Lkft-triage

lkft-triage@lists.linaro.org

20 participants
34241 discussions

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 5.15.211 release. There are 95 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat, 04 Jul 2026 15:50:58 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.211-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 5.15.211-rc1 Thadeu Lima de Souza Cascardo <cascardo(a)igalia.com> dlm: prevent NPD when writing a positive value to event_done Giovanni Cabiddu <giovanni.cabiddu(a)intel.com> crypto: qat - remove unused character device and IOCTLs Herbert Xu <herbert(a)gondor.apana.org.au> crypto: qat - Return pointer directly in adf_ctl_alloc_resources Thorsten Blum <thorsten.blum(a)linux.dev> crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() Bagas Sanjaya <bagasdotme(a)gmail.com> Documentation: ioctl-number: Extend "Include File" column width Gil Portnoy <dddhkts1(a)gmail.com> ksmbd: reject non-VALID session in compound request branch Joanne Koong <joannelkoong(a)gmail.com> fuse: re-lock request before replacing page cache folio Santosh Kalluri <santosh.kalluri129(a)gmail.com> net: phonet: free phonet_device after RCU grace period Kuniyuki Iwashima <kuniyu(a)amazon.com> phonet: Pass net and ifindex to phonet_address_notify(). Kuniyuki Iwashima <kuniyu(a)amazon.com> phonet: Pass ifindex to fill_addr(). Dexuan Cui <decui(a)microsoft.com> Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs Mukesh Ojha <mukesh.ojha(a)oss.qualcomm.com> misc: fastrpc: Fix NULL pointer dereference in rpmsg callback Abel Vesa <abel.vesa(a)linaro.org> misc: fastrpc: Add dma_mask to fastrpc_channel_ctx Thorsten Blum <thorsten.blum(a)linux.dev> hv: utils: handle and propagate errors in kvp_register Paolo Abeni <pabeni(a)redhat.com> mptcp: fix missing wakeups in edge scenarios Michael Bommarito <michael.bommarito(a)gmail.com> NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr Dominik Woźniak <stalion(a)gmail.com> nfsd: check get_user() return when reading princhashlen Jeff Layton <jlayton(a)kernel.org> nfsd: fix posix_acl leak on SETACL decode failure Guannan Wang <wgnbuaa(a)gmail.com> NFSD: Fix SECINFO_NO_NAME decode error cleanup Steffen Persvold <spersvold(a)gmail.com> fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode Ian Bridges <icb(a)fastmail.org> fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var Wentao Liang <vulab(a)iscas.ac.cn> power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() Ashutosh Desai <ashutoshdesai993(a)gmail.com> KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path Zhang Cen <rollkingzzc(a)gmail.com> ocfs2: reject oversized group bitmap descriptors Wentao Liang <vulab(a)iscas.ac.cn> fpga: region: fix use-after-free in child_regions_with_firmware() Qingshuang Fu <fuqingshuang(a)kylinos.cn> irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove Wentao Liang <vulab(a)iscas.ac.cn> pNFS: Fix use-after-free in pnfs_update_layout() Doruk Tan Ozturk <doruk(a)0sec.ai> tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done Fan Wu <fanwu01(a)zju.edu.cn> hdlc_ppp: sync per-proto timers before freeing hdlc state Michael Bommarito <michael.bommarito(a)gmail.com> exfat: fix potential use-after-free in exfat_find_dir_entry() Maciej W. Rozycki <macro(a)orcam.me.uk> MIPS: DEC: Prevent initial console buffer from landing in XKPHYS Dawei Feng <dawei.feng(a)seu.edu.cn> bpf: use kvfree() for replaced sysctl write buffer Zhang Cen <rollkingzzc(a)gmail.com> f2fs: validate ACL entry sizes in f2fs_acl_from_disk() Bitterblue Smith <rtl8821cerfe2(a)gmail.com> wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor Jose Ignacio Tornos Martinez <jtornosm(a)redhat.com> wifi: ath11k: fix warning when unbinding Zenm Chen <zenmchen(a)gmail.com> wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S Shaomin Chen <eeesssooo020(a)gmail.com> keys: Pin request_key_auth payload in instantiate paths Jarkko Sakkinen <jarkko(a)kernel.org> KEYS: fix overflow in keyctl_pkey_params_get_2() Doruk Tan Ozturk <doruk(a)0sec.ai> mac802154: llsec: add skb_cow_data() before in-place crypto Herbert Xu <herbert(a)gondor.apana.org.au> crypto: af_alg - Set merge to zero early in af_alg_sendmsg Yuto Ohnuki <ytohnuki(a)amazon.com> ext4: add bounds check for inline data length in ext4_read_inline_page Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> ntfs3: reject direct userspace writes to reserved $LX* xattrs Bjoern Doebel <doebel(a)amazon.de> ring-buffer: Remove ring_buffer_read_prepare_sync() Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: avoid race of cifsnotfound handler state Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: enforce 2-byte alignment Sven Eckelmann <sven(a)narfation.org> batman-adv: dat: prevent false sharing between VLANs Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: track roam count per VID Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: don't merge change entries with different VIDs Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: handle overlapping packets Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: prevent parallel modifications of last_recv Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: restrict number of unacked list entries Sven Eckelmann <sven(a)narfation.org> batman-adv: v: prevent OGM aggregation on disabled hardif Sven Eckelmann <sven(a)narfation.org> batman-adv: frag: avoid underflow of TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: frag: ensure fragment is writable before modifying TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: fix (m|b)cast csum after decrementing TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: ensure bcast is writable before modifying TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: initialize last_recv_time during init Sven Eckelmann <sven(a)narfation.org> batman-adv: prevent ELP transmission interval underflow Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: add only finished tp_vars to lists Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: fix fast recovery precondition Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: avoid window underflow Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: initialize dec_cwnd explicitly Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: initialize dup_acks explicitly Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: keep unacked list in ascending ordered Yijia Wang <wangyijia.yeah(a)bytedance.com> kselftest/arm64: signal: Skip SVE signal test if not enough VLs supported Sean Christopherson <seanjc(a)google.com> KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level Petr Machata <petrm(a)nvidia.com> Revert "ptp: add testptp mask test" Petr Machata <petrm(a)nvidia.com> Revert "selftest/ptp: update ptp selftest to exercise the gettimex options" Miklos Szeredi <mszeredi(a)redhat.com> virtiofs: fix UAF on submount umount Ruslan Valiyev <linuxoid(a)gmail.com> media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si Yi Yang <yiyang13(a)huawei.com> vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write André Draszik <andre.draszik(a)linaro.org> regulator: core: fix locking in regulator_resolve_supply() error path Jiexun Wang <wangjiexun2025(a)gmail.com> af_unix: Reject SIOCATMARK on non-stream sockets Mathias Nyman <mathias.nyman(a)linux.intel.com> xhci: fix memory leak regression when freeing xhci vdev devices depth first Mingyu Wang <25181214217(a)stu.xidian.edu.cn> agp/amd64: Fix broken error propagation in agp_amd64_probe() Weiming Shi <bestswngs(a)gmail.com> net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() Weiming Shi <bestswngs(a)gmail.com> i2c: stub: Reject I2C block transfers with invalid length Lord Ulf Henrik Holmberg <henrik.holmberg(a)defensify.se> RDMA/bnxt_re: zero shared page before exposing to userspace Jiacheng Shi <billsjc(a)sjtu.edu.cn> vfio/iommu_type1: replace kfree with kvfree Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: light: bh1780: fix PM runtime leak on error path Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: prevent TVLV entry number overflow Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: reject oversized local TVLV buffers Maíra Canal <mcanal(a)igalia.com> drm/v3d: Skip CSD when it has zeroed workgroups Maíra Canal <mcanal(a)igalia.com> drm/v3d: Store the active job inside the queue's state Eric Dumazet <edumazet(a)google.com> ip6_vti: set netns_immutable on the fallback device. Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Bound VBIOS record-chain walk loops Pedro Tammela <pctammela(a)mojatatu.com> net/sched: act_pedit: free pedit keys on bail from offset check Rajat Gupta <rajat.gupta(a)oss.qualcomm.com> net/sched: fix pedit partial COW leading to page cache corruption Pedro Tammela <pctammela(a)mojatatu.com> net/sched: act_pedit: rate limit datapath messages Pedro Tammela <pctammela(a)mojatatu.com> net/sched: act_pedit: check static offsets a priori Jann Horn <jannh(a)google.com> fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios ------------- Diffstat: Documentation/userspace-api/ioctl/ioctl-number.rst | 447 ++++++++++----------- Makefile | 4 +- arch/mips/dec/prom/console.c | 7 +- arch/x86/kvm/mmu/mmu.c | 19 +- arch/x86/kvm/svm/sev.c | 1 + crypto/af_alg.c | 2 + drivers/char/agp/amd64-agp.c | 2 +- drivers/crypto/qat/qat_common/adf_cfg_common.h | 32 -- drivers/crypto/qat/qat_common/adf_cfg_user.h | 38 -- drivers/crypto/qat/qat_common/adf_common_drv.h | 3 - drivers/crypto/qat/qat_common/adf_ctl_drv.c | 421 +------------------ drivers/crypto/qat/qat_common/adf_dev_mgr.c | 70 ---- drivers/fpga/of-fpga-region.c | 3 +- drivers/gpu/drm/amd/display/dc/bios/bios_parser.c | 15 +- drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | 15 +- .../drm/amd/display/dc/bios/bios_parser_helper.h | 5 + drivers/gpu/drm/v3d/v3d_drv.h | 8 +- drivers/gpu/drm/v3d/v3d_gem.c | 5 +- drivers/gpu/drm/v3d/v3d_irq.c | 24 +- drivers/gpu/drm/v3d/v3d_sched.c | 36 +- drivers/hv/hv_kvp.c | 25 +- drivers/hv/vmbus_drv.c | 56 ++- drivers/i2c/i2c-stub.c | 5 + drivers/iio/light/bh1780.c | 4 +- drivers/infiniband/hw/bnxt_re/ib_verbs.c | 2 +- drivers/irqchip/irq-imgpdc.c | 6 + drivers/media/test-drivers/vidtv/vidtv_mux.c | 8 +- drivers/misc/fastrpc.c | 7 +- drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c | 8 +- drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h | 1 + drivers/net/wan/hdlc_ppp.c | 15 +- drivers/net/wireless/ath/ath11k/dp.c | 1 + drivers/net/wireless/mediatek/mt76/mt76x2/usb.c | 1 + .../net/wireless/realtek/rtlwifi/rtl8821ae/trx.h | 2 +- drivers/power/reset/linkstation-poweroff.c | 2 +- drivers/regulator/core.c | 10 +- drivers/tty/vt/vc_screen.c | 2 +- drivers/usb/host/xhci-mem.c | 2 +- drivers/vfio/vfio_iommu_type1.c | 2 +- drivers/video/fbdev/core/fbmem.c | 12 + drivers/video/fbdev/core/modedb.c | 2 +- fs/dlm/lockspace.c | 2 +- fs/exfat/dir.c | 4 +- fs/ext4/inline.c | 8 + fs/f2fs/acl.c | 18 +- fs/fuse/dev.c | 23 +- fs/fuse/file.c | 8 +- fs/ksmbd/smb2pdu.c | 5 + fs/nfs/pnfs.c | 2 +- fs/nfs/pnfs_nfs.c | 4 +- fs/nfsd/nfs2acl.c | 17 +- fs/nfsd/nfs3acl.c | 17 +- fs/nfsd/nfs4recover.c | 3 +- fs/nfsd/nfs4xdr.c | 3 +- fs/ntfs3/xattr.c | 12 + fs/ocfs2/suballoc.c | 22 + include/keys/request_key_auth-type.h | 2 + include/linux/kvm_host.h | 7 +- include/linux/ring_buffer.h | 4 +- include/net/phonet/pn_dev.h | 2 +- include/net/tc_act/tc_pedit.h | 1 - kernel/bpf/cgroup.c | 2 +- kernel/trace/ring_buffer.c | 74 +--- kernel/trace/trace.c | 14 +- kernel/trace/trace_kdb.c | 8 +- net/batman-adv/bat_iv_ogm.c | 11 +- net/batman-adv/bat_v.c | 1 + net/batman-adv/bat_v_ogm.c | 23 +- net/batman-adv/bridge_loop_avoidance.c | 28 +- net/batman-adv/distributed-arp-table.c | 12 +- net/batman-adv/fragmentation.c | 22 +- net/batman-adv/fragmentation.h | 3 +- net/batman-adv/netlink.c | 10 +- net/batman-adv/routing.c | 64 ++- net/batman-adv/tp_meter.c | 115 ++++-- net/batman-adv/translation-table.c | 40 +- net/batman-adv/tvlv.c | 69 +++- net/batman-adv/types.h | 21 +- net/ipv6/ip6_vti.c | 1 + net/mac802154/llsec.c | 14 + net/mptcp/protocol.c | 4 +- net/phonet/pn_dev.c | 12 +- net/phonet/pn_netlink.c | 23 +- net/sched/act_pedit.c | 101 +++-- net/tipc/crypto.c | 9 + net/unix/af_unix.c | 3 + security/keys/internal.h | 2 + security/keys/keyctl.c | 24 +- security/keys/keyctl_pkey.c | 9 +- security/keys/request_key_auth.c | 33 +- .../testcases/fake_sigreturn_sve_change_vl.c | 2 + tools/testing/selftests/ptp/testptp.c | 79 +--- 92 files changed, 1104 insertions(+), 1223 deletions(-)

1 month, 4 weeks

韓国ブームに乗った、新規事業

by フランチャイズセミナー事務局｜ K Village 韓国語

　　お世話になります。　　新たな事業展開をお考えの経営者様へ、　「市場は急成長×少競合×上場企業が運営」3拍子揃った、韓国語教室のフランチャイズ説明会をご案内申し上げます。 ━━━━━━━━━━━━━━━━━━━━━━━━ 　　　　7月10日（金）13:00〜14:00 　　　7月19日（日）11:00〜12:00 　　　※内容は同じです。　◆　韓国語ブームを味方に、先行者利益と安定収益を　　　日本最大級の韓国語スクール　　　”K Village 韓国語” 　※　オーナー様に韓国語や業界知識などは不要で、　　　未経験から開業することができます。　◆　セミナーの視聴予約はこちら　　　https://k-village-school.jp/seminar/ ━━━━━━━━━━━━━━━━━━━━━━━━ 　　韓国語の学習業界は、K-POP・韓国ドラマ人気の影響で　急成長しています。　その中でもK Village韓国語は、　東証プライム上場企業グループのブランド力と集客力を背景に、　生徒数15,000人・月間の問合せ数1,500件を超える　日本最大の韓国語教室です。　　24年5月までに開校した、直営する19校舎では黒字化を達成し、　再現性の高い安定したビジネスモデルの構築に成功しました。　　そして、このタイミングでマーケットシェアを一気に拡大して　競合他社を圧倒する経済性をもつ事業へと成長させるべく、　フランチャイズ加盟店を募集する運びとなりました。　韓国語コミュニティをけん引する私たちと、　事業の拡大を共創していきませんか？　　今このタイミングでの加盟は、　他にはない特別な成長機会を得られるチャンスです。　新規事業をお考えでしたらぜひ、ご視聴ください。 ━━━━━━━━━━━━━━━━━━━ 　■　開催日程　　　7月10日（金）13:00〜14:00 　　　7月19日（日）11:00〜12:00 　　　※内容は同じです。　■　開催方式　　　・オンライン開催　■　コンテンツ　　　・韓国語ビジネスの市場と魅力について　　　・K Villageのビジネスモデル　　　・競合優位性と収益の事例　　　・フランチャイズについて　■　主催　　　・株式会社 K Village 　■　定員　　　・10社／各回　■　参加費　　　・不要です　■　視聴のご予約はこちら　　　https://k-village-school.jp/seminar/ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 本メールが不要の方には大変失礼しました。今後ご案内が不要な際は、下記URLにてより手続きを承っています。 https://k-village-school.jp/mail/ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 株式会社 K Village 東京都新宿区西新宿2-4-1 新宿NSビル7F ━━━━━━━━━━━━━━━━━━━━━━━━━━━━

1 month, 4 weeks

[PATCH 7.1 000/120] 7.1.3-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 7.1.3 release. There are 120 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat, 04 Jul 2026 15:50:58 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.1.3-rc1.… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.1.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 7.1.3-rc1 John Johansen <john.johansen(a)canonical.com> apparmor: advertise the tcp fast open fix is applied HanQuan <eilaimemedsnaimel(a)gmail.com> net/tcp-ao: fix use-after-free of key in del_async path Hem Parekh <hemparekh1596(a)gmail.com> ksmbd: fix out-of-bounds read in smb_check_perm_dacl() Markus Elfring <elfring(a)users.sourceforge.net> NFS: Prevent resource leak in nfs_alloc_server() Igor Raits <igor.raits(a)gmail.com> NFSv4: clear exception state on successful mkdir retry Michael Bommarito <michael.bommarito(a)gmail.com> NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr Michael Bommarito <michael.bommarito(a)gmail.com> NFSv4/flexfiles: reject zero filehandle version count Jeff Layton <jlayton(a)kernel.org> nfsd: reset write verifier on deferred writeback errors Jeff Layton <jlayton(a)kernel.org> nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race Jeff Layton <jlayton(a)kernel.org> nfsd: fix dead ACL conflict guard in nfsd4_create Dominik Woźniak <stalion(a)gmail.com> nfsd: check get_user() return when reading princhashlen Jeff Layton <jlayton(a)kernel.org> nfsd: fix posix_acl leak and ignored error in nfsd4_create_file Jeff Layton <jlayton(a)kernel.org> nfsd: fix inverted cp_ttl check in async copy reaper Jeff Layton <jlayton(a)kernel.org> nfsd: fix posix_acl leak on SETACL decode failure Guannan Wang <wgnbuaa(a)gmail.com> NFSD: Fix SECINFO_NO_NAME decode error cleanup Chris Mason <clm(a)meta.com> nfsd: release layout stid on setlease failure Johan Hovold <johan(a)kernel.org> i2c: core: fix adapter registration race Steffen Persvold <spersvold(a)gmail.com> fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode Tuo Li <islituo(a)gmail.com> fbdev: modedb: fix a possible UAF in fb_find_mode() Hongling Zeng <zenghongling(a)kylinos.cn> fbdev: omap2: fix use-after-free in omapfb_mmap Mingyu Wang <25181214217(a)stu.xidian.edu.cn> fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font() Ian Bridges <icb(a)fastmail.org> fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var Hyunchul Lee <hyc.lee(a)gmail.com> ntfs: serialize volume label accesses Vivian Wang <wangruikang(a)iscas.ac.cn> riscv: kfence: Call mark_new_valid_map() for kfence_unprotect() Wentao Liang <vulab(a)iscas.ac.cn> power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() Ashutosh Desai <ashutoshdesai993(a)gmail.com> KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path Hyunwoo Kim <imv4bel(a)gmail.com> KVM: x86: hyper-v: Bound the bank index when querying sparse banks Jonas Jelonek <jelonek.jonas(a)gmail.com> MIPS: smp: report dying CPU to RCU in stop_this_cpu() Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> 9p: avoid putting oldfid in p9_client_walk() error path Zhang Cen <rollkingzzc(a)gmail.com> ocfs2: reject oversized group bitmap descriptors Yuho Choi <dbgh9129(a)gmail.com> rpmsg: char: Fix use-after-free on probe error path Wentao Liang <vulab(a)iscas.ac.cn> fpga: region: fix use-after-free in child_regions_with_firmware() Qingshuang Fu <fuqingshuang(a)kylinos.cn> irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove Rik van Riel <riel(a)surriel.com> sched/mmcid: Fix OOB clear_bit when CID is MM_CID_UNSET in fixup path Wentao Liang <vulab(a)iscas.ac.cn> pNFS: Fix use-after-free in pnfs_update_layout() Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Report dying CPU to RCU in stop_this_cpu() Doruk Tan Ozturk <doruk(a)0sec.ai> tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done Michal Koutný <mkoutny(a)suse.com> blk-cgroup: fix UAF in __blkcg_rstat_flush() Fan Wu <fanwu01(a)zju.edu.cn> hdlc_ppp: sync per-proto timers before freeing hdlc state Wentao Liang <vulab(a)iscas.ac.cn> pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next() Tristan Madani <tristan(a)talencesecurity.com> gfs2: fix use-after-free in gfs2_qd_dealloc Sam James <sam(a)gentoo.org> crypto: nx - fix nx_crypto_ctx_exit argument Sean Christopherson <seanjc(a)google.com> KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() Sean Christopherson <seanjc(a)google.com> KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level Michael Bommarito <michael.bommarito(a)gmail.com> exfat: fix potential use-after-free in exfat_find_dir_entry() Maciej W. Rozycki <macro(a)orcam.me.uk> MIPS: DEC: Prevent initial console buffer from landing in XKPHYS Dawei Feng <dawei.feng(a)seu.edu.cn> bpf: use kvfree() for replaced sysctl write buffer Denis Arefev <arefev(a)swemel.ru> block: Avoid mounting the bdev pseudo-filesystem in userspace Mikhail Lobanov <m.lobanov(a)rosa.ru> f2fs: read COW data with the original inode during atomic write Wenjie Qi <qwjhust(a)gmail.com> f2fs: keep atomic write retry from zeroing original data Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node() Zhaoyang Huang <zhaoyang.huang(a)unisoc.com> Revert "f2fs: remove non-uptodate folio from the page cache in move_data_block" Zhang Cen <rollkingzzc(a)gmail.com> f2fs: validate ACL entry sizes in f2fs_acl_from_disk() Bryam Vargas <hexlabsecurity(a)proton.me> f2fs: bound i_inline_xattr_size for non-inline-xattr inodes Sunmin Jeong <s_min.jeong(a)samsung.com> f2fs: fix to round down start offset of fallocate for pin file Chao Yu <chao(a)kernel.org> f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode Wenjie Qi <qwjhust(a)gmail.com> f2fs: validate compress cache inode only when enabled Wenjie Qi <qwjhust(a)gmail.com> f2fs: validate orphan inode entry count Chao Yu <chao(a)kernel.org> f2fs: fix to do sanity check on f2fs_get_node_folio_ra() Wenjie Qi <qwjhust(a)gmail.com> f2fs: reject setattr size changes on large folio files Wenjie Qi <qwjhust(a)gmail.com> f2fs: pass correct iostat type for single node writes Wenjie Qi <qiwenjie(a)xiaomi.com> f2fs: fix missing read bio submission on large folio error Junrui Luo <moonafterrain(a)outlook.com> wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers Junjie Cao <junjie.cao(a)intel.com> wifi: iwlwifi: mld: fix race condition in PTP removal Junjie Cao <junjie.cao(a)intel.com> wifi: iwlwifi: mvm: fix race condition in PTP removal Luka Gejak <luka.gejak(a)linux.dev> wifi: rtw88: usb: fix memory leaks on USB write failures Luka Gejak <luka.gejak(a)linux.dev> wifi: rtw88: increase TX report timeout to fix race condition Bitterblue Smith <rtl8821cerfe2(a)gmail.com> wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor Bitterblue Smith <rtl8821cerfe2(a)gmail.com> wifi: rtl8xxxu: Detect the maximum supported channel width Jose Ignacio Tornos Martinez <jtornosm(a)redhat.com> wifi: ath11k: fix warning when unbinding ElXreno <elxreno(a)gmail.com> wifi: mt76: mt7925: don't disable AP BSS when removing TDLS peer Zenm Chen <zenmchen(a)gmail.com> wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S Kiryl Shutsemau (Meta) <kas(a)kernel.org> userfaultfd: build __VMA_UFFD_FLAGS from config-gated masks Mike Rapoport (Microsoft) <rppt(a)kernel.org> userfaultfd: ensure mremap_userfaultfd_fail() releases mmap_changing Shaomin Chen <eeesssooo020(a)gmail.com> keys: Pin request_key_auth payload in instantiate paths Jarkko Sakkinen <jarkko(a)kernel.org> KEYS: fix overflow in keyctl_pkey_params_get_2() Konstantin Khorenko <khorenko(a)virtuozzo.com> gcov: use atomic counter updates to fix concurrent access crashes Arnd Bergmann <arnd(a)arndb.de> err.h: use __always_inline on all error pointer helpers Ard Biesheuvel <ardb(a)kernel.org> KVM: arm64: Omit tag sync on stage-2 mappings of the zero page Usama Arif <usama.arif(a)linux.dev> block: invalidate cached plug timestamp after task switch Eric Biggers <ebiggers(a)kernel.org> fscrypt: Fix key setup in edge case with multiple data unit sizes Ian Bridges <icb(a)fastmail.org> fbdev: fix use-after-free in store_modes() Koichiro Den <den(a)valinux.co.jp> NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR Ruslan Valiyev <linuxoid(a)gmail.com> apparmor: fix use-after-free in rawdata dedup loop Bryam Vargas <hexlabsecurity(a)proton.me> apparmor: mediate the implicit connect of TCP fast open sendmsg Lukas Wunner <lukas(a)wunner.de> PCI/P2PDMA: Add Intel QAT, DSA, IAA devices to whitelist Maoyi Xie <maoyixie.tju(a)gmail.com> net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink Yiming Qian <yimingqian591(a)gmail.com> net: skmsg: preserve sg.copy across SG transforms Doruk Tan Ozturk <doruk(a)0sec.ai> mac802154: llsec: add skb_cow_data() before in-place crypto Jiajia Liu <liujiajia(a)kylinos.cn> wifi: mt76: add wcid publish check in mt76_sta_add Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> ntfs3: reject direct userspace writes to reserved $LX* xattrs Wongi Lee <qw3rtyp0(a)gmail.com> ipv4: account for fraggap on the paged allocation path Wongi Lee <qw3rtyp0(a)gmail.com> ipv6: account for fraggap on the paged allocation path Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: avoid race of cifsnotfound handler state Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: enforce 2-byte alignment Sven Eckelmann <sven(a)narfation.org> batman-adv: dat: prevent false sharing between VLANs Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: track roam count per VID Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: don't merge change entries with different VIDs Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: handle overlapping packets Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: prevent parallel modifications of last_recv Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: restrict number of unacked list entries Sven Eckelmann <sven(a)narfation.org> batman-adv: v: prevent OGM aggregation on disabled hardif Sven Eckelmann <sven(a)narfation.org> batman-adv: frag: avoid underflow of TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: frag: ensure fragment is writable before modifying TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: fix (m|b)cast csum after decrementing TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: ensure bcast is writable before modifying TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: gw: don't deselect gateway with active hardif Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: initialize last_recv_time during init Sven Eckelmann <sven(a)narfation.org> batman-adv: prevent ELP transmission interval underflow Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: add only finished tp_vars to lists Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: fix fast recovery precondition Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: avoid window underflow Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: initialize dec_cwnd explicitly Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: initialize dup_acks explicitly Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: keep unacked list in ascending ordered Paolo Bonzini <pbonzini(a)redhat.com> KVM: x86: Fix shadow paging use-after-free due to unexpected role ------------- Diffstat: Makefile | 31 ++++-- arch/arm64/kvm/mmu.c | 5 + arch/loongarch/kernel/smp.c | 1 + arch/mips/dec/prom/console.c | 7 +- arch/mips/kernel/smp.c | 2 + arch/riscv/include/asm/kfence.h | 7 +- arch/riscv/kernel/entry.S | 6 +- arch/x86/kvm/hyperv.c | 5 + arch/x86/kvm/mmu/mmu.c | 28 +++-- arch/x86/kvm/svm/sev.c | 1 + block/bdev.c | 5 - block/blk-cgroup.c | 21 ++-- .../intel/qat/qat_common/adf_accel_devices.h | 5 - drivers/crypto/nx/nx.c | 6 +- drivers/crypto/nx/nx.h | 2 +- drivers/dma/idxd/registers.h | 3 - drivers/fpga/of-fpga-region.c | 3 +- drivers/i2c/i2c-core-base.c | 8 +- drivers/irqchip/irq-imgpdc.c | 6 ++ drivers/net/wan/hdlc_ppp.c | 15 ++- drivers/net/wireless/ath/ath11k/dp.c | 1 + drivers/net/wireless/intel/iwlwifi/mld/agg.c | 9 ++ drivers/net/wireless/intel/iwlwifi/mld/ptp.c | 2 +- drivers/net/wireless/intel/iwlwifi/mvm/ptp.c | 2 +- drivers/net/wireless/mediatek/mt76/mac80211.c | 15 ++- drivers/net/wireless/mediatek/mt76/mt76x2/usb.c | 1 + drivers/net/wireless/mediatek/mt76/mt7925/main.c | 3 + drivers/net/wireless/realtek/rtl8xxxu/8188e.c | 1 + drivers/net/wireless/realtek/rtl8xxxu/8188f.c | 1 + drivers/net/wireless/realtek/rtl8xxxu/8192c.c | 1 + drivers/net/wireless/realtek/rtl8xxxu/8192e.c | 1 + drivers/net/wireless/realtek/rtl8xxxu/8192f.c | 1 + drivers/net/wireless/realtek/rtl8xxxu/8710b.c | 1 + drivers/net/wireless/realtek/rtl8xxxu/8723a.c | 1 + drivers/net/wireless/realtek/rtl8xxxu/8723b.c | 1 + drivers/net/wireless/realtek/rtl8xxxu/core.c | 64 ++++++++++- drivers/net/wireless/realtek/rtl8xxxu/regs.h | 2 + drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h | 7 ++ .../net/wireless/realtek/rtlwifi/rtl8821ae/trx.h | 2 +- drivers/net/wireless/realtek/rtw88/tx.c | 7 +- drivers/net/wireless/realtek/rtw88/usb.c | 13 ++- drivers/ntb/hw/epf/ntb_hw_epf.c | 3 +- drivers/pci/p2pdma.c | 10 ++ drivers/power/reset/linkstation-poweroff.c | 2 +- drivers/power/sequencing/core.c | 14 ++- drivers/rpmsg/rpmsg_char.c | 15 ++- drivers/video/fbdev/core/fbcon.c | 7 ++ drivers/video/fbdev/core/fbmem.c | 12 +++ drivers/video/fbdev/core/fbsysfs.c | 10 +- drivers/video/fbdev/core/modedb.c | 5 +- drivers/video/fbdev/omap2/omapfb/omapfb-main.c | 9 +- fs/crypto/fscrypt_private.h | 52 +++++---- fs/crypto/inline_crypt.c | 8 +- fs/crypto/keyring.c | 23 ++-- fs/crypto/keysetup.c | 118 +++++++++++++-------- fs/exfat/dir.c | 4 +- fs/f2fs/acl.c | 18 +++- fs/f2fs/checkpoint.c | 14 ++- fs/f2fs/data.c | 49 +++++---- fs/f2fs/extent_cache.c | 19 ++-- fs/f2fs/f2fs.h | 1 + fs/f2fs/file.c | 11 +- fs/f2fs/gc.c | 56 +++++++--- fs/f2fs/inode.c | 26 +++-- fs/f2fs/node.c | 8 +- fs/gfs2/super.c | 1 + fs/nfs/client.c | 1 + fs/nfs/flexfilelayout/flexfilelayout.c | 4 + fs/nfs/nfs4proc.c | 5 +- fs/nfs/pnfs.c | 2 +- fs/nfs/pnfs_nfs.c | 4 +- fs/nfsd/nfs2acl.c | 17 ++- fs/nfsd/nfs3acl.c | 17 ++- fs/nfsd/nfs4layouts.c | 12 +-- fs/nfsd/nfs4proc.c | 19 ++-- fs/nfsd/nfs4recover.c | 3 +- fs/nfsd/nfs4state.c | 1 + fs/nfsd/nfs4xdr.c | 3 +- fs/nfsd/vfs.c | 6 +- fs/ntfs/file.c | 17 ++- fs/ntfs/super.c | 21 ++-- fs/ntfs/volume.h | 2 + fs/ntfs3/xattr.c | 12 +++ fs/ocfs2/suballoc.c | 22 ++++ fs/smb/server/smbacl.c | 4 +- fs/userfaultfd.c | 2 + include/keys/request_key_auth-type.h | 2 + include/linux/blkdev.h | 16 ++- include/linux/err.h | 12 +-- include/linux/f2fs_fs.h | 1 + include/linux/kvm_host.h | 7 +- include/linux/mm.h | 39 +++++++ include/linux/pci_ids.h | 8 ++ include/linux/skmsg.h | 15 ++- include/linux/userfaultfd_k.h | 4 +- include/net/rtnetlink.h | 2 + kernel/bpf/cgroup.c | 2 +- kernel/sched/core.c | 27 +++-- net/9p/client.c | 3 +- net/batman-adv/bat_iv_ogm.c | 11 +- net/batman-adv/bat_v.c | 1 + net/batman-adv/bat_v_ogm.c | 23 +++- net/batman-adv/bridge_loop_avoidance.c | 28 ++--- net/batman-adv/distributed-arp-table.c | 12 ++- net/batman-adv/fragmentation.c | 22 +++- net/batman-adv/fragmentation.h | 3 +- net/batman-adv/hard-interface.c | 28 +---- net/batman-adv/netlink.c | 10 +- net/batman-adv/routing.c | 73 ++++++++++++- net/batman-adv/tp_meter.c | 115 +++++++++++++------- net/batman-adv/translation-table.c | 12 ++- net/batman-adv/tvlv.c | 69 ++++++++++-- net/batman-adv/types.h | 21 ++-- net/core/filter.c | 27 +++++ net/core/rtnetlink.c | 8 ++ net/core/skmsg.c | 2 + net/ipv4/ip_gre.c | 6 ++ net/ipv4/ip_output.c | 7 +- net/ipv4/tcp_ao.c | 4 + net/ipv6/ip6_output.c | 9 +- net/mac802154/llsec.c | 14 +++ net/tipc/crypto.c | 9 ++ net/tls/tls_sw.c | 4 + security/apparmor/include/policy_unpack.h | 19 ++++ security/apparmor/lsm.c | 16 ++- security/apparmor/net.c | 2 + security/apparmor/policy.c | 8 +- security/keys/internal.h | 2 + security/keys/keyctl.c | 24 +++-- security/keys/keyctl_pkey.c | 9 +- security/keys/request_key_auth.c | 33 +++++- virt/kvm/eventfd.c | 12 +-- 132 files changed, 1312 insertions(+), 441 deletions(-)

2 months

[PATCH 5.10 00/96] 5.10.260-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 5.10.260 release. There are 96 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat, 04 Jul 2026 15:50:58 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.260-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 5.10.260-rc1 Miklos Szeredi <mszeredi(a)redhat.com> virtiofs: fix UAF on submount umount Junrui Luo <moonafterrain(a)outlook.com> misc: fastrpc: fix DMA address corruption due to find_vma misuse Lad Prabhakar <prabhakar.mahadev-lad.rj(a)bp.renesas.com> mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC Santosh Kalluri <santosh.kalluri129(a)gmail.com> net: phonet: free phonet_device after RCU grace period Kuniyuki Iwashima <kuniyu(a)amazon.com> phonet: Pass net and ifindex to phonet_address_notify(). Kuniyuki Iwashima <kuniyu(a)amazon.com> phonet: Pass ifindex to fill_addr(). Dexuan Cui <decui(a)microsoft.com> Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs Mukesh Ojha <mukesh.ojha(a)oss.qualcomm.com> misc: fastrpc: Fix NULL pointer dereference in rpmsg callback Abel Vesa <abel.vesa(a)linaro.org> misc: fastrpc: Add dma_mask to fastrpc_channel_ctx Paolo Abeni <pabeni(a)redhat.com> mptcp: fix missing wakeups in edge scenarios Thorsten Blum <thorsten.blum(a)linux.dev> hv: utils: handle and propagate errors in kvp_register Kyle Meyer <kyle.meyer(a)hpe.com> bnxt_en: Fix NULL pointer dereference Michael Chan <michael.chan(a)broadcom.com> bnxt_en: Modify bnxt_disable_int_sync() to be called more than once. Yongchao Wu <yongchao.wu(a)autochips.com> usb: cdns3: gadget: fix NULL pointer dereference in ep_queue Thadeu Lima de Souza Cascardo <cascardo(a)igalia.com> dlm: prevent NPD when writing a positive value to event_done Dominik Woźniak <stalion(a)gmail.com> nfsd: check get_user() return when reading princhashlen Jeff Layton <jlayton(a)kernel.org> nfsd: fix posix_acl leak on SETACL decode failure Guannan Wang <wgnbuaa(a)gmail.com> NFSD: Fix SECINFO_NO_NAME decode error cleanup Steffen Persvold <spersvold(a)gmail.com> fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode Ian Bridges <icb(a)fastmail.org> fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var Ashutosh Desai <ashutoshdesai993(a)gmail.com> KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path Zhang Cen <rollkingzzc(a)gmail.com> ocfs2: reject oversized group bitmap descriptors Wentao Liang <vulab(a)iscas.ac.cn> fpga: region: fix use-after-free in child_regions_with_firmware() Qingshuang Fu <fuqingshuang(a)kylinos.cn> irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove Wentao Liang <vulab(a)iscas.ac.cn> pNFS: Fix use-after-free in pnfs_update_layout() Doruk Tan Ozturk <doruk(a)0sec.ai> tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done Michael Bommarito <michael.bommarito(a)gmail.com> exfat: fix potential use-after-free in exfat_find_dir_entry() Maciej W. Rozycki <macro(a)orcam.me.uk> MIPS: DEC: Prevent initial console buffer from landing in XKPHYS Dawei Feng <dawei.feng(a)seu.edu.cn> bpf: use kvfree() for replaced sysctl write buffer Zhang Cen <rollkingzzc(a)gmail.com> f2fs: validate ACL entry sizes in f2fs_acl_from_disk() Bitterblue Smith <rtl8821cerfe2(a)gmail.com> wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor Jose Ignacio Tornos Martinez <jtornosm(a)redhat.com> wifi: ath11k: fix warning when unbinding Zenm Chen <zenmchen(a)gmail.com> wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S Shaomin Chen <eeesssooo020(a)gmail.com> keys: Pin request_key_auth payload in instantiate paths Jarkko Sakkinen <jarkko(a)kernel.org> KEYS: fix overflow in keyctl_pkey_params_get_2() Doruk Tan Ozturk <doruk(a)0sec.ai> mac802154: llsec: add skb_cow_data() before in-place crypto Kevin Hao <haokexin(a)gmail.com> net: cpsw_new: Fix potential unregister of netdev that has not been registered yet Herbert Xu <herbert(a)gondor.apana.org.au> crypto: af_alg - Set merge to zero early in af_alg_sendmsg Yuto Ohnuki <ytohnuki(a)amazon.com> ext4: add bounds check for inline data length in ext4_read_inline_page Bjoern Doebel <doebel(a)amazon.de> ring-buffer: Remove ring_buffer_read_prepare_sync() Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: avoid race of cifsnotfound handler state Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: enforce 2-byte alignment Sven Eckelmann <sven(a)narfation.org> batman-adv: dat: prevent false sharing between VLANs Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: track roam count per VID Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: don't merge change entries with different VIDs Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: handle overlapping packets Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: prevent parallel modifications of last_recv Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: restrict number of unacked list entries Sven Eckelmann <sven(a)narfation.org> batman-adv: v: prevent OGM aggregation on disabled hardif Sven Eckelmann <sven(a)narfation.org> batman-adv: frag: avoid underflow of TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: frag: ensure fragment is writable before modifying TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: initialize last_recv_time during init Sven Eckelmann <sven(a)narfation.org> batman-adv: prevent ELP transmission interval underflow Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: add only finished tp_vars to lists Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: fix fast recovery precondition Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: avoid window underflow Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: initialize dec_cwnd explicitly Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: initialize dup_acks explicitly Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: keep unacked list in ascending ordered Pedro Tammela <pctammela(a)mojatatu.com> net/sched: act_pedit: fix action bind logic Giovanni Cabiddu <giovanni.cabiddu(a)intel.com> crypto: qat - remove unused character device and IOCTLs Herbert Xu <herbert(a)gondor.apana.org.au> crypto: qat - Return pointer directly in adf_ctl_alloc_resources Thorsten Blum <thorsten.blum(a)linux.dev> crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() Bagas Sanjaya <bagasdotme(a)gmail.com> Documentation: ioctl-number: Extend "Include File" column width Ruslan Valiyev <linuxoid(a)gmail.com> media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si Yi Yang <yiyang13(a)huawei.com> vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write André Draszik <andre.draszik(a)linaro.org> regulator: core: fix locking in regulator_resolve_supply() error path Mingyu Wang <25181214217(a)stu.xidian.edu.cn> agp/amd64: Fix broken error propagation in agp_amd64_probe() Weiming Shi <bestswngs(a)gmail.com> net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() Weiming Shi <bestswngs(a)gmail.com> i2c: stub: Reject I2C block transfers with invalid length Lord Ulf Henrik Holmberg <henrik.holmberg(a)defensify.se> RDMA/bnxt_re: zero shared page before exposing to userspace Jiacheng Shi <billsjc(a)sjtu.edu.cn> vfio/iommu_type1: replace kfree with kvfree Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: prevent TVLV entry number overflow Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: reject oversized local TVLV buffers Wang Yufen <wangyufen(a)huawei.com> netdevsim: Fix memory leak of nsim_dev->fa_cookie Hangyu Hua <hbh25y(a)gmail.com> net: 9p: fix refcount leak in p9_read_work() error handling Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Use krealloc_array() in dal_vector_reserve() Eric Dumazet <edumazet(a)google.com> net/sched: cls_u32: use skb_header_pointer_careful() Eric Dumazet <edumazet(a)google.com> net: add skb_header_pointer_careful() helper Eric Dumazet <edumazet(a)google.com> ip6_vti: set netns_immutable on the fallback device. Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Bound VBIOS record-chain walk loops Bjorn Andersson <bjorn.andersson(a)oss.qualcomm.com> slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd Jann Horn <jannh(a)google.com> fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios Pedro Tammela <pctammela(a)mojatatu.com> net/sched: act_pedit: free pedit keys on bail from offset check Rajat Gupta <rajat.gupta(a)oss.qualcomm.com> net/sched: fix pedit partial COW leading to page cache corruption Max Tottenham <mtottenh(a)akamai.com> net/sched: act_pedit: Parse L3 Header for L4 offset Pedro Tammela <pctammela(a)mojatatu.com> net/sched: act_pedit: rate limit datapath messages Pedro Tammela <pctammela(a)mojatatu.com> net/sched: act_pedit: check static offsets a priori Pedro Tammela <pctammela(a)mojatatu.com> net/sched: act_pedit: remove extra check for key type Pedro Tammela <pctammela(a)mojatatu.com> net/sched: simplify tcf_pedit_act Pedro Tammela <pctammela(a)mojatatu.com> net/sched: transition act_pedit to rcu and percpu stats Pedro Tammela <pctammela(a)mojatatu.com> net/sched: act_pedit: use NLA_POLICY for parsing 'ex' keys ------------- Diffstat: Documentation/userspace-api/ioctl/ioctl-number.rst | 427 ++++++++++----------- Makefile | 4 +- arch/mips/dec/prom/console.c | 7 +- arch/x86/kvm/svm/sev.c | 1 + crypto/af_alg.c | 2 + drivers/char/agp/amd64-agp.c | 2 +- drivers/crypto/qat/qat_common/adf_cfg_common.h | 32 -- drivers/crypto/qat/qat_common/adf_cfg_user.h | 38 -- drivers/crypto/qat/qat_common/adf_common_drv.h | 3 - drivers/crypto/qat/qat_common/adf_ctl_drv.c | 421 +------------------- drivers/crypto/qat/qat_common/adf_dev_mgr.c | 70 ---- drivers/fpga/of-fpga-region.c | 3 +- drivers/gpu/drm/amd/display/dc/basics/vector.c | 2 +- drivers/gpu/drm/amd/display/dc/bios/bios_parser.c | 15 +- drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | 12 +- .../drm/amd/display/dc/bios/bios_parser_helper.h | 5 + drivers/hv/hv_kvp.c | 25 +- drivers/hv/vmbus_drv.c | 56 ++- drivers/i2c/i2c-stub.c | 5 + drivers/infiniband/hw/bnxt_re/ib_verbs.c | 2 +- drivers/irqchip/irq-imgpdc.c | 6 + drivers/media/test-drivers/vidtv/vidtv_mux.c | 8 +- drivers/misc/fastrpc.c | 9 +- drivers/mmc/host/renesas_sdhi_internal_dmac.c | 1 + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 3 + drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c | 8 +- drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h | 1 + drivers/net/ethernet/ti/cpsw_new.c | 4 +- drivers/net/netdevsim/dev.c | 1 + drivers/net/wireless/ath/ath11k/dp.c | 1 + drivers/net/wireless/mediatek/mt76/mt76x2/usb.c | 1 + .../net/wireless/realtek/rtlwifi/rtl8821ae/trx.h | 2 +- drivers/regulator/core.c | 10 +- drivers/slimbus/qcom-ngd-ctrl.c | 11 +- drivers/tty/vt/vc_screen.c | 2 +- drivers/usb/cdns3/gadget.c | 3 + drivers/vfio/vfio_iommu_type1.c | 2 +- drivers/video/fbdev/core/fbmem.c | 12 + drivers/video/fbdev/core/modedb.c | 2 +- fs/dlm/lockspace.c | 2 +- fs/exfat/dir.c | 4 +- fs/ext4/inline.c | 8 + fs/f2fs/acl.c | 18 +- fs/fuse/dev.c | 4 + fs/fuse/file.c | 8 +- fs/nfs/pnfs.c | 2 +- fs/nfsd/nfs2acl.c | 17 +- fs/nfsd/nfs3acl.c | 17 +- fs/nfsd/nfs4recover.c | 3 +- fs/nfsd/nfs4xdr.c | 3 +- fs/ocfs2/suballoc.c | 22 ++ include/keys/request_key_auth-type.h | 2 + include/linux/ring_buffer.h | 4 +- include/linux/skbuff.h | 12 + include/net/phonet/pn_dev.h | 2 +- include/net/tc_act/tc_pedit.h | 80 +++- kernel/bpf/cgroup.c | 2 +- kernel/trace/ring_buffer.c | 74 +--- kernel/trace/trace.c | 14 +- kernel/trace/trace_kdb.c | 8 +- net/9p/trans_fd.c | 1 + net/batman-adv/bat_iv_ogm.c | 11 +- net/batman-adv/bat_v.c | 1 + net/batman-adv/bat_v_ogm.c | 23 +- net/batman-adv/bridge_loop_avoidance.c | 28 +- net/batman-adv/distributed-arp-table.c | 12 +- net/batman-adv/fragmentation.c | 22 +- net/batman-adv/fragmentation.h | 3 +- net/batman-adv/netlink.c | 10 +- net/batman-adv/routing.c | 3 +- net/batman-adv/tp_meter.c | 115 ++++-- net/batman-adv/translation-table.c | 40 +- net/batman-adv/tvlv.c | 69 +++- net/batman-adv/types.h | 21 +- net/ipv6/ip6_vti.c | 1 + net/mac802154/llsec.c | 14 + net/mptcp/protocol.c | 8 + net/phonet/pn_dev.c | 12 +- net/phonet/pn_netlink.c | 23 +- net/sched/act_pedit.c | 420 +++++++++++--------- net/sched/cls_u32.c | 13 +- net/tipc/crypto.c | 9 + security/keys/internal.h | 2 + security/keys/keyctl.c | 24 +- security/keys/keyctl_pkey.c | 9 +- security/keys/request_key_auth.c | 33 +- 86 files changed, 1206 insertions(+), 1246 deletions(-)

2 months

「ペット愛」溢れる、経営者様へ

by 日本ペットホテル協会

　　「ペット愛」溢れる、経営者様へ　　地域で愛犬を安心して預けられる　ペットホテル・トリミング事業を始めませんか。　　　■　フランチャイズシステム説明会　■ 　　　　愛犬家のオーナー多数！　　　ペットホテル・トリミングサロン “ONE LUKE” 　　　※経験や資格が無くても始められます　　■　開催方式　　　オンライン（申込後に参加方法をご案内）　　■　日程　　　7月7日（火）13:00-14:00 　　　7月10日（金）13:00-14:00　残2席　　　7月13日（月）11:00-12:00 　　　7月16日（木）13:00-14:00 　■　定員　　　5名　　■　ご視聴・詳細はこちら　　　https://oneluke-fc-seminar.jp/lp/ 　　　お世話になります。　　ペットホテル・トリミングサロンの　フラチャイズ説明会のご案内でございます。　ペットホテルとトリミングサービスを提供する　ONE LUKE（ワンルーク）　　ワンちゃんが好きすぎる創業者が　ペットホテルに預けたときに感じた　不安や思ったことを施設づくりに活かしています。　　　例えばワンちゃんが泊まるときに、少しでも　広く、心地よく過ごして欲しいという思いから　鉄のゲージではなくオーダーで職人さんに　「お部屋」を作っていただいています。　　そうした愛犬家目線のきめ細かいサービスが支持され　利用した方は高い確率でリピートしてくれます。　　　日本ではいまや「8世帯に1世帯」がペットを飼うまでに　増えてきましたが、ペットホテルはまだまだ店舗数が　足りていないため、今後も成長が期待できます。　　　ここまでこの文章を読まれたということは、　あなたもワンちゃんが大好きなのではないでしょうか。　　ワンルークのFCオーナー様も愛犬家が多く、中には　ご自身が利用者だった、という方もいらっしゃいます。　　説明会にて詳しいビジネスモデルをお伝えしますので、　新規事業を探している愛犬家の経営者様は　この機会にぜひご参加ください。　　地域のペットライフを豊かにし、愛犬が安心して　過ごせる空間を一緒につくっていきましょう。　　　■　フランチャイズシステム説明会　■ 　　　　愛犬家のオーナー多数！　　　ペットホテル・トリミングサロン　　　“ONE LUKE（ワンルーク）” 　　■　ご視聴はこちら　　　https://oneluke-fc-seminar.jp/lp/ 　 *********************************************************************** 本メールのご不要な方には大変ご迷惑をおかけいたしました。お手数お掛けしますが、メール不要のお手続きは下記URLよりお願いいたします。 <メール停止フォーム> 　https://oneluke-fc-seminar.jp/mail/ *********************************************************************** 日本ペットホテル協会株式会社愛知県名古屋市千種区内山3丁目9-23 3F TEL:052-784-8416 ***********************************************************************

2 months

[PATCH 6.12 000/204] 6.12.95-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.12.95 release. There are 204 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat, 04 Jul 2026 15:50:58 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.95-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.12.95-rc1 Hangbin Liu <liuhangbin(a)gmail.com> bonding: do not set usable_slaves for broadcast mode Eric Dumazet <edumazet(a)google.com> bonding: annotate data-races arcound churn variables Tonghao Zhang <tonghao(a)bamaicloud.com> net: bonding: update the slave array for broadcast mode John Stultz <jstultz(a)google.com> locking: rtmutex: Fix wake_q logic in task_blocks_on_rt_mutex HanQuan <eilaimemedsnaimel(a)gmail.com> net/tcp-ao: fix use-after-free of key in del_async path Giovanni Cabiddu <giovanni.cabiddu(a)intel.com> crypto: qat - remove unused character device and IOCTLs Herbert Xu <herbert(a)gondor.apana.org.au> crypto: qat - Return pointer directly in adf_ctl_alloc_resources Thorsten Blum <thorsten.blum(a)linux.dev> crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() Bagas Sanjaya <bagasdotme(a)gmail.com> Documentation: ioctl-number: Extend "Include File" column width Bagas Sanjaya <bagasdotme(a)gmail.com> Documentation: ioctl-number: Fix linuxppc-dev mailto link Georgi Djakov <georgi.djakov(a)oss.qualcomm.com> drivers/base/memory: set mem->altmap after successful device registration Stepan Ionichev <sozdayvek(a)gmail.com> serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails Hem Parekh <hemparekh1596(a)gmail.com> ksmbd: fix out-of-bounds read in smb_check_perm_dacl() Markus Elfring <elfring(a)users.sourceforge.net> NFS: Prevent resource leak in nfs_alloc_server() Michael Bommarito <michael.bommarito(a)gmail.com> NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr Jeff Layton <jlayton(a)kernel.org> nfsd: reset write verifier on deferred writeback errors Jeff Layton <jlayton(a)kernel.org> nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race Dominik Woźniak <stalion(a)gmail.com> nfsd: check get_user() return when reading princhashlen Jeff Layton <jlayton(a)kernel.org> nfsd: fix posix_acl leak on SETACL decode failure Guannan Wang <wgnbuaa(a)gmail.com> NFSD: Fix SECINFO_NO_NAME decode error cleanup Johan Hovold <johan(a)kernel.org> i2c: core: fix adapter registration race Steffen Persvold <spersvold(a)gmail.com> fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode Tuo Li <islituo(a)gmail.com> fbdev: modedb: fix a possible UAF in fb_find_mode() Ian Bridges <icb(a)fastmail.org> fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var Vivian Wang <wangruikang(a)iscas.ac.cn> riscv: kfence: Call mark_new_valid_map() for kfence_unprotect() Wentao Liang <vulab(a)iscas.ac.cn> power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() Ashutosh Desai <ashutoshdesai993(a)gmail.com> KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path Hyunwoo Kim <imv4bel(a)gmail.com> KVM: x86: hyper-v: Bound the bank index when querying sparse banks Jonas Jelonek <jelonek.jonas(a)gmail.com> MIPS: smp: report dying CPU to RCU in stop_this_cpu() Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> 9p: avoid putting oldfid in p9_client_walk() error path Zhang Cen <rollkingzzc(a)gmail.com> ocfs2: reject oversized group bitmap descriptors Yuho Choi <dbgh9129(a)gmail.com> rpmsg: char: Fix use-after-free on probe error path Wentao Liang <vulab(a)iscas.ac.cn> fpga: region: fix use-after-free in child_regions_with_firmware() Qingshuang Fu <fuqingshuang(a)kylinos.cn> irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove Wentao Liang <vulab(a)iscas.ac.cn> pNFS: Fix use-after-free in pnfs_update_layout() Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Report dying CPU to RCU in stop_this_cpu() Doruk Tan Ozturk <doruk(a)0sec.ai> tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done Michal Koutný <mkoutny(a)suse.com> blk-cgroup: fix UAF in __blkcg_rstat_flush() Fan Wu <fanwu01(a)zju.edu.cn> hdlc_ppp: sync per-proto timers before freeing hdlc state Wentao Liang <vulab(a)iscas.ac.cn> pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next() Tristan Madani <tristan(a)talencesecurity.com> gfs2: fix use-after-free in gfs2_qd_dealloc Sean Christopherson <seanjc(a)google.com> KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() Michael Bommarito <michael.bommarito(a)gmail.com> exfat: fix potential use-after-free in exfat_find_dir_entry() Maciej W. Rozycki <macro(a)orcam.me.uk> MIPS: DEC: Prevent initial console buffer from landing in XKPHYS Dawei Feng <dawei.feng(a)seu.edu.cn> bpf: use kvfree() for replaced sysctl write buffer Denis Arefev <arefev(a)swemel.ru> block: Avoid mounting the bdev pseudo-filesystem in userspace Wenjie Qi <qwjhust(a)gmail.com> f2fs: keep atomic write retry from zeroing original data Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node() Zhang Cen <rollkingzzc(a)gmail.com> f2fs: validate ACL entry sizes in f2fs_acl_from_disk() Sunmin Jeong <s_min.jeong(a)samsung.com> f2fs: fix to round down start offset of fallocate for pin file Wenjie Qi <qwjhust(a)gmail.com> f2fs: validate compress cache inode only when enabled Junjie Cao <junjie.cao(a)intel.com> wifi: iwlwifi: mvm: fix race condition in PTP removal Luka Gejak <luka.gejak(a)linux.dev> wifi: rtw88: usb: fix memory leaks on USB write failures Luka Gejak <luka.gejak(a)linux.dev> wifi: rtw88: increase TX report timeout to fix race condition Bitterblue Smith <rtl8821cerfe2(a)gmail.com> wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor Jose Ignacio Tornos Martinez <jtornosm(a)redhat.com> wifi: ath11k: fix warning when unbinding ElXreno <elxreno(a)gmail.com> wifi: mt76: mt7925: don't disable AP BSS when removing TDLS peer Zenm Chen <zenmchen(a)gmail.com> wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S Shaomin Chen <eeesssooo020(a)gmail.com> keys: Pin request_key_auth payload in instantiate paths Jarkko Sakkinen <jarkko(a)kernel.org> KEYS: fix overflow in keyctl_pkey_params_get_2() Arnd Bergmann <arnd(a)arndb.de> err.h: use __always_inline on all error pointer helpers Usama Arif <usama.arif(a)linux.dev> block: invalidate cached plug timestamp after task switch Ian Bridges <icb(a)fastmail.org> fbdev: fix use-after-free in store_modes() Koichiro Den <den(a)valinux.co.jp> NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR Ruslan Valiyev <linuxoid(a)gmail.com> apparmor: fix use-after-free in rawdata dedup loop Bryam Vargas <hexlabsecurity(a)proton.me> apparmor: mediate the implicit connect of TCP fast open sendmsg Maoyi Xie <maoyixie.tju(a)gmail.com> net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink Yiming Qian <yimingqian591(a)gmail.com> net: skmsg: preserve sg.copy across SG transforms Doruk Tan Ozturk <doruk(a)0sec.ai> mac802154: llsec: add skb_cow_data() before in-place crypto Cheng Ming Lin <chengminglin(a)mxic.com.tw> mtd: spi-nor: macronix: add support for mx66{l2, u1}g45g Cheng Ming Lin <chengminglin(a)mxic.com.tw> mtd: spi-nor: macronix: Add post_sfdp fixups for Quad Input Page Program Kuniyuki Iwashima <kuniyu(a)google.com> af_unix: Set gc_in_progress to true in unix_gc(). Sean Christopherson <seanjc(a)google.com> KVM: SEV: Unmap and unpin the GHCB as needed on vCPU free Sean Christopherson <seanjc(a)google.com> KVM: SEV: Move sev_free_vcpu() down below sev_es_unmap_ghcb() Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> ntfs3: reject direct userspace writes to reserved $LX* xattrs Wongi Lee <qw3rtyp0(a)gmail.com> ipv4: account for fraggap on the paged allocation path Eric Dumazet <edumazet(a)google.com> inet: add indirect call wrapper for getfrag() calls Paul Moore <paul(a)paul-moore.com> selinux: fix overlayfs mmap() and mprotect() access checks Paul Moore <paul(a)paul-moore.com> lsm: add backing_file LSM hooks Amir Goldstein <amir73il(a)gmail.com> fs: constify file ptr in backing_file accessor helpers Wongi Lee <qw3rtyp0(a)gmail.com> ipv6: account for fraggap on the paged allocation path Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: avoid race of cifsnotfound handler state Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: enforce 2-byte alignment Sven Eckelmann <sven(a)narfation.org> batman-adv: dat: prevent false sharing between VLANs Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: track roam count per VID Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: don't merge change entries with different VIDs Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: handle overlapping packets Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: prevent parallel modifications of last_recv Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: restrict number of unacked list entries Sven Eckelmann <sven(a)narfation.org> batman-adv: v: prevent OGM aggregation on disabled hardif Sven Eckelmann <sven(a)narfation.org> batman-adv: frag: avoid underflow of TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: frag: ensure fragment is writable before modifying TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: fix (m|b)cast csum after decrementing TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: ensure bcast is writable before modifying TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: initialize last_recv_time during init Sven Eckelmann <sven(a)narfation.org> batman-adv: prevent ELP transmission interval underflow Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: add only finished tp_vars to lists Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: fix fast recovery precondition Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: avoid window underflow Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: initialize dec_cwnd explicitly Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: initialize dup_acks explicitly Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: keep unacked list in ascending ordered Sean Christopherson <seanjc(a)google.com> KVM: SEV: Ignore Port I/O requests of length '0' Sean Christopherson <seanjc(a)google.com> KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ Sean Christopherson <seanjc(a)google.com> KVM: SEV: Ignore MMIO requests of length '0' Sasha Levin <sashal(a)kernel.org> Revert "PCI: qcom: Advertise Hotplug Slot Capability with no Command Completion support" Sean Christopherson <seanjc(a)google.com> KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level Paolo Bonzini <pbonzini(a)redhat.com> KVM: x86: Fix shadow paging use-after-free due to unexpected role Miklos Szeredi <mszeredi(a)redhat.com> virtiofs: fix UAF on submount umount Ruslan Valiyev <linuxoid(a)gmail.com> media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si Gil Portnoy <dddhkts1(a)gmail.com> ksmbd: reject non-VALID session in compound request branch Viken Dadhaniya <viken.dadhaniya(a)oss.qualcomm.com> serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero Yi Yang <yiyang13(a)huawei.com> vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write Sam Daly <sam(a)samdaly.ie> iio: adc: ti-ads1298: add bounds check to pga_settings index Sam Daly <sam(a)samdaly.ie> iio: light: veml6075: add bounds check to veml6075_it_ms index Xin Long <lucien.xin(a)gmail.com> sctp: disable BH before calling udp_tunnel_xmit_skb() Petr Machata <petrm(a)nvidia.com> net: ipv6: Make udp_tunnel6_xmit_skb() void Vasily Gorbik <gor(a)linux.ibm.com> scripts/sorttable: Fix endianness handling in build-time mcount sort Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Allow matches to functions before function entry Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Use normal sort if theres no relocs in the mcount section Steven Rostedt <rostedt(a)goodmis.org> ftrace: Check against is_kernel_text() instead of kaslr_offset() Steven Rostedt <rostedt(a)goodmis.org> ftrace: Test mcount_loc addr before calling ftrace_call_addr() Guenter Roeck <linux(a)roeck-us.net> ftrace: Do not over-allocate ftrace memory Steven Rostedt <rostedt(a)goodmis.org> ftrace: Have ftrace pages output reflect freed pages Steven Rostedt <rostedt(a)goodmis.org> ftrace: Update the mcount_loc check of skipped entries Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Zero out weak functions in mcount_loc table Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Always use an array for the mcount_loc sorting Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Have mcount rela sort use direct values Steven Rostedt <rostedt(a)goodmis.org> arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Use a structure of function pointers for elf helpers Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Get start/stop_mcount_loc from ELF file directly Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Move code from sorttable.h into sorttable.c Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Use uint64_t for mcount sorting Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Add helper functions for Elf_Sym Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Add helper functions for Elf_Shdr Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Add helper functions for Elf_Ehdr Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Convert Elf_Sym MACRO over to a union Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Replace Elf_Shdr Macro with a union Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Convert Elf_Ehdr to union Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Make compare_extable() into two functions Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Have the ORC code use the _r() functions to read Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Remove unneeded Elf_Rel Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Remove unused write functions Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Remove unused macro defines Joanne Koong <joannelkoong(a)gmail.com> fuse: re-lock request before replacing page cache folio David Howells <dhowells(a)redhat.com> rxrpc: Fix the ACK parser to extract the SACK table for parsing Santosh Kalluri <santosh.kalluri129(a)gmail.com> net: phonet: free phonet_device after RCU grace period Kuniyuki Iwashima <kuniyu(a)amazon.com> phonet: Pass net and ifindex to phonet_address_notify(). Kuniyuki Iwashima <kuniyu(a)amazon.com> phonet: Pass ifindex to fill_addr(). Davidlohr Bueso <dave(a)stgolabs.net> locking/rtmutex: Skip remove_waiter() when waiter is not enqueued Peter Zijlstra <peterz(a)infradead.org> locking/mutex: Remove wakeups from under mutex::wait_lock Ji'an Zhou <eilaimemedsnaimel(a)gmail.com> futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock Thorsten Blum <thorsten.blum(a)linux.dev> hv: utils: handle and propagate errors in kvp_register Dexuan Cui <decui(a)microsoft.com> Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs Jann Horn <jannh(a)google.com> fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() Salman Alghamdi <me(a)cipherat.com> staging: rtl8723bs: fix buffer over-read in rtw_update_protection Hangbin Liu <liuhangbin(a)gmail.com> bonding: fix NULL pointer dereference in actor_port_prio setting Xiang Mei <xmei5(a)asu.edu> net: bonding: fix use-after-free in bond_xmit_broadcast() Eric Dumazet <edumazet(a)google.com> bonding: 3ad: implement proper RCU rules for port->aggregator Hangbin Liu <liuhangbin(a)gmail.com> bonding: print churn state via netlink Hangbin Liu <liuhangbin(a)gmail.com> bonding: add support for per-port LACP actor priority Tonghao Zhang <tonghao(a)bamaicloud.com> net: bonding: add broadcast_neighbor option for 802.3ad Kevin Berry <kpberry(a)google.com> Revert "net: bonding: fix use-after-free in bond_xmit_broadcast()" Yingjie Gao <gaoyingjie(a)uniontech.com> xfs: fix error returns in CoW fork repair Christoph Hellwig <hch(a)lst.de> xfs: remove the expr argument to XFS_TEST_ERROR Thadeu Lima de Souza Cascardo <cascardo(a)igalia.com> dlm: prevent NPD when writing a positive value to event_done André Draszik <andre.draszik(a)linaro.org> regulator: core: fix locking in regulator_resolve_supply() error path Yicong Yang <yang.yicong(a)picoheart.com> ACPI: scan: Use async schedule function in acpi_scan_clear_dep_fn() Varun R Mallya <varunrmallya(a)gmail.com> selftests/bpf: Add test to ensure kprobe_multi is not sleepable Varun R Mallya <varunrmallya(a)gmail.com> bpf: Reject sleepable kprobe_multi programs at attach time Mingyu Wang <25181214217(a)stu.xidian.edu.cn> agp/amd64: Fix broken error propagation in agp_amd64_probe() Weiming Shi <bestswngs(a)gmail.com> net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() Weiming Shi <bestswngs(a)gmail.com> i2c: stub: Reject I2C block transfers with invalid length Lord Ulf Henrik Holmberg <henrik.holmberg(a)defensify.se> RDMA/bnxt_re: zero shared page before exposing to userspace Waiman Long <longman(a)redhat.com> debugobjects: Dont call fill_pool() in early boot hardirq context Helen Koike <koike(a)igalia.com> debugobjects: Do not fill_pool() if pi_blocked_on Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> debugobjects: Use LD_WAIT_CONFIG instead of LD_WAIT_SLEEP Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> debugobjects: Allow to refill the pool before SYSTEM_SCHEDULING Petr Machata <petrm(a)nvidia.com> Reapply "selftest/ptp: update ptp selftest to exercise the gettimex options" Eric Dumazet <edumazet(a)google.com> ip6_vti: set netns_immutable on the fallback device. Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> net: Drop the lock in skb_may_tx_timestamp() Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: light: bh1780: fix PM runtime leak on error path Christian Brauner <brauner(a)kernel.org> eventpoll: fix ep_remove struct eventpoll / struct file UAF Christian Brauner <brauner(a)kernel.org> eventpoll: move epi_fget() up Christian Brauner <brauner(a)kernel.org> eventpoll: rename ep_remove_safe() back to ep_remove() Christian Brauner <brauner(a)kernel.org> eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() Christian Brauner <brauner(a)kernel.org> eventpoll: kill __ep_remove() Christian Brauner <brauner(a)kernel.org> eventpoll: split __ep_remove() Christian Brauner <brauner(a)kernel.org> eventpoll: use hlist_is_singular_node() in __ep_remove() Maíra Canal <mcanal(a)igalia.com> drm/v3d: Skip CSD when it has zeroed workgroups Maíra Canal <mcanal(a)igalia.com> drm/v3d: Store the active job inside the queue's state Jani Nikula <jani.nikula(a)intel.com> drm/xe/display: fix oops in suspend/shutdown without display Gabriel Krisman Bertazi <krisman(a)suse.de> io_uring/net: Avoid msghdr on op_connect/op_bind async data Tzung-Bi Shih <tzungbi(a)kernel.org> gpio: Fix resource leaks on errors in gpiochip_add_data_with_key() Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> gpiolib: Remove redundant assignment of return variable Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> gpiolib: Extract gpiochip_choose_fwnode() for wider use Jann Horn <jannh(a)google.com> fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios Sean Wang <sean.wang(a)mediatek.com> wifi: mt76: mt7921: fix potential deadlock in mt7921_roc_abort_sync Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7921: fix a potential scan no APs Leon Yen <leon.yen(a)mediatek.com> wifi: mt76: mt7921: avoid undesired changes of the preset regulatory domain ------------- Diffstat: Documentation/networking/bonding.rst | 15 + Documentation/userspace-api/ioctl/ioctl-number.rst | 485 +++++---- Makefile | 4 +- arch/arm64/Kconfig | 1 + arch/loongarch/kernel/smp.c | 1 + arch/mips/dec/prom/console.c | 7 +- arch/mips/kernel/smp.c | 2 + arch/riscv/include/asm/kfence.h | 7 +- arch/riscv/kernel/entry.S | 6 +- arch/x86/kvm/hyperv.c | 5 + arch/x86/kvm/mmu/mmu.c | 28 +- arch/x86/kvm/svm/sev.c | 113 +- block/bdev.c | 5 - block/blk-cgroup.c | 21 +- drivers/acpi/scan.c | 41 +- drivers/base/memory.c | 3 +- drivers/char/agp/amd64-agp.c | 2 +- drivers/crypto/intel/qat/qat_common/adf_cfg.c | 10 - drivers/crypto/intel/qat/qat_common/adf_cfg.h | 1 - .../crypto/intel/qat/qat_common/adf_cfg_common.h | 32 - drivers/crypto/intel/qat/qat_common/adf_cfg_user.h | 38 - .../crypto/intel/qat/qat_common/adf_common_drv.h | 3 - drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c | 416 +------- drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c | 70 -- drivers/fpga/of-fpga-region.c | 3 +- drivers/gpio/gpiolib.c | 156 +-- drivers/gpu/drm/v3d/v3d_drv.h | 7 +- drivers/gpu/drm/v3d/v3d_gem.c | 7 +- drivers/gpu/drm/v3d/v3d_irq.c | 62 +- drivers/gpu/drm/v3d/v3d_sched.c | 42 +- drivers/gpu/drm/xe/display/xe_display.c | 11 +- drivers/hv/hv_kvp.c | 25 +- drivers/hv/vmbus_drv.c | 29 +- drivers/i2c/i2c-core-base.c | 8 +- drivers/i2c/i2c-stub.c | 5 + drivers/iio/adc/ti-ads1298.c | 7 +- drivers/iio/light/bh1780.c | 4 +- drivers/iio/light/veml6075.c | 8 +- drivers/infiniband/hw/bnxt_re/ib_verbs.c | 2 +- drivers/irqchip/irq-imgpdc.c | 6 + drivers/media/test-drivers/vidtv/vidtv_mux.c | 8 +- drivers/mtd/spi-nor/macronix.c | 31 + drivers/net/bonding/bond_3ad.c | 131 ++- drivers/net/bonding/bond_main.c | 86 +- drivers/net/bonding/bond_netlink.c | 37 +- drivers/net/bonding/bond_options.c | 71 ++ drivers/net/bonding/bond_procfs.c | 11 +- drivers/net/bonding/bond_sysfs_slave.c | 17 +- drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c | 8 +- drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h | 1 + drivers/net/wan/hdlc_ppp.c | 15 +- drivers/net/wireless/ath/ath11k/dp.c | 1 + drivers/net/wireless/intel/iwlwifi/mvm/ptp.c | 2 +- drivers/net/wireless/mediatek/mt76/mt76x2/usb.c | 1 + drivers/net/wireless/mediatek/mt76/mt7921/init.c | 7 + drivers/net/wireless/mediatek/mt76/mt7921/main.c | 14 +- drivers/net/wireless/mediatek/mt76/mt7925/main.c | 3 + .../net/wireless/realtek/rtlwifi/rtl8821ae/trx.h | 2 +- drivers/net/wireless/realtek/rtw88/tx.c | 7 +- drivers/net/wireless/realtek/rtw88/usb.c | 13 +- drivers/ntb/hw/epf/ntb_hw_epf.c | 3 +- drivers/pci/controller/dwc/pcie-qcom.c | 17 +- drivers/power/reset/linkstation-poweroff.c | 2 +- drivers/power/sequencing/core.c | 14 +- drivers/regulator/core.c | 10 +- drivers/rpmsg/rpmsg_char.c | 15 +- drivers/staging/rtl8723bs/core/rtw_mlme.c | 10 +- drivers/tty/serial/8250/8250_dw.c | 4 +- drivers/tty/serial/qcom_geni_serial.c | 9 +- drivers/tty/vt/vc_screen.c | 2 +- drivers/video/fbdev/core/fbmem.c | 12 + drivers/video/fbdev/core/fbsysfs.c | 10 +- drivers/video/fbdev/core/modedb.c | 5 +- fs/backing-file.c | 22 +- fs/dlm/lockspace.c | 2 +- fs/eventpoll.c | 142 +-- fs/exfat/dir.c | 4 +- fs/f2fs/acl.c | 18 +- fs/f2fs/data.c | 16 +- fs/f2fs/extent_cache.c | 19 +- fs/f2fs/file.c | 9 +- fs/f2fs/inode.c | 9 +- fs/fhandle.c | 16 +- fs/file_table.c | 40 +- fs/fuse/dev.c | 23 +- fs/fuse/file.c | 8 +- fs/fuse/passthrough.c | 2 +- fs/gfs2/super.c | 1 + fs/internal.h | 4 +- fs/mount.h | 10 +- fs/namespace.c | 6 +- fs/nfs/client.c | 1 + fs/nfs/pnfs.c | 2 +- fs/nfs/pnfs_nfs.c | 4 +- fs/nfsd/nfs2acl.c | 17 +- fs/nfsd/nfs3acl.c | 17 +- fs/nfsd/nfs4recover.c | 3 +- fs/nfsd/nfs4state.c | 1 + fs/nfsd/nfs4xdr.c | 3 +- fs/nfsd/vfs.c | 6 +- fs/ntfs3/xattr.c | 12 + fs/ocfs2/suballoc.c | 22 + fs/overlayfs/dir.c | 2 +- fs/overlayfs/file.c | 3 +- fs/smb/server/smb2pdu.c | 5 + fs/smb/server/smbacl.c | 4 +- fs/xfs/libxfs/xfs_ag_resv.c | 8 +- fs/xfs/libxfs/xfs_alloc.c | 5 +- fs/xfs/libxfs/xfs_attr_leaf.c | 2 +- fs/xfs/libxfs/xfs_bmap.c | 17 +- fs/xfs/libxfs/xfs_btree.c | 2 +- fs/xfs/libxfs/xfs_da_btree.c | 2 +- fs/xfs/libxfs/xfs_dir2.c | 2 +- fs/xfs/libxfs/xfs_exchmaps.c | 4 +- fs/xfs/libxfs/xfs_ialloc.c | 2 +- fs/xfs/libxfs/xfs_inode_buf.c | 4 +- fs/xfs/libxfs/xfs_inode_fork.c | 3 +- fs/xfs/libxfs/xfs_refcount.c | 5 +- fs/xfs/libxfs/xfs_rmap.c | 2 +- fs/xfs/scrub/cow_repair.c | 7 +- fs/xfs/scrub/repair.c | 2 +- fs/xfs/xfs_attr_item.c | 2 +- fs/xfs/xfs_buf.c | 4 +- fs/xfs/xfs_error.c | 5 +- fs/xfs/xfs_error.h | 10 +- fs/xfs/xfs_inode.c | 28 +- fs/xfs/xfs_iomap.c | 2 +- fs/xfs/xfs_log.c | 8 +- fs/xfs/xfs_trans_ail.c | 2 +- include/keys/request_key_auth-type.h | 2 + include/linux/backing-file.h | 4 +- include/linux/blkdev.h | 16 +- include/linux/err.h | 12 +- include/linux/fs.h | 19 +- include/linux/kvm_host.h | 7 +- include/linux/lsm_audit.h | 2 +- include/linux/lsm_hook_defs.h | 5 + include/linux/lsm_hooks.h | 1 + include/linux/security.h | 22 + include/linux/skmsg.h | 15 +- include/net/bond_3ad.h | 3 +- include/net/bond_options.h | 2 + include/net/bonding.h | 3 + include/net/phonet/pn_dev.h | 2 +- include/net/rtnetlink.h | 2 + include/net/sock.h | 2 +- include/net/udp_tunnel.h | 14 +- include/uapi/linux/if_link.h | 3 + io_uring/net.c | 36 +- io_uring/opdef.c | 4 +- kernel/bpf/cgroup.c | 2 +- kernel/futex/pi.c | 6 +- kernel/futex/requeue.c | 6 + kernel/locking/mutex.c | 16 +- kernel/locking/rtmutex.c | 51 +- kernel/locking/rtmutex_api.c | 14 +- kernel/locking/rtmutex_common.h | 3 +- kernel/locking/rwbase_rt.c | 8 +- kernel/locking/rwsem.c | 4 +- kernel/locking/spinlock_rt.c | 5 +- kernel/locking/ww_mutex.h | 30 +- kernel/sched/core.c | 12 +- kernel/trace/bpf_trace.c | 4 + kernel/trace/ftrace.c | 68 +- lib/debugobjects.c | 56 +- net/9p/client.c | 3 +- net/batman-adv/bat_iv_ogm.c | 11 +- net/batman-adv/bat_v.c | 1 + net/batman-adv/bat_v_ogm.c | 23 +- net/batman-adv/bridge_loop_avoidance.c | 28 +- net/batman-adv/distributed-arp-table.c | 12 +- net/batman-adv/fragmentation.c | 22 +- net/batman-adv/fragmentation.h | 3 +- net/batman-adv/netlink.c | 10 +- net/batman-adv/routing.c | 73 +- net/batman-adv/tp_meter.c | 115 +- net/batman-adv/translation-table.c | 12 +- net/batman-adv/tvlv.c | 69 +- net/batman-adv/types.h | 21 +- net/core/filter.c | 27 + net/core/rtnetlink.c | 8 + net/core/skbuff.c | 23 +- net/core/skmsg.c | 2 + net/ipv4/ip_gre.c | 6 + net/ipv4/ip_output.c | 20 +- net/ipv4/tcp_ao.c | 4 + net/ipv6/ip6_output.c | 22 +- net/ipv6/ip6_udp_tunnel.c | 15 +- net/ipv6/ip6_vti.c | 1 + net/mac802154/llsec.c | 14 + net/phonet/pn_dev.c | 12 +- net/phonet/pn_netlink.c | 23 +- net/rxrpc/input.c | 21 +- net/sctp/ipv6.c | 9 +- net/sctp/protocol.c | 2 + net/socket.c | 2 +- net/tipc/crypto.c | 9 + net/tipc/udp_media.c | 10 +- net/tls/tls_sw.c | 4 + net/unix/garbage.c | 2 + scripts/link-vmlinux.sh | 4 +- scripts/sorttable.c | 1119 +++++++++++++++++++- scripts/sorttable.h | 500 --------- security/apparmor/include/policy_unpack.h | 19 + security/apparmor/lsm.c | 16 +- security/apparmor/policy.c | 8 +- security/keys/internal.h | 2 + security/keys/keyctl.c | 24 +- security/keys/keyctl_pkey.c | 9 +- security/keys/request_key_auth.c | 33 +- security/security.c | 109 ++ security/selinux/hooks.c | 256 +++-- security/selinux/include/objsec.h | 11 + .../selftests/bpf/prog_tests/kprobe_multi_test.c | 35 +- .../selftests/bpf/progs/kprobe_multi_sleepable.c | 25 + tools/testing/selftests/ptp/testptp.c | 62 +- virt/kvm/eventfd.c | 12 +- 217 files changed, 3867 insertions(+), 2335 deletions(-)

2 months

[PATCH 6.18 000/108] 6.18.38-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.18.38 release. There are 108 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat, 04 Jul 2026 15:50:58 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.38-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.18.38-rc1 John Johansen <john.johansen(a)canonical.com> apparmor: advertise the tcp fast open fix is applied HanQuan <eilaimemedsnaimel(a)gmail.com> net/tcp-ao: fix use-after-free of key in del_async path Stepan Ionichev <sozdayvek(a)gmail.com> serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails Hem Parekh <hemparekh1596(a)gmail.com> ksmbd: fix out-of-bounds read in smb_check_perm_dacl() Markus Elfring <elfring(a)users.sourceforge.net> NFS: Prevent resource leak in nfs_alloc_server() Igor Raits <igor.raits(a)gmail.com> NFSv4: clear exception state on successful mkdir retry Michael Bommarito <michael.bommarito(a)gmail.com> NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr Michael Bommarito <michael.bommarito(a)gmail.com> NFSv4/flexfiles: reject zero filehandle version count Jeff Layton <jlayton(a)kernel.org> nfsd: reset write verifier on deferred writeback errors Jeff Layton <jlayton(a)kernel.org> nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race Dominik Woźniak <stalion(a)gmail.com> nfsd: check get_user() return when reading princhashlen Jeff Layton <jlayton(a)kernel.org> nfsd: fix inverted cp_ttl check in async copy reaper Jeff Layton <jlayton(a)kernel.org> nfsd: fix posix_acl leak on SETACL decode failure Guannan Wang <wgnbuaa(a)gmail.com> NFSD: Fix SECINFO_NO_NAME decode error cleanup Johan Hovold <johan(a)kernel.org> i2c: core: fix adapter registration race Steffen Persvold <spersvold(a)gmail.com> fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode Tuo Li <islituo(a)gmail.com> fbdev: modedb: fix a possible UAF in fb_find_mode() Ian Bridges <icb(a)fastmail.org> fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var Vivian Wang <wangruikang(a)iscas.ac.cn> riscv: kfence: Call mark_new_valid_map() for kfence_unprotect() Wentao Liang <vulab(a)iscas.ac.cn> power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() Ashutosh Desai <ashutoshdesai993(a)gmail.com> KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path Hyunwoo Kim <imv4bel(a)gmail.com> KVM: x86: hyper-v: Bound the bank index when querying sparse banks Jonas Jelonek <jelonek.jonas(a)gmail.com> MIPS: smp: report dying CPU to RCU in stop_this_cpu() Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> 9p: avoid putting oldfid in p9_client_walk() error path Zhang Cen <rollkingzzc(a)gmail.com> ocfs2: reject oversized group bitmap descriptors Yuho Choi <dbgh9129(a)gmail.com> rpmsg: char: Fix use-after-free on probe error path Wentao Liang <vulab(a)iscas.ac.cn> fpga: region: fix use-after-free in child_regions_with_firmware() Qingshuang Fu <fuqingshuang(a)kylinos.cn> irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove Wentao Liang <vulab(a)iscas.ac.cn> pNFS: Fix use-after-free in pnfs_update_layout() Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Report dying CPU to RCU in stop_this_cpu() Doruk Tan Ozturk <doruk(a)0sec.ai> tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done Michal Koutný <mkoutny(a)suse.com> blk-cgroup: fix UAF in __blkcg_rstat_flush() Fan Wu <fanwu01(a)zju.edu.cn> hdlc_ppp: sync per-proto timers before freeing hdlc state Wentao Liang <vulab(a)iscas.ac.cn> pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next() Tristan Madani <tristan(a)talencesecurity.com> gfs2: fix use-after-free in gfs2_qd_dealloc Sam James <sam(a)gentoo.org> crypto: nx - fix nx_crypto_ctx_exit argument Sean Christopherson <seanjc(a)google.com> KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() Sean Christopherson <seanjc(a)google.com> KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level Michael Bommarito <michael.bommarito(a)gmail.com> exfat: fix potential use-after-free in exfat_find_dir_entry() Maciej W. Rozycki <macro(a)orcam.me.uk> MIPS: DEC: Prevent initial console buffer from landing in XKPHYS Dawei Feng <dawei.feng(a)seu.edu.cn> bpf: use kvfree() for replaced sysctl write buffer Denis Arefev <arefev(a)swemel.ru> block: Avoid mounting the bdev pseudo-filesystem in userspace Wenjie Qi <qwjhust(a)gmail.com> f2fs: keep atomic write retry from zeroing original data Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node() Zhang Cen <rollkingzzc(a)gmail.com> f2fs: validate ACL entry sizes in f2fs_acl_from_disk() Sunmin Jeong <s_min.jeong(a)samsung.com> f2fs: fix to round down start offset of fallocate for pin file Wenjie Qi <qwjhust(a)gmail.com> f2fs: validate compress cache inode only when enabled Wenjie Qi <qwjhust(a)gmail.com> f2fs: validate orphan inode entry count Wenjie Qi <qwjhust(a)gmail.com> f2fs: pass correct iostat type for single node writes Junrui Luo <moonafterrain(a)outlook.com> wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers Junjie Cao <junjie.cao(a)intel.com> wifi: iwlwifi: mld: fix race condition in PTP removal Junjie Cao <junjie.cao(a)intel.com> wifi: iwlwifi: mvm: fix race condition in PTP removal Luka Gejak <luka.gejak(a)linux.dev> wifi: rtw88: usb: fix memory leaks on USB write failures Luka Gejak <luka.gejak(a)linux.dev> wifi: rtw88: increase TX report timeout to fix race condition Bitterblue Smith <rtl8821cerfe2(a)gmail.com> wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor Jose Ignacio Tornos Martinez <jtornosm(a)redhat.com> wifi: ath11k: fix warning when unbinding ElXreno <elxreno(a)gmail.com> wifi: mt76: mt7925: don't disable AP BSS when removing TDLS peer Zenm Chen <zenmchen(a)gmail.com> wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S Mike Rapoport (Microsoft) <rppt(a)kernel.org> userfaultfd: ensure mremap_userfaultfd_fail() releases mmap_changing Shaomin Chen <eeesssooo020(a)gmail.com> keys: Pin request_key_auth payload in instantiate paths Jarkko Sakkinen <jarkko(a)kernel.org> KEYS: fix overflow in keyctl_pkey_params_get_2() Konstantin Khorenko <khorenko(a)virtuozzo.com> gcov: use atomic counter updates to fix concurrent access crashes Arnd Bergmann <arnd(a)arndb.de> err.h: use __always_inline on all error pointer helpers Ard Biesheuvel <ardb(a)kernel.org> KVM: arm64: Omit tag sync on stage-2 mappings of the zero page Usama Arif <usama.arif(a)linux.dev> block: invalidate cached plug timestamp after task switch Ian Bridges <icb(a)fastmail.org> fbdev: fix use-after-free in store_modes() Koichiro Den <den(a)valinux.co.jp> NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR Ruslan Valiyev <linuxoid(a)gmail.com> apparmor: fix use-after-free in rawdata dedup loop Bryam Vargas <hexlabsecurity(a)proton.me> apparmor: mediate the implicit connect of TCP fast open sendmsg Maoyi Xie <maoyixie.tju(a)gmail.com> net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink Yiming Qian <yimingqian591(a)gmail.com> net: skmsg: preserve sg.copy across SG transforms Doruk Tan Ozturk <doruk(a)0sec.ai> mac802154: llsec: add skb_cow_data() before in-place crypto Kuniyuki Iwashima <kuniyu(a)google.com> af_unix: Set gc_in_progress to true in unix_gc(). Jiajia Liu <liujiajia(a)kylinos.cn> wifi: mt76: add wcid publish check in mt76_sta_add Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> ntfs3: reject direct userspace writes to reserved $LX* xattrs Wongi Lee <qw3rtyp0(a)gmail.com> ipv4: account for fraggap on the paged allocation path Wongi Lee <qw3rtyp0(a)gmail.com> ipv6: account for fraggap on the paged allocation path Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: avoid race of cifsnotfound handler state Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: enforce 2-byte alignment Sven Eckelmann <sven(a)narfation.org> batman-adv: dat: prevent false sharing between VLANs Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: track roam count per VID Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: don't merge change entries with different VIDs Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: handle overlapping packets Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: prevent parallel modifications of last_recv Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: restrict number of unacked list entries Sven Eckelmann <sven(a)narfation.org> batman-adv: v: prevent OGM aggregation on disabled hardif Sven Eckelmann <sven(a)narfation.org> batman-adv: frag: avoid underflow of TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: frag: ensure fragment is writable before modifying TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: fix (m|b)cast csum after decrementing TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: ensure bcast is writable before modifying TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: gw: don't deselect gateway with active hardif Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: initialize last_recv_time during init Sven Eckelmann <sven(a)narfation.org> batman-adv: prevent ELP transmission interval underflow Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: add only finished tp_vars to lists Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: fix fast recovery precondition Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: avoid window underflow Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: initialize dec_cwnd explicitly Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: initialize dup_acks explicitly Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: keep unacked list in ascending ordered NeilBrown <neil(a)brown.name> lockd: fix TEST handling when not all permissions are available. Sasha Levin <sashal(a)kernel.org> Revert "PCI: qcom: Advertise Hotplug Slot Capability with no Command Completion support" Paul Moore <paul(a)paul-moore.com> selinux: fix overlayfs mmap() and mprotect() access checks Paul Moore <paul(a)paul-moore.com> lsm: add backing_file LSM hooks Paolo Bonzini <pbonzini(a)redhat.com> KVM: x86: Fix shadow paging use-after-free due to unexpected role ------------- Diffstat: Makefile | 31 ++- arch/arm64/kvm/mmu.c | 5 + arch/loongarch/kernel/smp.c | 1 + arch/mips/dec/prom/console.c | 7 +- arch/mips/kernel/smp.c | 2 + arch/riscv/include/asm/kfence.h | 7 +- arch/riscv/kernel/entry.S | 6 +- arch/x86/kvm/hyperv.c | 5 + arch/x86/kvm/mmu/mmu.c | 28 ++- arch/x86/kvm/svm/sev.c | 1 + block/bdev.c | 5 - block/blk-cgroup.c | 21 +- drivers/crypto/nx/nx.c | 6 +- drivers/crypto/nx/nx.h | 2 +- drivers/fpga/of-fpga-region.c | 3 +- drivers/i2c/i2c-core-base.c | 8 +- drivers/irqchip/irq-imgpdc.c | 6 + drivers/net/wan/hdlc_ppp.c | 15 +- drivers/net/wireless/ath/ath11k/dp.c | 1 + drivers/net/wireless/intel/iwlwifi/mld/agg.c | 9 + drivers/net/wireless/intel/iwlwifi/mld/ptp.c | 2 +- drivers/net/wireless/intel/iwlwifi/mvm/ptp.c | 2 +- drivers/net/wireless/mediatek/mt76/mac80211.c | 15 +- drivers/net/wireless/mediatek/mt76/mt76x2/usb.c | 1 + drivers/net/wireless/mediatek/mt76/mt7925/main.c | 3 + .../net/wireless/realtek/rtlwifi/rtl8821ae/trx.h | 2 +- drivers/net/wireless/realtek/rtw88/tx.c | 7 +- drivers/net/wireless/realtek/rtw88/usb.c | 13 +- drivers/ntb/hw/epf/ntb_hw_epf.c | 3 +- drivers/pci/controller/dwc/pcie-qcom.c | 17 +- drivers/power/reset/linkstation-poweroff.c | 2 +- drivers/power/sequencing/core.c | 14 +- drivers/rpmsg/rpmsg_char.c | 15 +- drivers/tty/serial/8250/8250_dw.c | 4 +- drivers/video/fbdev/core/fbmem.c | 12 + drivers/video/fbdev/core/fbsysfs.c | 10 +- drivers/video/fbdev/core/modedb.c | 5 +- fs/backing-file.c | 17 +- fs/exfat/dir.c | 4 +- fs/f2fs/acl.c | 18 +- fs/f2fs/checkpoint.c | 14 +- fs/f2fs/data.c | 16 +- fs/f2fs/extent_cache.c | 19 +- fs/f2fs/file.c | 9 +- fs/f2fs/inode.c | 9 +- fs/f2fs/node.c | 2 +- fs/file_table.c | 27 ++- fs/fuse/passthrough.c | 2 +- fs/gfs2/super.c | 1 + fs/internal.h | 3 +- fs/lockd/svc4proc.c | 13 +- fs/lockd/svclock.c | 4 +- fs/lockd/svcproc.c | 15 +- fs/lockd/svcsubs.c | 35 ++- fs/nfs/client.c | 1 + fs/nfs/flexfilelayout/flexfilelayout.c | 4 + fs/nfs/nfs4proc.c | 5 +- fs/nfs/pnfs.c | 2 +- fs/nfs/pnfs_nfs.c | 4 +- fs/nfsd/nfs2acl.c | 17 +- fs/nfsd/nfs3acl.c | 17 +- fs/nfsd/nfs4proc.c | 2 +- fs/nfsd/nfs4recover.c | 3 +- fs/nfsd/nfs4state.c | 1 + fs/nfsd/nfs4xdr.c | 3 +- fs/nfsd/vfs.c | 6 +- fs/ntfs3/xattr.c | 12 + fs/ocfs2/suballoc.c | 22 ++ fs/overlayfs/dir.c | 2 +- fs/overlayfs/file.c | 2 +- fs/smb/server/smbacl.c | 4 +- fs/userfaultfd.c | 2 + include/keys/request_key_auth-type.h | 2 + include/linux/backing-file.h | 4 +- include/linux/blkdev.h | 16 +- include/linux/err.h | 12 +- include/linux/f2fs_fs.h | 1 + include/linux/fs.h | 13 ++ include/linux/kvm_host.h | 7 +- include/linux/lockd/lockd.h | 2 +- include/linux/lsm_audit.h | 2 +- include/linux/lsm_hook_defs.h | 5 + include/linux/lsm_hooks.h | 1 + include/linux/security.h | 22 ++ include/linux/skmsg.h | 15 +- include/net/rtnetlink.h | 2 + kernel/bpf/cgroup.c | 2 +- kernel/sched/core.c | 12 +- net/9p/client.c | 3 +- net/batman-adv/bat_iv_ogm.c | 11 +- net/batman-adv/bat_v.c | 1 + net/batman-adv/bat_v_ogm.c | 23 +- net/batman-adv/bridge_loop_avoidance.c | 28 +-- net/batman-adv/distributed-arp-table.c | 12 +- net/batman-adv/fragmentation.c | 22 +- net/batman-adv/fragmentation.h | 3 +- net/batman-adv/hard-interface.c | 28 +-- net/batman-adv/netlink.c | 10 +- net/batman-adv/routing.c | 73 +++++- net/batman-adv/tp_meter.c | 115 +++++---- net/batman-adv/translation-table.c | 12 +- net/batman-adv/tvlv.c | 69 +++++- net/batman-adv/types.h | 21 +- net/core/filter.c | 27 +++ net/core/rtnetlink.c | 8 + net/core/skmsg.c | 2 + net/ipv4/ip_gre.c | 6 + net/ipv4/ip_output.c | 7 +- net/ipv4/tcp_ao.c | 4 + net/ipv6/ip6_output.c | 9 +- net/mac802154/llsec.c | 14 ++ net/tipc/crypto.c | 9 + net/tls/tls_sw.c | 4 + net/unix/garbage.c | 2 + security/apparmor/include/policy_unpack.h | 19 ++ security/apparmor/lsm.c | 16 +- security/apparmor/net.c | 2 + security/apparmor/policy.c | 8 +- security/keys/internal.h | 2 + security/keys/keyctl.c | 24 +- security/keys/keyctl_pkey.c | 9 +- security/keys/request_key_auth.c | 33 ++- security/security.c | 109 +++++++++ security/selinux/hooks.c | 256 +++++++++++++++------ security/selinux/include/objsec.h | 11 + virt/kvm/eventfd.c | 12 +- 126 files changed, 1354 insertions(+), 401 deletions(-)

2 months

[PATCH 6.18 00/60] 6.18.37-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.18.37 release. There are 60 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat, 27 Jun 2026 12:54:50 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.37-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.18.37-rc1 Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> mm: do not copy page tables unnecessarily for VM_UFFD_WP Miklos Szeredi <mszeredi(a)redhat.com> virtiofs: fix UAF on submount umount Ruslan Valiyev <linuxoid(a)gmail.com> media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si Gil Portnoy <dddhkts1(a)gmail.com> ksmbd: reject non-VALID session in compound request branch Georgi Djakov <georgi.djakov(a)oss.qualcomm.com> drivers/base/memory: set mem->altmap after successful device registration Viken Dadhaniya <viken.dadhaniya(a)oss.qualcomm.com> serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero Yi Yang <yiyang13(a)huawei.com> vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write Giovanni Cabiddu <giovanni.cabiddu(a)intel.com> crypto: qat - remove unused character device and IOCTLs Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: rmi4 - fix bit count in bitmap_copy() Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: rmi4 - iterative IRQ handler Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: rmi4 - fix memory leak in rmi_set_attn_data() Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: rmi4 - fix num_subpackets overflow in register descriptor Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: rmi4 - fix type overflow in register counts Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: rmi4 - refactor register descriptor parsing Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: rmi4 - fix register descriptor address calculation Sam Daly <sam(a)samdaly.ie> iio: adc: ti-ads1298: add bounds check to pga_settings index Sam Daly <sam(a)samdaly.ie> iio: light: veml6075: add bounds check to veml6075_it_ms index Faicker Mo <faicker.mo(a)gmail.com> net: net_failover: Fix the deadlock in slave register Mike Marciniszyn (Meta) <mike.marciniszyn(a)gmail.com> net: export netif_open for self_test usage Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> testing/selftests/mm: add soft-dirty merge self-test Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> mm: propagate VM_SOFTDIRTY on merge Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> mm: set the VM_MAYBE_GUARD flag on guard region install Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> mm: introduce copy-on-fork VMAs and make VM_MAYBE_GUARD one Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> mm: implement sticky VMA flags Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> mm: update vma_modify_flags() to handle residual flags, document Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> mm: add atomic VMA flags and set VM_MAYBE_GUARD as such Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> mm: introduce VM_MAYBE_GUARD and make visible in /proc/$pid/smaps Xin Long <lucien.xin(a)gmail.com> sctp: disable BH before calling udp_tunnel_xmit_skb() Tudor Ambarus <tudor.ambarus(a)linaro.org> firmware: samsung: acpm: Fix cross-thread RX length corruption Dexuan Cui <decui(a)microsoft.com> Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs Thorsten Blum <thorsten.blum(a)linux.dev> hv: utils: handle and propagate errors in kvp_register André Draszik <andre.draszik(a)linaro.org> regulator: core: fix locking in regulator_resolve_supply() error path Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: don't free fd-owned sockets when reaping in the heartbeat Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: clear neighbour pointer in rose_kill_by_device() Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: cancel neighbour timers in rose_neigh_put() before freeing Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: drop CALL_REQUEST in loopback timer when device is not running Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: release netdev ref and destroy orphaned incoming sockets Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: fix netdev double-hold in rose_make_new() Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: disconnect orphaned STATE_2 sockets when device is gone Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: set SOCK_DESTROY in rose_kill_by_device() for prompt cleanup Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: fix notifier unregistered too early in rose_exit() Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: fix netdev double-hold in rose_rx_call_request() Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: guard rose_neigh_put() against NULL in timer expiry Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: clear neighbour pointer after rose_neigh_put() in state machines Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: fix race between loopback timer and module removal Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: hold loopback neighbour reference across timer callback Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: fix dev_put() leak in rose_loopback_timer() Yicong Yang <yang.yicong(a)picoheart.com> ACPI: scan: Use async schedule function in acpi_scan_clear_dep_fn() Mingyu Wang <25181214217(a)stu.xidian.edu.cn> agp/amd64: Fix broken error propagation in agp_amd64_probe() Weiming Shi <bestswngs(a)gmail.com> net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() Weiming Shi <bestswngs(a)gmail.com> i2c: stub: Reject I2C block transfers with invalid length Lord Ulf Henrik Holmberg <henrik.holmberg(a)defensify.se> RDMA/bnxt_re: zero shared page before exposing to userspace Waiman Long <longman(a)redhat.com> debugobjects: Dont call fill_pool() in early boot hardirq context Helen Koike <koike(a)igalia.com> debugobjects: Do not fill_pool() if pi_blocked_on Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> debugobjects: Use LD_WAIT_CONFIG instead of LD_WAIT_SLEEP Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> debugobjects: Allow to refill the pool before SYSTEM_SCHEDULING Yang Erkun <yangerkun(a)huawei.com> Revert "NFSD: Defer sub-object cleanup in export put callbacks" Joanne Koong <joannelkoong(a)gmail.com> fuse: re-lock request before replacing page cache folio Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> net: stmmac: fix stm32 (and potentially others) resume regression Gabriel Krisman Bertazi <krisman(a)suse.de> io_uring/net: Avoid msghdr on op_connect/op_bind async data ------------- Diffstat: Documentation/filesystems/proc.rst | 5 +- Documentation/userspace-api/ioctl/ioctl-number.rst | 1 - Makefile | 4 +- drivers/acpi/scan.c | 41 +-- drivers/base/memory.c | 3 +- drivers/char/agp/amd64-agp.c | 2 +- drivers/crypto/intel/qat/qat_common/adf_cfg.c | 10 - drivers/crypto/intel/qat/qat_common/adf_cfg.h | 1 - .../crypto/intel/qat/qat_common/adf_cfg_common.h | 32 -- drivers/crypto/intel/qat/qat_common/adf_cfg_user.h | 38 -- .../crypto/intel/qat/qat_common/adf_common_drv.h | 3 - drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c | 404 +-------------------- drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c | 70 ---- drivers/firmware/samsung/exynos-acpm.c | 14 +- drivers/hv/hv_kvp.c | 25 +- drivers/hv/vmbus_drv.c | 29 +- drivers/i2c/i2c-stub.c | 5 + drivers/iio/adc/ti-ads1298.c | 7 +- drivers/iio/light/veml6075.c | 8 +- drivers/infiniband/hw/bnxt_re/ib_verbs.c | 2 +- drivers/input/rmi4/rmi_driver.c | 171 +++++---- drivers/input/rmi4/rmi_driver.h | 4 +- drivers/input/rmi4/rmi_f12.c | 7 + drivers/media/test-drivers/vidtv/vidtv_mux.c | 8 +- drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c | 8 +- drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h | 1 + drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 3 +- drivers/net/net_failover.c | 12 +- drivers/regulator/core.c | 10 +- drivers/tty/serial/qcom_geni_serial.c | 9 +- drivers/tty/vt/vc_screen.c | 2 +- fs/fuse/dev.c | 19 +- fs/fuse/file.c | 8 +- fs/nfsd/export.c | 67 +--- fs/nfsd/export.h | 7 +- fs/nfsd/nfsctl.c | 8 +- fs/proc/task_mmu.c | 1 + fs/smb/server/smb2pdu.c | 5 + include/linux/mm.h | 104 ++++++ include/net/rose.h | 12 + include/trace/events/mmflags.h | 1 + io_uring/net.c | 36 +- io_uring/opdef.c | 4 +- lib/debugobjects.c | 58 ++- mm/khugepaged.c | 71 ++-- mm/madvise.c | 24 +- mm/memory.c | 16 +- mm/mlock.c | 2 +- mm/mprotect.c | 2 +- mm/mseal.c | 7 +- mm/vma.c | 81 +++-- mm/vma.h | 130 +++++-- net/core/dev.c | 1 + net/core/failover.c | 6 +- net/rose/af_rose.c | 49 ++- net/rose/rose_in.c | 6 + net/rose/rose_loopback.c | 61 +++- net/rose/rose_timer.c | 87 ++++- net/sctp/ipv6.c | 2 + net/sctp/protocol.c | 2 + tools/testing/selftests/mm/soft-dirty.c | 127 ++++++- tools/testing/vma/vma.c | 3 +- tools/testing/vma/vma_internal.h | 49 +++ 63 files changed, 1023 insertions(+), 972 deletions(-)

2 months

[PATCH 7.0 00/49] 7.0.14-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 7.0.14 release. There are 49 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat, 27 Jun 2026 12:54:50 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.0.14-rc1… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.0.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 7.0.14-rc1 Miklos Szeredi <mszeredi(a)redhat.com> virtiofs: fix UAF on submount umount Ruslan Valiyev <linuxoid(a)gmail.com> media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si Gil Portnoy <dddhkts1(a)gmail.com> ksmbd: reject non-VALID session in compound request branch Georgi Djakov <georgi.djakov(a)oss.qualcomm.com> drivers/base/memory: set mem->altmap after successful device registration Stepan Ionichev <sozdayvek(a)gmail.com> serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails Viken Dadhaniya <viken.dadhaniya(a)oss.qualcomm.com> serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero Yi Yang <yiyang13(a)huawei.com> vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write Giovanni Cabiddu <giovanni.cabiddu(a)intel.com> crypto: qat - remove unused character device and IOCTLs Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: rmi4 - fix bit count in bitmap_copy() Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: rmi4 - iterative IRQ handler Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: rmi4 - fix memory leak in rmi_set_attn_data() Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: rmi4 - fix num_subpackets overflow in register descriptor Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: rmi4 - fix type overflow in register counts Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: rmi4 - refactor register descriptor parsing Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: rmi4 - fix register descriptor address calculation Sam Daly <sam(a)samdaly.ie> iio: adc: ti-ads1298: add bounds check to pga_settings index Sam Daly <sam(a)samdaly.ie> iio: light: veml6075: add bounds check to veml6075_it_ms index Faicker Mo <faicker.mo(a)gmail.com> net: net_failover: Fix the deadlock in slave register Mike Marciniszyn (Meta) <mike.marciniszyn(a)gmail.com> net: export netif_open for self_test usage Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: don't free fd-owned sockets when reaping in the heartbeat Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: clear neighbour pointer in rose_kill_by_device() Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: cancel neighbour timers in rose_neigh_put() before freeing Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: drop CALL_REQUEST in loopback timer when device is not running Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: release netdev ref and destroy orphaned incoming sockets Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: fix netdev double-hold in rose_make_new() Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: disconnect orphaned STATE_2 sockets when device is gone Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: set SOCK_DESTROY in rose_kill_by_device() for prompt cleanup Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: fix notifier unregistered too early in rose_exit() Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: fix netdev double-hold in rose_rx_call_request() Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: guard rose_neigh_put() against NULL in timer expiry Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: clear neighbour pointer after rose_neigh_put() in state machines Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: fix race between loopback timer and module removal Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: hold loopback neighbour reference across timer callback Bernard Pidoux <bernard.f6bvp(a)gmail.com> rose: fix dev_put() leak in rose_loopback_timer() Mingyu Wang <25181214217(a)stu.xidian.edu.cn> agp/amd64: Fix broken error propagation in agp_amd64_probe() Weiming Shi <bestswngs(a)gmail.com> net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() Weiming Shi <bestswngs(a)gmail.com> i2c: stub: Reject I2C block transfers with invalid length Weiming Shi <bestswngs(a)gmail.com> bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths Lord Ulf Henrik Holmberg <henrik.holmberg(a)defensify.se> RDMA/bnxt_re: zero shared page before exposing to userspace Yang Erkun <yangerkun(a)huawei.com> Revert "NFSD: Defer sub-object cleanup in export put callbacks" Joanne Koong <joannelkoong(a)gmail.com> fuse: re-lock request before replacing page cache folio Tudor Ambarus <tudor.ambarus(a)linaro.org> firmware: samsung: acpm: Fix missing LKMM barriers in sequence allocator Tudor Ambarus <tudor.ambarus(a)linaro.org> firmware: samsung: acpm: Fix false timeouts and Use-After-Free in polling Tudor Ambarus <tudor.ambarus(a)linaro.org> firmware: samsung: acpm: Fix cross-thread RX length corruption Krzysztof Kozlowski <krzysztof.kozlowski(a)oss.qualcomm.com> firmware: exynos-acpm: Count acpm_xfer buffers with __counted_by_ptr Krzysztof Kozlowski <krzysztof.kozlowski(a)oss.qualcomm.com> firmware: exynos-acpm: Count number of commands in acpm_xfer NeilBrown <neil(a)brown.name> lockd: fix TEST handling when not all permissions are available. Mark Rutland <mark.rutland(a)arm.com> arm64/entry: Fix arm64-specific rseq brokenness Gabriel Krisman Bertazi <krisman(a)suse.de> io_uring/net: Avoid msghdr on op_connect/op_bind async data ------------- Diffstat: Documentation/userspace-api/ioctl/ioctl-number.rst | 1 - Makefile | 4 +- arch/arm64/kernel/entry-common.c | 29 +- drivers/base/memory.c | 3 +- drivers/char/agp/amd64-agp.c | 2 +- drivers/crypto/intel/qat/qat_common/adf_cfg.c | 10 - drivers/crypto/intel/qat/qat_common/adf_cfg.h | 1 - .../crypto/intel/qat/qat_common/adf_cfg_common.h | 32 -- drivers/crypto/intel/qat/qat_common/adf_cfg_user.h | 38 -- .../crypto/intel/qat/qat_common/adf_common_drv.h | 3 - drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c | 404 +-------------------- drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c | 70 ---- drivers/firmware/samsung/exynos-acpm-dvfs.c | 12 +- drivers/firmware/samsung/exynos-acpm-pmic.c | 14 +- drivers/firmware/samsung/exynos-acpm.c | 109 ++++-- drivers/firmware/samsung/exynos-acpm.h | 8 +- drivers/i2c/i2c-stub.c | 5 + drivers/iio/adc/ti-ads1298.c | 7 +- drivers/iio/light/veml6075.c | 8 +- drivers/infiniband/hw/bnxt_re/ib_verbs.c | 2 +- drivers/input/rmi4/rmi_driver.c | 171 +++++---- drivers/input/rmi4/rmi_driver.h | 4 +- drivers/input/rmi4/rmi_f12.c | 7 + drivers/media/test-drivers/vidtv/vidtv_mux.c | 8 +- drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c | 8 +- drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h | 1 + drivers/net/net_failover.c | 12 +- drivers/tty/serial/8250/8250_dw.c | 4 +- drivers/tty/serial/qcom_geni_serial.c | 9 +- drivers/tty/vt/vc_screen.c | 2 +- fs/fuse/dev.c | 19 +- fs/fuse/file.c | 8 +- fs/lockd/svc4proc.c | 13 +- fs/lockd/svclock.c | 4 +- fs/lockd/svcproc.c | 15 +- fs/lockd/svcsubs.c | 35 +- fs/nfsd/export.c | 67 +--- fs/nfsd/export.h | 7 +- fs/nfsd/nfsctl.c | 8 +- fs/smb/server/smb2pdu.c | 5 + include/linux/irq-entry-common.h | 8 - include/linux/lockd/lockd.h | 2 +- include/linux/rseq_entry.h | 19 - include/net/rose.h | 12 + io_uring/net.c | 36 +- io_uring/opdef.c | 4 +- net/core/bpf_sk_storage.c | 13 +- net/core/dev.c | 1 + net/core/failover.c | 6 +- net/rose/af_rose.c | 49 ++- net/rose/rose_in.c | 6 + net/rose/rose_loopback.c | 61 +++- net/rose/rose_timer.c | 87 ++++- 53 files changed, 567 insertions(+), 906 deletions(-)

2 months

MS Dynamics AX-NAV-SL-GP Users

by Maurine Lopez

Hi, I researched your organization and thought you might be interested in connecting with MS Dynamics AX-NAV-SL-GP Usersto promote your products or services? We also provide other related Technology Users like: Epicor, SAP BusinessOne, Sage ERP, Acumatica, Salesforce, Rackspace, MS SharePoint, Amazon S3, MS Azure, NetSuite, MS Office365, Workday, Red Hat JBoss, ServiceNow and many more. Do let me know if you are interested and I would be happy to share our work details and Prices. Regards, Maurine Lopez | Senior Lead Executive If you do not wish to receive messages from us, please reply "Withdraw."

2 months, 1 week

← Newer
1
...
7
8
9
10
11
12
13
...
3425
Older →

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

Lkft-triage