine Wenyuan Li <2063309626(a)qq.com> can: mcp251x: add error handling for power enable in open and resume Cássio Gabriel <cassiogabrielcontato(a)gmail.com> ASoC: SOF: topology: reject invalid vendor array size in token parser Zhang Heng <zhangheng(a)kylinos.cn> ASoC: amd: yc: Add DMI quirk for Thin A15 B7VF Cen Zhang <zzzccc427(a)gmail.com> Bluetooth: hci_sync: annotate data-races around hdev->req_status Arnd Bergmann <arnd(a)arndb.de> ALSA: asihpi: avoid write overflow check warning Arnd Bergmann <arnd(a)arndb.de> media: rkvdec: reduce stack usage in rkvdec_init_v4l2_vp9_count_tbl() Matthew Schwartz <matthew.schwartz(a)linux.dev> ALSA: hda/realtek: Add quirk for ASUS ROG Flow Z13-KJP GZ302EAC Zhang Heng <zhangheng(a)kylinos.cn> ALSA: hda/realtek: add quirk for Lenovo Yoga 7 2-in-1 16AKP10 Andrii Kovalchuk <coderpy4(a)proton.me> ALSA: hda/realtek: Add HP ENVY Laptop 13-ba0xxx quirk Vee Satayamas <vsatayamas(a)gmail.com> ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK BM1403CDA Jacob Moroni <jmoroni(a)google.com> RDMA/irdma: Fix double free related to rereg_user_mr Vinicius Costa Gomes <vinicius.gomes(a)intel.com> dmaengine: idxd: Fix lockdep warnings when calling idxd_device_config() ------------- Diffstat: Documentation/admin-guide/mm/damon/reclaim.rst | 4 + .../bindings/net/nvidia,tegra234-mgbe.yaml | 4 +- Makefile | 4 +- arch/arm/boot/dts/microchip/sam9x7.dtsi | 2 +- arch/arm64/boot/dts/freescale/imx8mq.dtsi | 2 +- arch/arm64/boot/dts/freescale/imx91-tqma9131.dtsi | 20 +- arch/arm64/boot/dts/freescale/imx93-9x9-qsb.dts | 2 + arch/arm64/boot/dts/freescale/imx93-tqma9352.dtsi | 26 +-- arch/arm64/boot/dts/qcom/hamoa.dtsi | 2 +- arch/arm64/boot/dts/qcom/monaco.dtsi | 9 +- arch/arm64/boot/dts/qcom/qcm6490-idp.dts | 2 +- arch/arm64/include/asm/pgtable-prot.h | 2 + arch/arm64/include/asm/pgtable.h | 9 +- arch/arm64/include/asm/uaccess.h | 2 +- arch/arm64/kvm/guest.c | 4 +- arch/arm64/mm/mmu.c | 4 + arch/arm64/mm/pageattr.c | 50 ++--- arch/arm64/mm/trans_pgd.c | 42 +--- arch/loongarch/kvm/vcpu.c | 2 +- arch/loongarch/kvm/vm.c | 2 +- arch/mips/kvm/mips.c | 4 +- arch/powerpc/include/asm/uaccess.h | 3 +- arch/powerpc/kvm/book3s.c | 4 +- arch/powerpc/kvm/booke.c | 4 +- arch/powerpc/lib/pmem.c | 11 +- arch/riscv/kvm/vcpu.c | 2 +- arch/riscv/kvm/vm.c | 2 +- arch/s390/kvm/kvm-s390.c | 4 +- arch/x86/events/intel/uncore.c | 1 + arch/x86/events/intel/uncore_discovery.c | 2 +- arch/x86/events/intel/uncore_snbep.c | 13 +- arch/x86/include/asm/uaccess.h | 2 +- arch/x86/include/asm/uaccess_32.h | 8 +- arch/x86/include/asm/uaccess_64.h | 16 +- arch/x86/include/uapi/asm/kvm.h | 12 +- arch/x86/kernel/shstk.c | 3 +- arch/x86/kvm/svm/sev.c | 46 +++-- arch/x86/kvm/x86.c | 18 +- arch/x86/lib/copy_user_uncached_64.S | 6 +- arch/x86/lib/usercopy_32.c | 9 +- arch/x86/lib/usercopy_64.c | 12 +- crypto/af_alg.c | 6 +- crypto/algif_aead.c | 2 +- crypto/algif_skcipher.c | 5 + drivers/ata/ahci.c | 14 ++ drivers/dma/idxd/device.c | 17 +- drivers/dma/idxd/init.c | 10 +- drivers/gpio/gpio-tegra.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 6 +- drivers/gpu/drm/amd/amdkfd/kfd_queue.c | 7 +- drivers/gpu/drm/i915/i915_gem.c | 2 +- drivers/gpu/drm/qxl/qxl_ioctl.c | 2 +- drivers/gpu/drm/vc4/vc4_bo.c | 3 + drivers/gpu/drm/vc4/vc4_gem.c | 19 +- drivers/gpu/drm/vc4/vc4_hdmi.c | 14 +- drivers/gpu/drm/vc4/vc4_v3d.c | 1 + drivers/gpu/drm/xe/xe_hw_engine.c | 3 +- drivers/hid/amd-sfh-hid/amd_sfh_pcie.c | 3 +- drivers/hid/hid-alps.c | 3 + drivers/hid/hid-core.c | 3 + drivers/hid/hid-ids.h | 3 + drivers/hid/hid-quirks.c | 1 + drivers/hid/hid-roccat.c | 2 + .../intel-thc-hid/intel-quickspi/pci-quickspi.c | 6 + .../intel-thc-hid/intel-quickspi/quickspi-dev.h | 2 + drivers/hv/mshv_root_main.c | 15 +- drivers/hwmon/powerz.c | 8 +- drivers/i2c/busses/i2c-s3c2410.c | 7 +- drivers/infiniband/hw/irdma/verbs.c | 1 + drivers/infiniband/sw/rdmavt/qp.c | 8 +- drivers/md/bcache/super.c | 7 + .../mediatek/vcodec/encoder/mtk_vcodec_enc_drv.c | 9 + .../media/platform/rockchip/rkvdec/rkvdec-vp9.c | 3 +- drivers/media/test-drivers/vidtv/vidtv_bridge.c | 4 +- drivers/media/test-drivers/vidtv/vidtv_channel.c | 4 + drivers/media/test-drivers/vidtv/vidtv_mux.c | 4 +- drivers/media/test-drivers/vidtv/vidtv_ts.c | 48 ++--- drivers/media/test-drivers/vidtv/vidtv_ts.h | 4 +- drivers/media/usb/as102/as102_usb_drv.c | 2 + drivers/media/usb/em28xx/em28xx-video.c | 14 +- drivers/media/usb/hackrf/hackrf.c | 7 +- drivers/net/can/spi/mcp251x.c | 29 ++- drivers/net/ethernet/airoha/airoha_eth.c | 3 +- drivers/net/ethernet/broadcom/bnge/bnge_auxr.c | 1 + drivers/net/ethernet/freescale/Kconfig | 2 +- drivers/net/ethernet/intel/e1000/e1000_ethtool.c | 8 +- drivers/net/ethernet/intel/ice/ice_ptp.c | 8 +- drivers/net/ethernet/intel/ixgbe/devlink/devlink.c | 2 +- drivers/net/ethernet/intel/ixgbe/ixgbe.h | 2 +- drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c | 13 +- drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 10 + drivers/net/ethernet/intel/ixgbevf/vf.c | 7 + drivers/net/ethernet/stmicro/stmmac/dwmac-tegra.c | 19 +- drivers/net/ethernet/wangxun/txgbe/txgbe_type.h | 8 +- drivers/net/ipa/reg/gsi_reg-v5.0.c | 9 +- drivers/net/mdio/mdio-realtek-rtl9300.c | 3 +- drivers/net/phy/sfp.c | 16 ++ drivers/net/usb/cdc-phonet.c | 7 +- drivers/net/wan/lapbether.c | 13 +- drivers/net/wireguard/device.c | 8 +- .../wireless/broadcom/brcm80211/brcmfmac/fweh.c | 5 + drivers/net/wireless/realtek/rtw88/usb.c | 3 +- drivers/net/wireless/ti/wl1251/tx.c | 8 +- drivers/nfc/s3fwrn5/uart.c | 10 +- drivers/ntb/ntb_transport.c | 7 +- drivers/pci/controller/pci-hyperv.c | 12 +- drivers/pci/endpoint/functions/pci-epf-vntb.c | 20 +- drivers/pinctrl/intel/pinctrl-intel.c | 2 +- drivers/pinctrl/pinctrl-mcp23s08.c | 9 + drivers/platform/x86/amd/pmc/pmc-quirks.c | 9 + drivers/platform/x86/asus-nb-wmi.c | 2 +- drivers/platform/x86/hp/hp-wmi.c | 4 + drivers/soc/aspeed/aspeed-socinfo.c | 2 +- drivers/soc/microchip/mpfs-control-scb.c | 6 +- drivers/soc/microchip/mpfs-mss-top-sysreg.c | 6 +- drivers/soc/qcom/pdr_internal.h | 2 +- drivers/soc/qcom/qcom_pdr_msg.c | 2 +- drivers/staging/rtl8723bs/core/rtw_security.c | 2 +- drivers/staging/sm750fb/sm750.c | 3 + drivers/usb/class/cdc-acm.c | 53 ++++- drivers/usb/core/port.c | 1 + drivers/usb/gadget/function/f_hid.c | 15 +- drivers/usb/gadget/function/f_ncm.c | 4 +- drivers/usb/gadget/function/f_phonet.c | 9 + drivers/usb/gadget/udc/renesas_usb3.c | 7 +- drivers/usb/serial/option.c | 2 + drivers/usb/storage/unusual_devs.h | 7 +- drivers/usb/typec/tcpm/fusb302.c | 5 +- drivers/usb/usbip/usbip_common.c | 12 ++ drivers/vfio/pci/xe/main.c | 43 +++-- drivers/video/fbdev/tdfxfb.c | 3 + drivers/video/fbdev/udlfb.c | 3 + fs/btrfs/tree-log.c | 98 ++++++---- fs/cachefiles/namei.c | 5 + fs/dcache.c | 4 +- fs/eventpoll.c | 6 +- fs/nilfs2/dat.c | 3 + fs/ocfs2/aops.c | 3 +- fs/ocfs2/inode.c | 35 +++- fs/ocfs2/mmap.c | 7 +- fs/ocfs2/ocfs2_trace.h | 10 +- fs/ocfs2/resize.c | 10 +- fs/smb/client/fs_context.c | 4 + fs/smb/client/smb2file.c | 20 +- fs/smb/client/smb2inode.c | 2 +- fs/smb/client/smbdirect.c | 8 + fs/smb/server/connection.c | 1 + fs/smb/server/smb2pdu.c | 7 +- fs/smb/server/smbacl.c | 3 +- fs/smb/server/transport_rdma.c | 8 +- include/hyperv/hvgdk_mini.h | 6 + include/hyperv/hvhdk.h | 4 +- include/linux/clockchips.h | 2 + include/linux/dma-mapping.h | 7 + include/linux/hugetlb.h | 17 ++ include/linux/kvm_host.h | 93 +++++---- include/linux/mmap_lock.h | 6 +- include/linux/soc/qcom/pdr.h | 1 + include/linux/srcutiny.h | 4 + include/linux/uaccess.h | 11 +- include/net/ip_tunnels.h | 2 +- include/net/netfilter/nf_conntrack_core.h | 5 + include/net/netfilter/nf_queue.h | 1 - include/net/xdp_sock.h | 2 +- include/net/xdp_sock_drv.h | 23 ++- include/sound/sdca_interrupts.h | 5 + include/trace/events/btrfs.h | 11 +- include/trace/events/dma.h | 3 +- include/uapi/linux/kvm.h | 19 +- kernel/dma/debug.c | 35 +++- kernel/rcu/srcutiny.c | 19 +- kernel/sched/deadline.c | 2 +- kernel/time/clockevents.c | 27 ++- kernel/time/hrtimer.c | 1 + kernel/time/tick-broadcast.c | 8 +- kernel/time/tick-common.c | 1 + kernel/time/tick-sched.c | 1 + kernel/trace/trace_probe.c | 2 +- lib/iov_iter.c | 4 +- mm/backing-dev.c | 5 +- mm/filemap.c | 3 +- mm/internal.h | 1 - mm/kasan/init.c | 8 +- mm/truncate.c | 6 +- mm/userfaultfd.c | 2 +- net/bluetooth/hci_conn.c | 2 +- net/bluetooth/hci_core.c | 2 +- net/bluetooth/hci_sync.c | 20 +- net/bridge/br_fdb.c | 6 + net/can/raw.c | 11 +- net/core/rtnetlink.c | 40 ++-- net/devlink/health.c | 2 +- net/ipv4/icmp.c | 7 + net/ipv4/nexthop.c | 41 ++-- net/ipv6/ioam6.c | 33 ++-- net/ipv6/netfilter/ip6t_eui64.c | 3 +- net/key/af_key.c | 52 +++-- net/l2tp/l2tp_core.c | 5 + net/netfilter/ipvs/ip_vs_ctl.c | 1 - net/netfilter/nf_conntrack_ecache.c | 2 + net/netfilter/nf_conntrack_expect.c | 10 +- net/netfilter/nf_conntrack_netlink.c | 28 ++- net/netfilter/nfnetlink_log.c | 8 +- net/netfilter/nfnetlink_queue.c | 214 ++++++++------------- net/netfilter/nft_set_pipapo_avx2.c | 20 +- net/netfilter/xt_multiport.c | 34 +++- net/nfc/digital_technology.c | 6 + net/nfc/llcp_core.c | 2 + net/sched/act_csum.c | 6 +- net/unix/diag.c | 21 +- net/xdp/xdp_umem.c | 3 +- net/xdp/xsk.c | 4 +- net/xdp/xsk_buff_pool.c | 32 ++- net/xfrm/xfrm_policy.c | 5 +- net/xfrm/xfrm_user.c | 11 +- scripts/checkpatch.pl | 10 + scripts/gdb/linux/symbols.py | 2 +- scripts/generate_rust_analyzer.py | 3 +- sound/firewire/fireworks/fireworks_command.c | 5 +- sound/hda/codecs/realtek/alc269.c | 35 +++- sound/pci/asihpi/hpimsgx.c | 6 +- sound/pci/ctxfi/ctvmem.h | 2 +- sound/soc/amd/acp/acp-sdw-legacy-mach.c | 16 +- sound/soc/amd/yc/acp6x-mach.c | 21 ++ sound/soc/intel/avs/board_selection.c | 9 +- sound/soc/qcom/qdsp6/q6apm.c | 14 +- sound/soc/sdca/sdca_class_function.c | 30 +++ sound/soc/sdca/sdca_interrupts.c | 80 +++++++- sound/soc/soc-core.c | 1 + sound/soc/sof/intel/hda.c | 10 +- sound/soc/sof/topology.c | 2 +- sound/soc/stm/stm32_sai_sub.c | 3 + sound/usb/6fire/chip.c | 17 +- sound/usb/Kconfig | 1 + sound/usb/quirks.c | 2 + sound/usb/usx2y/us144mkii.c | 6 +- tools/objtool/check.c | 2 +- tools/power/x86/turbostat/turbostat.c | 67 ++++--- .../testing/selftests/bpf/progs/verifier_bounds.c | 137 +++++++++++++ .../testing/selftests/kvm/x86/sev_migrate_tests.c | 2 - tools/testing/selftests/mm/hmm-tests.c | 83 ++------ .../selftests/net/forwarding/bridge_vlan_mcast.sh | 1 + tools/testing/vsock/util.c | 8 +- virt/kvm/binary_stats.c | 2 +- virt/kvm/kvm_main.c | 20 +- 245 files changed, 1954 insertions(+), 958 deletions(-)

3 weeks, 6 days

12
11
0 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

Lkft-triage