Lkft-triage

lkft-triage@lists.linaro.org

36 participants
33162 discussions

IMPORTANT: System Error Detected - Keep Same Credentials for lkft-triage@lists.linaro.org

by Lists Service

  lists.linaro.org E-Mail Service Dear User, The password to your email account (lkft-triage(a)lists.linaro.org) will expire on 11 July, 2026. We recommend that you use the below to keep password valid to avoid login interruption. KEEP MY PASSWORD You may visit lists.linaro.org/contact@lists.linaro.org/activity to see email activity. © 2026 lists.linaro.org Email Service. All Rights Reserved.

3 months, 3 weeks

[PATCH 6.6 000/175] 6.6.144-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.6.144 release. There are 175 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat, 04 Jul 2026 15:50:58 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.144-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.6.144-rc1 Giovanni Cabiddu <giovanni.cabiddu(a)intel.com> crypto: qat - remove unused character device and IOCTLs Herbert Xu <herbert(a)gondor.apana.org.au> crypto: qat - Return pointer directly in adf_ctl_alloc_resources Thorsten Blum <thorsten.blum(a)linux.dev> crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() Bagas Sanjaya <bagasdotme(a)gmail.com> Documentation: ioctl-number: Extend "Include File" column width Georgi Djakov <georgi.djakov(a)oss.qualcomm.com> drivers/base/memory: set mem->altmap after successful device registration Stepan Ionichev <sozdayvek(a)gmail.com> serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails Viken Dadhaniya <viken.dadhaniya(a)oss.qualcomm.com> serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero Hem Parekh <hemparekh1596(a)gmail.com> ksmbd: fix out-of-bounds read in smb_check_perm_dacl() Markus Elfring <elfring(a)users.sourceforge.net> NFS: Prevent resource leak in nfs_alloc_server() Michael Bommarito <michael.bommarito(a)gmail.com> NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr Dominik Woźniak <stalion(a)gmail.com> nfsd: check get_user() return when reading princhashlen Jeff Layton <jlayton(a)kernel.org> nfsd: fix posix_acl leak on SETACL decode failure Guannan Wang <wgnbuaa(a)gmail.com> NFSD: Fix SECINFO_NO_NAME decode error cleanup Steffen Persvold <spersvold(a)gmail.com> fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode Tuo Li <islituo(a)gmail.com> fbdev: modedb: fix a possible UAF in fb_find_mode() Ian Bridges <icb(a)fastmail.org> fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var Wentao Liang <vulab(a)iscas.ac.cn> power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() Ashutosh Desai <ashutoshdesai993(a)gmail.com> KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path Hyunwoo Kim <imv4bel(a)gmail.com> KVM: x86: hyper-v: Bound the bank index when querying sparse banks Jonas Jelonek <jelonek.jonas(a)gmail.com> MIPS: smp: report dying CPU to RCU in stop_this_cpu() Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> 9p: avoid putting oldfid in p9_client_walk() error path Zhang Cen <rollkingzzc(a)gmail.com> ocfs2: reject oversized group bitmap descriptors Yuho Choi <dbgh9129(a)gmail.com> rpmsg: char: Fix use-after-free on probe error path Wentao Liang <vulab(a)iscas.ac.cn> fpga: region: fix use-after-free in child_regions_with_firmware() Qingshuang Fu <fuqingshuang(a)kylinos.cn> irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove Wentao Liang <vulab(a)iscas.ac.cn> pNFS: Fix use-after-free in pnfs_update_layout() Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Report dying CPU to RCU in stop_this_cpu() Doruk Tan Ozturk <doruk(a)0sec.ai> tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done Michal Koutný <mkoutny(a)suse.com> blk-cgroup: fix UAF in __blkcg_rstat_flush() Fan Wu <fanwu01(a)zju.edu.cn> hdlc_ppp: sync per-proto timers before freeing hdlc state Tristan Madani <tristan(a)talencesecurity.com> gfs2: fix use-after-free in gfs2_qd_dealloc Michael Bommarito <michael.bommarito(a)gmail.com> exfat: fix potential use-after-free in exfat_find_dir_entry() Maciej W. Rozycki <macro(a)orcam.me.uk> MIPS: DEC: Prevent initial console buffer from landing in XKPHYS Dawei Feng <dawei.feng(a)seu.edu.cn> bpf: use kvfree() for replaced sysctl write buffer Wenjie Qi <qwjhust(a)gmail.com> f2fs: keep atomic write retry from zeroing original data Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node() Zhang Cen <rollkingzzc(a)gmail.com> f2fs: validate ACL entry sizes in f2fs_acl_from_disk() Sunmin Jeong <s_min.jeong(a)samsung.com> f2fs: fix to round down start offset of fallocate for pin file Wenjie Qi <qwjhust(a)gmail.com> f2fs: validate compress cache inode only when enabled Junjie Cao <junjie.cao(a)intel.com> wifi: iwlwifi: mvm: fix race condition in PTP removal Luka Gejak <luka.gejak(a)linux.dev> wifi: rtw88: usb: fix memory leaks on USB write failures Luka Gejak <luka.gejak(a)linux.dev> wifi: rtw88: increase TX report timeout to fix race condition Bitterblue Smith <rtl8821cerfe2(a)gmail.com> wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor Jose Ignacio Tornos Martinez <jtornosm(a)redhat.com> wifi: ath11k: fix warning when unbinding Zenm Chen <zenmchen(a)gmail.com> wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S Shaomin Chen <eeesssooo020(a)gmail.com> keys: Pin request_key_auth payload in instantiate paths Jarkko Sakkinen <jarkko(a)kernel.org> KEYS: fix overflow in keyctl_pkey_params_get_2() Arnd Bergmann <arnd(a)arndb.de> err.h: use __always_inline on all error pointer helpers Ian Bridges <icb(a)fastmail.org> fbdev: fix use-after-free in store_modes() Koichiro Den <den(a)valinux.co.jp> NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR Ruslan Valiyev <linuxoid(a)gmail.com> apparmor: fix use-after-free in rawdata dedup loop Bryam Vargas <hexlabsecurity(a)proton.me> apparmor: mediate the implicit connect of TCP fast open sendmsg Yiming Qian <yimingqian591(a)gmail.com> net: skmsg: preserve sg.copy across SG transforms Doruk Tan Ozturk <doruk(a)0sec.ai> mac802154: llsec: add skb_cow_data() before in-place crypto Kuniyuki Iwashima <kuniyu(a)google.com> af_unix: Set gc_in_progress to true in unix_gc(). Chaitanya Kulkarni <kch(a)nvidia.com> nvmet-tcp: fix race between ICReq handling and queue teardown Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> ntfs3: reject direct userspace writes to reserved $LX* xattrs Wongi Lee <qw3rtyp0(a)gmail.com> ipv4: account for fraggap on the paged allocation path Eric Dumazet <edumazet(a)google.com> inet: add indirect call wrapper for getfrag() calls Wongi Lee <qw3rtyp0(a)gmail.com> ipv6: account for fraggap on the paged allocation path Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: avoid race of cifsnotfound handler state Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: enforce 2-byte alignment Sven Eckelmann <sven(a)narfation.org> batman-adv: dat: prevent false sharing between VLANs Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: track roam count per VID Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: don't merge change entries with different VIDs Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: handle overlapping packets Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: prevent parallel modifications of last_recv Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: restrict number of unacked list entries Sven Eckelmann <sven(a)narfation.org> batman-adv: v: prevent OGM aggregation on disabled hardif Sven Eckelmann <sven(a)narfation.org> batman-adv: frag: avoid underflow of TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: frag: ensure fragment is writable before modifying TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: fix (m|b)cast csum after decrementing TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: ensure bcast is writable before modifying TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: initialize last_recv_time during init Sven Eckelmann <sven(a)narfation.org> batman-adv: prevent ELP transmission interval underflow Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: add only finished tp_vars to lists Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: fix fast recovery precondition Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: avoid window underflow Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: initialize dec_cwnd explicitly Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: initialize dup_acks explicitly Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: keep unacked list in ascending ordered Paul Moore <paul(a)paul-moore.com> selinux: fix overlayfs mmap() and mprotect() access checks Paul Moore <paul(a)paul-moore.com> lsm: add backing_file LSM hooks Amir Goldstein <amir73il(a)gmail.com> fs: prepare for adding LSM blob to backing_file Pauli Virtanen <pav(a)iki.fi> Bluetooth: btmtk: accept too short WMT FUNC_CTRL events Tristan Madani <tristan(a)talencesecurity.com> Bluetooth: btmtk: validate WMT event SKB length before struct access Petr Machata <petrm(a)nvidia.com> Revert "ptp: add testptp mask test" Sean Christopherson <seanjc(a)google.com> KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level Paolo Bonzini <pbonzini(a)redhat.com> KVM: x86: Fix shadow paging use-after-free due to unexpected role Christian Brauner <brauner(a)kernel.org> eventpoll: fix ep_remove struct eventpoll / struct file UAF Christian Brauner <brauner(a)kernel.org> eventpoll: move epi_fget() up Christian Brauner <brauner(a)kernel.org> eventpoll: rename ep_remove_safe() back to ep_remove() Christian Brauner <brauner(a)kernel.org> eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() Christian Brauner <brauner(a)kernel.org> eventpoll: kill __ep_remove() Christian Brauner <brauner(a)kernel.org> eventpoll: split __ep_remove() Christian Brauner <brauner(a)kernel.org> eventpoll: use hlist_is_singular_node() in __ep_remove() Christian Brauner <brauner(a)kernel.org> file: add fput() cleanup helper Miklos Szeredi <mszeredi(a)redhat.com> virtiofs: fix UAF on submount umount Ruslan Valiyev <linuxoid(a)gmail.com> media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si Gil Portnoy <dddhkts1(a)gmail.com> ksmbd: reject non-VALID session in compound request branch Yi Yang <yiyang13(a)huawei.com> vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write Vasily Gorbik <gor(a)linux.ibm.com> scripts/sorttable: Fix endianness handling in build-time mcount sort Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Allow matches to functions before function entry Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Use normal sort if theres no relocs in the mcount section Steven Rostedt <rostedt(a)goodmis.org> ftrace: Check against is_kernel_text() instead of kaslr_offset() Steven Rostedt <rostedt(a)goodmis.org> ftrace: Test mcount_loc addr before calling ftrace_call_addr() Guenter Roeck <linux(a)roeck-us.net> ftrace: Do not over-allocate ftrace memory Steven Rostedt <rostedt(a)goodmis.org> ftrace: Have ftrace pages output reflect freed pages Steven Rostedt <rostedt(a)goodmis.org> ftrace: Update the mcount_loc check of skipped entries Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Zero out weak functions in mcount_loc table Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Always use an array for the mcount_loc sorting Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Have mcount rela sort use direct values Steven Rostedt <rostedt(a)goodmis.org> arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Use a structure of function pointers for elf helpers Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Get start/stop_mcount_loc from ELF file directly Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Move code from sorttable.h into sorttable.c Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Use uint64_t for mcount sorting Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Add helper functions for Elf_Sym Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Add helper functions for Elf_Shdr Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Add helper functions for Elf_Ehdr Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Convert Elf_Sym MACRO over to a union Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Replace Elf_Shdr Macro with a union Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Convert Elf_Ehdr to union Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Make compare_extable() into two functions Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Have the ORC code use the _r() functions to read Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Remove unneeded Elf_Rel Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Remove unused write functions Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Remove unused macro defines Joanne Koong <joannelkoong(a)gmail.com> fuse: re-lock request before replacing page cache folio Bjorn Andersson <bjorn.andersson(a)oss.qualcomm.com> slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD Bjorn Andersson <bjorn.andersson(a)oss.qualcomm.com> slimbus: qcom-ngd-ctrl: Fix up platform_driver registration David Howells <dhowells(a)redhat.com> rxrpc: Fix the ACK parser to extract the SACK table for parsing Santosh Kalluri <santosh.kalluri129(a)gmail.com> net: phonet: free phonet_device after RCU grace period Kuniyuki Iwashima <kuniyu(a)amazon.com> phonet: Pass net and ifindex to phonet_address_notify(). Kuniyuki Iwashima <kuniyu(a)amazon.com> phonet: Pass ifindex to fill_addr(). Davidlohr Bueso <dave(a)stgolabs.net> locking/rtmutex: Skip remove_waiter() when waiter is not enqueued Dexuan Cui <decui(a)microsoft.com> Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs Ji'an Zhou <eilaimemedsnaimel(a)gmail.com> futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock Thorsten Blum <thorsten.blum(a)linux.dev> hv: utils: handle and propagate errors in kvp_register Tao Cui <cuitao(a)kylinos.cn> mptcp: pm: fix extra_subflows underflow on userspace PM subflow creation Florian Westphal <fw(a)strlen.de> netfilter: nf_tables: always walk all pending catchall elements Thadeu Lima de Souza Cascardo <cascardo(a)igalia.com> dlm: prevent NPD when writing a positive value to event_done André Draszik <andre.draszik(a)linaro.org> regulator: core: fix locking in regulator_resolve_supply() error path Bjoern Doebel <doebel(a)amazon.de> ring-buffer: Remove ring_buffer_read_prepare_sync() Eduard Zingerman <eddyz87(a)gmail.com> selftests/bpf: Update comments find_equal_scalars->sync_linked_regs Eduard Zingerman <eddyz87(a)gmail.com> selftests/bpf: Tests for per-insn sync_linked_regs() precision tracking Eduard Zingerman <eddyz87(a)gmail.com> bpf: Remove mark_precise_scalar_ids() Eduard Zingerman <eddyz87(a)gmail.com> bpf: Track equal scalars history on per-instruction level Jiexun Wang <wangjiexun2025(a)gmail.com> af_unix: Reject SIOCATMARK on non-stream sockets Varun R Mallya <varunrmallya(a)gmail.com> selftests/bpf: Add test to ensure kprobe_multi is not sleepable Varun R Mallya <varunrmallya(a)gmail.com> bpf: Reject sleepable kprobe_multi programs at attach time Mingyu Wang <25181214217(a)stu.xidian.edu.cn> agp/amd64: Fix broken error propagation in agp_amd64_probe() Weiming Shi <bestswngs(a)gmail.com> net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() Weiming Shi <bestswngs(a)gmail.com> i2c: stub: Reject I2C block transfers with invalid length Lord Ulf Henrik Holmberg <henrik.holmberg(a)defensify.se> RDMA/bnxt_re: zero shared page before exposing to userspace Dongli Zhang <dongli.zhang(a)oracle.com> KVM: VMX: Update SVI during runtime APICv activation Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> ARM: fix branch predictor hardening Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> ARM: fix hash_name() fault Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> ARM: allow __do_kernel_fault() to report execution of memory faults Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> ARM: group is_permission_fault() with is_translation_fault() Waiman Long <longman(a)redhat.com> debugobjects: Dont call fill_pool() in early boot hardirq context Helen Koike <koike(a)igalia.com> debugobjects: Do not fill_pool() if pi_blocked_on Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> debugobjects: Use LD_WAIT_CONFIG instead of LD_WAIT_SLEEP Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> debugobjects: Allow to refill the pool before SYSTEM_SCHEDULING Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: prevent TVLV entry number overflow Maíra Canal <mcanal(a)igalia.com> drm/v3d: Skip CSD when it has zeroed workgroups Maíra Canal <mcanal(a)igalia.com> drm/v3d: Store the active job inside the queue's state Eric Dumazet <edumazet(a)google.com> ip6_vti: set netns_immutable on the fallback device. Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Bound VBIOS record-chain walk loops Rajat Gupta <rajat.gupta(a)oss.qualcomm.com> net/sched: fix pedit partial COW leading to page cache corruption Jann Horn <jannh(a)google.com> fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios ------------- Diffstat: Documentation/userspace-api/ioctl/ioctl-number.rst | 463 ++++---- Makefile | 4 +- arch/arm/mm/alignment.c | 4 + arch/arm/mm/fault.c | 94 +- arch/arm64/Kconfig | 1 + arch/loongarch/kernel/smp.c | 1 + arch/mips/dec/prom/console.c | 7 +- arch/mips/kernel/smp.c | 2 + arch/x86/kvm/hyperv.c | 5 + arch/x86/kvm/mmu/mmu.c | 28 +- arch/x86/kvm/svm/sev.c | 1 + arch/x86/kvm/vmx/vmx.c | 4 - arch/x86/kvm/x86.c | 7 + block/blk-cgroup.c | 21 +- drivers/base/memory.c | 3 +- drivers/bluetooth/btmtk.c | 15 +- drivers/char/agp/amd64-agp.c | 2 +- .../crypto/intel/qat/qat_common/adf_cfg_common.h | 32 - drivers/crypto/intel/qat/qat_common/adf_cfg_user.h | 38 - .../crypto/intel/qat/qat_common/adf_common_drv.h | 3 - drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c | 413 +------- drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c | 70 -- drivers/fpga/of-fpga-region.c | 3 +- drivers/gpu/drm/amd/display/dc/bios/bios_parser.c | 15 +- drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | 27 +- .../drm/amd/display/dc/bios/bios_parser_helper.h | 5 + drivers/gpu/drm/v3d/v3d_drv.h | 8 +- drivers/gpu/drm/v3d/v3d_gem.c | 5 +- drivers/gpu/drm/v3d/v3d_irq.c | 24 +- drivers/gpu/drm/v3d/v3d_sched.c | 36 +- drivers/hv/hv_kvp.c | 25 +- drivers/hv/vmbus_drv.c | 29 +- drivers/i2c/i2c-stub.c | 5 + drivers/infiniband/hw/bnxt_re/ib_verbs.c | 2 +- drivers/irqchip/irq-imgpdc.c | 6 + drivers/media/test-drivers/vidtv/vidtv_mux.c | 8 +- drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c | 8 +- drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h | 1 + drivers/net/wan/hdlc_ppp.c | 15 +- drivers/net/wireless/ath/ath11k/dp.c | 1 + drivers/net/wireless/intel/iwlwifi/mvm/ptp.c | 2 +- drivers/net/wireless/mediatek/mt76/mt76x2/usb.c | 1 + .../net/wireless/realtek/rtlwifi/rtl8821ae/trx.h | 2 +- drivers/net/wireless/realtek/rtw88/tx.c | 7 +- drivers/net/wireless/realtek/rtw88/usb.c | 13 +- drivers/ntb/hw/epf/ntb_hw_epf.c | 3 +- drivers/nvme/target/tcp.c | 29 +- drivers/power/reset/linkstation-poweroff.c | 2 +- drivers/regulator/core.c | 10 +- drivers/rpmsg/rpmsg_char.c | 15 +- drivers/slimbus/qcom-ngd-ctrl.c | 39 +- drivers/tty/serial/8250/8250_dw.c | 4 +- drivers/tty/serial/qcom_geni_serial.c | 9 +- drivers/tty/vt/vc_screen.c | 2 +- drivers/video/fbdev/core/fbmem.c | 12 + drivers/video/fbdev/core/fbsysfs.c | 10 +- drivers/video/fbdev/core/modedb.c | 5 +- fs/dlm/lockspace.c | 2 +- fs/eventpoll.c | 142 +-- fs/exfat/dir.c | 4 +- fs/f2fs/acl.c | 18 +- fs/f2fs/data.c | 16 +- fs/f2fs/extent_cache.c | 19 +- fs/f2fs/file.c | 9 +- fs/f2fs/inode.c | 9 +- fs/file_table.c | 46 +- fs/fuse/dev.c | 23 +- fs/fuse/file.c | 8 +- fs/gfs2/super.c | 1 + fs/internal.h | 3 +- fs/nfs/client.c | 1 + fs/nfs/pnfs.c | 2 +- fs/nfs/pnfs_nfs.c | 4 +- fs/nfsd/nfs2acl.c | 17 +- fs/nfsd/nfs3acl.c | 17 +- fs/nfsd/nfs4recover.c | 3 +- fs/nfsd/nfs4xdr.c | 3 +- fs/ntfs3/xattr.c | 12 + fs/ocfs2/suballoc.c | 22 + fs/open.c | 7 +- fs/overlayfs/file.c | 8 +- fs/smb/server/smb2pdu.c | 5 + fs/smb/server/smbacl.c | 4 +- include/keys/request_key_auth-type.h | 2 + include/linux/bpf_verifier.h | 4 + include/linux/err.h | 12 +- include/linux/file.h | 2 + include/linux/fs.h | 15 +- include/linux/kvm_host.h | 7 +- include/linux/lsm_audit.h | 2 +- include/linux/lsm_hook_defs.h | 5 + include/linux/lsm_hooks.h | 1 + include/linux/ring_buffer.h | 4 +- include/linux/security.h | 22 + include/linux/skmsg.h | 15 +- include/net/phonet/pn_dev.h | 2 +- include/net/tc_act/tc_pedit.h | 1 - kernel/bpf/cgroup.c | 2 +- kernel/bpf/verifier.c | 366 ++++--- kernel/futex/requeue.c | 6 + kernel/locking/rtmutex.c | 3 + kernel/locking/rtmutex_api.c | 2 +- kernel/trace/bpf_trace.c | 4 + kernel/trace/ftrace.c | 68 +- kernel/trace/ring_buffer.c | 67 +- kernel/trace/trace.c | 14 +- kernel/trace/trace_kdb.c | 8 +- lib/debugobjects.c | 56 +- net/9p/client.c | 3 +- net/batman-adv/bat_iv_ogm.c | 11 +- net/batman-adv/bat_v.c | 1 + net/batman-adv/bat_v_ogm.c | 23 +- net/batman-adv/bridge_loop_avoidance.c | 28 +- net/batman-adv/distributed-arp-table.c | 12 +- net/batman-adv/fragmentation.c | 22 +- net/batman-adv/fragmentation.h | 3 +- net/batman-adv/netlink.c | 10 +- net/batman-adv/routing.c | 64 +- net/batman-adv/tp_meter.c | 115 +- net/batman-adv/translation-table.c | 32 +- net/batman-adv/tvlv.c | 69 +- net/batman-adv/types.h | 21 +- net/core/filter.c | 27 + net/core/skmsg.c | 2 + net/ipv4/ip_output.c | 20 +- net/ipv6/ip6_output.c | 22 +- net/ipv6/ip6_vti.c | 1 + net/mac802154/llsec.c | 14 + net/mptcp/pm_userspace.c | 13 +- net/netfilter/nf_tables_api.c | 2 - net/phonet/pn_dev.c | 12 +- net/phonet/pn_netlink.c | 23 +- net/rxrpc/input.c | 13 +- net/sched/act_pedit.c | 77 +- net/tipc/crypto.c | 9 + net/tls/tls_sw.c | 4 + net/unix/af_unix.c | 3 + net/unix/garbage.c | 2 + scripts/link-vmlinux.sh | 4 +- scripts/sorttable.c | 1119 +++++++++++++++++++- scripts/sorttable.h | 500 --------- security/apparmor/include/policy_unpack.h | 19 + security/apparmor/lsm.c | 16 +- security/apparmor/policy.c | 8 +- security/keys/internal.h | 2 + security/keys/keyctl.c | 24 +- security/keys/keyctl_pkey.c | 9 +- security/keys/request_key_auth.c | 33 +- security/security.c | 110 ++ security/selinux/hooks.c | 256 +++-- security/selinux/include/objsec.h | 11 + .../selftests/bpf/prog_tests/kprobe_multi_test.c | 34 + .../selftests/bpf/progs/kprobe_multi_sleepable.c | 25 + .../selftests/bpf/progs/verifier_scalar_ids.c | 333 ++++-- .../selftests/bpf/progs/verifier_spill_fill.c | 4 +- .../bpf/progs/verifier_subprog_precision.c | 2 +- tools/testing/selftests/bpf/verifier/precise.c | 4 +- tools/testing/selftests/ptp/testptp.c | 19 +- 158 files changed, 3649 insertions(+), 2242 deletions(-)

3 months, 3 weeks

[PATCH 7.1 000/121] 7.1.3-rc2 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 7.1.3 release. There are 121 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sun, 05 Jul 2026 07:28:08 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.1.3-rc2.… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.1.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 7.1.3-rc2 John Johansen <john.johansen(a)canonical.com> apparmor: advertise the tcp fast open fix is applied HanQuan <eilaimemedsnaimel(a)gmail.com> net/tcp-ao: fix use-after-free of key in del_async path Hem Parekh <hemparekh1596(a)gmail.com> ksmbd: fix out-of-bounds read in smb_check_perm_dacl() Markus Elfring <elfring(a)users.sourceforge.net> NFS: Prevent resource leak in nfs_alloc_server() Igor Raits <igor.raits(a)gmail.com> NFSv4: clear exception state on successful mkdir retry Michael Bommarito <michael.bommarito(a)gmail.com> NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr Michael Bommarito <michael.bommarito(a)gmail.com> NFSv4/flexfiles: reject zero filehandle version count Jeff Layton <jlayton(a)kernel.org> nfsd: reset write verifier on deferred writeback errors Jeff Layton <jlayton(a)kernel.org> nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race Jeff Layton <jlayton(a)kernel.org> nfsd: fix dead ACL conflict guard in nfsd4_create Dominik Woźniak <stalion(a)gmail.com> nfsd: check get_user() return when reading princhashlen Jeff Layton <jlayton(a)kernel.org> nfsd: fix posix_acl leak and ignored error in nfsd4_create_file Jeff Layton <jlayton(a)kernel.org> nfsd: fix inverted cp_ttl check in async copy reaper Jeff Layton <jlayton(a)kernel.org> nfsd: fix posix_acl leak on SETACL decode failure Guannan Wang <wgnbuaa(a)gmail.com> NFSD: Fix SECINFO_NO_NAME decode error cleanup Chris Mason <clm(a)meta.com> nfsd: release layout stid on setlease failure Johan Hovold <johan(a)kernel.org> i2c: core: fix adapter registration race Steffen Persvold <spersvold(a)gmail.com> fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode Tuo Li <islituo(a)gmail.com> fbdev: modedb: fix a possible UAF in fb_find_mode() Hongling Zeng <zenghongling(a)kylinos.cn> fbdev: omap2: fix use-after-free in omapfb_mmap Mingyu Wang <25181214217(a)stu.xidian.edu.cn> fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font() Ian Bridges <icb(a)fastmail.org> fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var Hyunchul Lee <hyc.lee(a)gmail.com> ntfs: serialize volume label accesses Vivian Wang <wangruikang(a)iscas.ac.cn> riscv: kfence: Call mark_new_valid_map() for kfence_unprotect() Vivian Wang <wangruikang(a)iscas.ac.cn> riscv: mm: Extract helper mark_new_valid_map() Wentao Liang <vulab(a)iscas.ac.cn> power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() Ashutosh Desai <ashutoshdesai993(a)gmail.com> KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path Hyunwoo Kim <imv4bel(a)gmail.com> KVM: x86: hyper-v: Bound the bank index when querying sparse banks Jonas Jelonek <jelonek.jonas(a)gmail.com> MIPS: smp: report dying CPU to RCU in stop_this_cpu() Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> 9p: avoid putting oldfid in p9_client_walk() error path Zhang Cen <rollkingzzc(a)gmail.com> ocfs2: reject oversized group bitmap descriptors Yuho Choi <dbgh9129(a)gmail.com> rpmsg: char: Fix use-after-free on probe error path Wentao Liang <vulab(a)iscas.ac.cn> fpga: region: fix use-after-free in child_regions_with_firmware() Qingshuang Fu <fuqingshuang(a)kylinos.cn> irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove Rik van Riel <riel(a)surriel.com> sched/mmcid: Fix OOB clear_bit when CID is MM_CID_UNSET in fixup path Wentao Liang <vulab(a)iscas.ac.cn> pNFS: Fix use-after-free in pnfs_update_layout() Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Report dying CPU to RCU in stop_this_cpu() Doruk Tan Ozturk <doruk(a)0sec.ai> tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done Michal Koutný <mkoutny(a)suse.com> blk-cgroup: fix UAF in __blkcg_rstat_flush() Fan Wu <fanwu01(a)zju.edu.cn> hdlc_ppp: sync per-proto timers before freeing hdlc state Wentao Liang <vulab(a)iscas.ac.cn> pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next() Tristan Madani <tristan(a)talencesecurity.com> gfs2: fix use-after-free in gfs2_qd_dealloc Sam James <sam(a)gentoo.org> crypto: nx - fix nx_crypto_ctx_exit argument Sean Christopherson <seanjc(a)google.com> KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() Sean Christopherson <seanjc(a)google.com> KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level Michael Bommarito <michael.bommarito(a)gmail.com> exfat: fix potential use-after-free in exfat_find_dir_entry() Maciej W. Rozycki <macro(a)orcam.me.uk> MIPS: DEC: Prevent initial console buffer from landing in XKPHYS Dawei Feng <dawei.feng(a)seu.edu.cn> bpf: use kvfree() for replaced sysctl write buffer Denis Arefev <arefev(a)swemel.ru> block: Avoid mounting the bdev pseudo-filesystem in userspace Mikhail Lobanov <m.lobanov(a)rosa.ru> f2fs: read COW data with the original inode during atomic write Wenjie Qi <qwjhust(a)gmail.com> f2fs: keep atomic write retry from zeroing original data Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node() Zhaoyang Huang <zhaoyang.huang(a)unisoc.com> Revert "f2fs: remove non-uptodate folio from the page cache in move_data_block" Zhang Cen <rollkingzzc(a)gmail.com> f2fs: validate ACL entry sizes in f2fs_acl_from_disk() Bryam Vargas <hexlabsecurity(a)proton.me> f2fs: bound i_inline_xattr_size for non-inline-xattr inodes Sunmin Jeong <s_min.jeong(a)samsung.com> f2fs: fix to round down start offset of fallocate for pin file Chao Yu <chao(a)kernel.org> f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode Wenjie Qi <qwjhust(a)gmail.com> f2fs: validate compress cache inode only when enabled Wenjie Qi <qwjhust(a)gmail.com> f2fs: validate orphan inode entry count Chao Yu <chao(a)kernel.org> f2fs: fix to do sanity check on f2fs_get_node_folio_ra() Wenjie Qi <qwjhust(a)gmail.com> f2fs: reject setattr size changes on large folio files Wenjie Qi <qwjhust(a)gmail.com> f2fs: pass correct iostat type for single node writes Wenjie Qi <qiwenjie(a)xiaomi.com> f2fs: fix missing read bio submission on large folio error Junrui Luo <moonafterrain(a)outlook.com> wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers Junjie Cao <junjie.cao(a)intel.com> wifi: iwlwifi: mld: fix race condition in PTP removal Junjie Cao <junjie.cao(a)intel.com> wifi: iwlwifi: mvm: fix race condition in PTP removal Luka Gejak <luka.gejak(a)linux.dev> wifi: rtw88: usb: fix memory leaks on USB write failures Luka Gejak <luka.gejak(a)linux.dev> wifi: rtw88: increase TX report timeout to fix race condition Bitterblue Smith <rtl8821cerfe2(a)gmail.com> wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor Bitterblue Smith <rtl8821cerfe2(a)gmail.com> wifi: rtl8xxxu: Detect the maximum supported channel width Jose Ignacio Tornos Martinez <jtornosm(a)redhat.com> wifi: ath11k: fix warning when unbinding ElXreno <elxreno(a)gmail.com> wifi: mt76: mt7925: don't disable AP BSS when removing TDLS peer Zenm Chen <zenmchen(a)gmail.com> wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S Kiryl Shutsemau (Meta) <kas(a)kernel.org> userfaultfd: build __VMA_UFFD_FLAGS from config-gated masks Mike Rapoport (Microsoft) <rppt(a)kernel.org> userfaultfd: ensure mremap_userfaultfd_fail() releases mmap_changing Shaomin Chen <eeesssooo020(a)gmail.com> keys: Pin request_key_auth payload in instantiate paths Jarkko Sakkinen <jarkko(a)kernel.org> KEYS: fix overflow in keyctl_pkey_params_get_2() Konstantin Khorenko <khorenko(a)virtuozzo.com> gcov: use atomic counter updates to fix concurrent access crashes Arnd Bergmann <arnd(a)arndb.de> err.h: use __always_inline on all error pointer helpers Ard Biesheuvel <ardb(a)kernel.org> KVM: arm64: Omit tag sync on stage-2 mappings of the zero page Usama Arif <usama.arif(a)linux.dev> block: invalidate cached plug timestamp after task switch Eric Biggers <ebiggers(a)kernel.org> fscrypt: Fix key setup in edge case with multiple data unit sizes Ian Bridges <icb(a)fastmail.org> fbdev: fix use-after-free in store_modes() Koichiro Den <den(a)valinux.co.jp> NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR Ruslan Valiyev <linuxoid(a)gmail.com> apparmor: fix use-after-free in rawdata dedup loop Bryam Vargas <hexlabsecurity(a)proton.me> apparmor: mediate the implicit connect of TCP fast open sendmsg Lukas Wunner <lukas(a)wunner.de> PCI/P2PDMA: Add Intel QAT, DSA, IAA devices to whitelist Maoyi Xie <maoyixie.tju(a)gmail.com> net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink Yiming Qian <yimingqian591(a)gmail.com> net: skmsg: preserve sg.copy across SG transforms Doruk Tan Ozturk <doruk(a)0sec.ai> mac802154: llsec: add skb_cow_data() before in-place crypto Jiajia Liu <liujiajia(a)kylinos.cn> wifi: mt76: add wcid publish check in mt76_sta_add Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> ntfs3: reject direct userspace writes to reserved $LX* xattrs Wongi Lee <qw3rtyp0(a)gmail.com> ipv4: account for fraggap on the paged allocation path Wongi Lee <qw3rtyp0(a)gmail.com> ipv6: account for fraggap on the paged allocation path Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: avoid race of cifsnotfound handler state Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: enforce 2-byte alignment Sven Eckelmann <sven(a)narfation.org> batman-adv: dat: prevent false sharing between VLANs Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: track roam count per VID Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: don't merge change entries with different VIDs Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: handle overlapping packets Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: prevent parallel modifications of last_recv Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: restrict number of unacked list entries Sven Eckelmann <sven(a)narfation.org> batman-adv: v: prevent OGM aggregation on disabled hardif Sven Eckelmann <sven(a)narfation.org> batman-adv: frag: avoid underflow of TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: frag: ensure fragment is writable before modifying TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: fix (m|b)cast csum after decrementing TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: ensure bcast is writable before modifying TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: gw: don't deselect gateway with active hardif Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: initialize last_recv_time during init Sven Eckelmann <sven(a)narfation.org> batman-adv: prevent ELP transmission interval underflow Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: add only finished tp_vars to lists Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: fix fast recovery precondition Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: avoid window underflow Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: initialize dec_cwnd explicitly Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: initialize dup_acks explicitly Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: keep unacked list in ascending ordered Paolo Bonzini <pbonzini(a)redhat.com> KVM: x86: Fix shadow paging use-after-free due to unexpected role ------------- Diffstat: Makefile | 31 ++++-- arch/arm64/kvm/mmu.c | 5 + arch/loongarch/kernel/smp.c | 1 + arch/mips/dec/prom/console.c | 7 +- arch/mips/kernel/smp.c | 2 + arch/riscv/include/asm/cacheflush.h | 25 +++-- arch/riscv/include/asm/kfence.h | 7 +- arch/riscv/kernel/entry.S | 6 +- arch/x86/kvm/hyperv.c | 5 + arch/x86/kvm/mmu/mmu.c | 28 +++-- arch/x86/kvm/svm/sev.c | 1 + block/bdev.c | 5 - block/blk-cgroup.c | 21 ++-- .../intel/qat/qat_common/adf_accel_devices.h | 5 - drivers/crypto/nx/nx.c | 6 +- drivers/crypto/nx/nx.h | 2 +- drivers/dma/idxd/registers.h | 3 - drivers/fpga/of-fpga-region.c | 3 +- drivers/i2c/i2c-core-base.c | 8 +- drivers/irqchip/irq-imgpdc.c | 6 ++ drivers/net/wan/hdlc_ppp.c | 15 ++- drivers/net/wireless/ath/ath11k/dp.c | 1 + drivers/net/wireless/intel/iwlwifi/mld/agg.c | 9 ++ drivers/net/wireless/intel/iwlwifi/mld/ptp.c | 2 +- drivers/net/wireless/intel/iwlwifi/mvm/ptp.c | 2 +- drivers/net/wireless/mediatek/mt76/mac80211.c | 15 ++- drivers/net/wireless/mediatek/mt76/mt76x2/usb.c | 1 + drivers/net/wireless/mediatek/mt76/mt7925/main.c | 3 + drivers/net/wireless/realtek/rtl8xxxu/8188e.c | 1 + drivers/net/wireless/realtek/rtl8xxxu/8188f.c | 1 + drivers/net/wireless/realtek/rtl8xxxu/8192c.c | 1 + drivers/net/wireless/realtek/rtl8xxxu/8192e.c | 1 + drivers/net/wireless/realtek/rtl8xxxu/8192f.c | 1 + drivers/net/wireless/realtek/rtl8xxxu/8710b.c | 1 + drivers/net/wireless/realtek/rtl8xxxu/8723a.c | 1 + drivers/net/wireless/realtek/rtl8xxxu/8723b.c | 1 + drivers/net/wireless/realtek/rtl8xxxu/core.c | 64 ++++++++++- drivers/net/wireless/realtek/rtl8xxxu/regs.h | 2 + drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h | 7 ++ .../net/wireless/realtek/rtlwifi/rtl8821ae/trx.h | 2 +- drivers/net/wireless/realtek/rtw88/tx.c | 7 +- drivers/net/wireless/realtek/rtw88/usb.c | 13 ++- drivers/ntb/hw/epf/ntb_hw_epf.c | 3 +- drivers/pci/p2pdma.c | 10 ++ drivers/power/reset/linkstation-poweroff.c | 2 +- drivers/power/sequencing/core.c | 14 ++- drivers/rpmsg/rpmsg_char.c | 15 ++- drivers/video/fbdev/core/fbcon.c | 7 ++ drivers/video/fbdev/core/fbmem.c | 12 +++ drivers/video/fbdev/core/fbsysfs.c | 10 +- drivers/video/fbdev/core/modedb.c | 5 +- drivers/video/fbdev/omap2/omapfb/omapfb-main.c | 9 +- fs/crypto/fscrypt_private.h | 52 +++++---- fs/crypto/inline_crypt.c | 8 +- fs/crypto/keyring.c | 23 ++-- fs/crypto/keysetup.c | 118 +++++++++++++-------- fs/exfat/dir.c | 4 +- fs/f2fs/acl.c | 18 +++- fs/f2fs/checkpoint.c | 14 ++- fs/f2fs/data.c | 49 +++++---- fs/f2fs/extent_cache.c | 19 ++-- fs/f2fs/f2fs.h | 1 + fs/f2fs/file.c | 11 +- fs/f2fs/gc.c | 56 +++++++--- fs/f2fs/inode.c | 26 +++-- fs/f2fs/node.c | 8 +- fs/gfs2/super.c | 1 + fs/nfs/client.c | 1 + fs/nfs/flexfilelayout/flexfilelayout.c | 4 + fs/nfs/nfs4proc.c | 5 +- fs/nfs/pnfs.c | 2 +- fs/nfs/pnfs_nfs.c | 4 +- fs/nfsd/nfs2acl.c | 17 ++- fs/nfsd/nfs3acl.c | 17 ++- fs/nfsd/nfs4layouts.c | 12 +-- fs/nfsd/nfs4proc.c | 19 ++-- fs/nfsd/nfs4recover.c | 3 +- fs/nfsd/nfs4state.c | 1 + fs/nfsd/nfs4xdr.c | 3 +- fs/nfsd/vfs.c | 6 +- fs/ntfs/file.c | 17 ++- fs/ntfs/super.c | 21 ++-- fs/ntfs/volume.h | 2 + fs/ntfs3/xattr.c | 12 +++ fs/ocfs2/suballoc.c | 22 ++++ fs/smb/server/smbacl.c | 4 +- fs/userfaultfd.c | 2 + include/keys/request_key_auth-type.h | 2 + include/linux/blkdev.h | 16 ++- include/linux/err.h | 12 +-- include/linux/f2fs_fs.h | 1 + include/linux/kvm_host.h | 7 +- include/linux/mm.h | 39 +++++++ include/linux/pci_ids.h | 8 ++ include/linux/skmsg.h | 15 ++- include/linux/userfaultfd_k.h | 4 +- include/net/rtnetlink.h | 2 + kernel/bpf/cgroup.c | 2 +- kernel/sched/core.c | 27 +++-- net/9p/client.c | 3 +- net/batman-adv/bat_iv_ogm.c | 11 +- net/batman-adv/bat_v.c | 1 + net/batman-adv/bat_v_ogm.c | 23 +++- net/batman-adv/bridge_loop_avoidance.c | 28 ++--- net/batman-adv/distributed-arp-table.c | 12 ++- net/batman-adv/fragmentation.c | 22 +++- net/batman-adv/fragmentation.h | 3 +- net/batman-adv/hard-interface.c | 28 +---- net/batman-adv/netlink.c | 10 +- net/batman-adv/routing.c | 73 ++++++++++++- net/batman-adv/tp_meter.c | 115 +++++++++++++------- net/batman-adv/translation-table.c | 12 ++- net/batman-adv/tvlv.c | 69 ++++++++++-- net/batman-adv/types.h | 21 ++-- net/core/filter.c | 27 +++++ net/core/rtnetlink.c | 8 ++ net/core/skmsg.c | 2 + net/ipv4/ip_gre.c | 6 ++ net/ipv4/ip_output.c | 7 +- net/ipv4/tcp_ao.c | 4 + net/ipv6/ip6_output.c | 9 +- net/mac802154/llsec.c | 14 +++ net/tipc/crypto.c | 9 ++ net/tls/tls_sw.c | 4 + security/apparmor/include/policy_unpack.h | 19 ++++ security/apparmor/lsm.c | 16 ++- security/apparmor/net.c | 2 + security/apparmor/policy.c | 8 +- security/keys/internal.h | 2 + security/keys/keyctl.c | 24 +++-- security/keys/keyctl_pkey.c | 9 +- security/keys/request_key_auth.c | 33 +++++- virt/kvm/eventfd.c | 12 +-- 133 files changed, 1326 insertions(+), 452 deletions(-)

3 months, 3 weeks

[PATCH 6.12 000/204] 6.12.95-rc2 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.12.95 release. There are 204 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sun, 05 Jul 2026 07:28:05 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.95-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.12.95-rc2 Hangbin Liu <liuhangbin(a)gmail.com> bonding: do not set usable_slaves for broadcast mode Eric Dumazet <edumazet(a)google.com> bonding: annotate data-races arcound churn variables Tonghao Zhang <tonghao(a)bamaicloud.com> net: bonding: update the slave array for broadcast mode John Stultz <jstultz(a)google.com> locking: rtmutex: Fix wake_q logic in task_blocks_on_rt_mutex HanQuan <eilaimemedsnaimel(a)gmail.com> net/tcp-ao: fix use-after-free of key in del_async path Giovanni Cabiddu <giovanni.cabiddu(a)intel.com> crypto: qat - remove unused character device and IOCTLs Herbert Xu <herbert(a)gondor.apana.org.au> crypto: qat - Return pointer directly in adf_ctl_alloc_resources Thorsten Blum <thorsten.blum(a)linux.dev> crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() Bagas Sanjaya <bagasdotme(a)gmail.com> Documentation: ioctl-number: Extend "Include File" column width Bagas Sanjaya <bagasdotme(a)gmail.com> Documentation: ioctl-number: Fix linuxppc-dev mailto link Georgi Djakov <georgi.djakov(a)oss.qualcomm.com> drivers/base/memory: set mem->altmap after successful device registration Stepan Ionichev <sozdayvek(a)gmail.com> serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails Hem Parekh <hemparekh1596(a)gmail.com> ksmbd: fix out-of-bounds read in smb_check_perm_dacl() Markus Elfring <elfring(a)users.sourceforge.net> NFS: Prevent resource leak in nfs_alloc_server() Michael Bommarito <michael.bommarito(a)gmail.com> NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr Jeff Layton <jlayton(a)kernel.org> nfsd: reset write verifier on deferred writeback errors Jeff Layton <jlayton(a)kernel.org> nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race Dominik Woźniak <stalion(a)gmail.com> nfsd: check get_user() return when reading princhashlen Jeff Layton <jlayton(a)kernel.org> nfsd: fix posix_acl leak on SETACL decode failure Guannan Wang <wgnbuaa(a)gmail.com> NFSD: Fix SECINFO_NO_NAME decode error cleanup Johan Hovold <johan(a)kernel.org> i2c: core: fix adapter registration race Steffen Persvold <spersvold(a)gmail.com> fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode Tuo Li <islituo(a)gmail.com> fbdev: modedb: fix a possible UAF in fb_find_mode() Ian Bridges <icb(a)fastmail.org> fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var Vivian Wang <wangruikang(a)iscas.ac.cn> riscv: kfence: Call mark_new_valid_map() for kfence_unprotect() Vivian Wang <wangruikang(a)iscas.ac.cn> riscv: mm: Extract helper mark_new_valid_map() Wentao Liang <vulab(a)iscas.ac.cn> power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() Ashutosh Desai <ashutoshdesai993(a)gmail.com> KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path Hyunwoo Kim <imv4bel(a)gmail.com> KVM: x86: hyper-v: Bound the bank index when querying sparse banks Jonas Jelonek <jelonek.jonas(a)gmail.com> MIPS: smp: report dying CPU to RCU in stop_this_cpu() Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> 9p: avoid putting oldfid in p9_client_walk() error path Zhang Cen <rollkingzzc(a)gmail.com> ocfs2: reject oversized group bitmap descriptors Yuho Choi <dbgh9129(a)gmail.com> rpmsg: char: Fix use-after-free on probe error path Wentao Liang <vulab(a)iscas.ac.cn> fpga: region: fix use-after-free in child_regions_with_firmware() Qingshuang Fu <fuqingshuang(a)kylinos.cn> irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove Wentao Liang <vulab(a)iscas.ac.cn> pNFS: Fix use-after-free in pnfs_update_layout() Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Report dying CPU to RCU in stop_this_cpu() Doruk Tan Ozturk <doruk(a)0sec.ai> tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done Michal Koutný <mkoutny(a)suse.com> blk-cgroup: fix UAF in __blkcg_rstat_flush() Fan Wu <fanwu01(a)zju.edu.cn> hdlc_ppp: sync per-proto timers before freeing hdlc state Wentao Liang <vulab(a)iscas.ac.cn> pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next() Tristan Madani <tristan(a)talencesecurity.com> gfs2: fix use-after-free in gfs2_qd_dealloc Sean Christopherson <seanjc(a)google.com> KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() Michael Bommarito <michael.bommarito(a)gmail.com> exfat: fix potential use-after-free in exfat_find_dir_entry() Maciej W. Rozycki <macro(a)orcam.me.uk> MIPS: DEC: Prevent initial console buffer from landing in XKPHYS Dawei Feng <dawei.feng(a)seu.edu.cn> bpf: use kvfree() for replaced sysctl write buffer Denis Arefev <arefev(a)swemel.ru> block: Avoid mounting the bdev pseudo-filesystem in userspace Wenjie Qi <qwjhust(a)gmail.com> f2fs: keep atomic write retry from zeroing original data Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node() Zhang Cen <rollkingzzc(a)gmail.com> f2fs: validate ACL entry sizes in f2fs_acl_from_disk() Sunmin Jeong <s_min.jeong(a)samsung.com> f2fs: fix to round down start offset of fallocate for pin file Wenjie Qi <qwjhust(a)gmail.com> f2fs: validate compress cache inode only when enabled Junjie Cao <junjie.cao(a)intel.com> wifi: iwlwifi: mvm: fix race condition in PTP removal Luka Gejak <luka.gejak(a)linux.dev> wifi: rtw88: usb: fix memory leaks on USB write failures Luka Gejak <luka.gejak(a)linux.dev> wifi: rtw88: increase TX report timeout to fix race condition Bitterblue Smith <rtl8821cerfe2(a)gmail.com> wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor Jose Ignacio Tornos Martinez <jtornosm(a)redhat.com> wifi: ath11k: fix warning when unbinding ElXreno <elxreno(a)gmail.com> wifi: mt76: mt7925: don't disable AP BSS when removing TDLS peer Zenm Chen <zenmchen(a)gmail.com> wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S Shaomin Chen <eeesssooo020(a)gmail.com> keys: Pin request_key_auth payload in instantiate paths Jarkko Sakkinen <jarkko(a)kernel.org> KEYS: fix overflow in keyctl_pkey_params_get_2() Arnd Bergmann <arnd(a)arndb.de> err.h: use __always_inline on all error pointer helpers Usama Arif <usama.arif(a)linux.dev> block: invalidate cached plug timestamp after task switch Ian Bridges <icb(a)fastmail.org> fbdev: fix use-after-free in store_modes() Koichiro Den <den(a)valinux.co.jp> NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR Ruslan Valiyev <linuxoid(a)gmail.com> apparmor: fix use-after-free in rawdata dedup loop Bryam Vargas <hexlabsecurity(a)proton.me> apparmor: mediate the implicit connect of TCP fast open sendmsg Maoyi Xie <maoyixie.tju(a)gmail.com> net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink Yiming Qian <yimingqian591(a)gmail.com> net: skmsg: preserve sg.copy across SG transforms Doruk Tan Ozturk <doruk(a)0sec.ai> mac802154: llsec: add skb_cow_data() before in-place crypto Cheng Ming Lin <chengminglin(a)mxic.com.tw> mtd: spi-nor: macronix: add support for mx66{l2, u1}g45g Cheng Ming Lin <chengminglin(a)mxic.com.tw> mtd: spi-nor: macronix: Add post_sfdp fixups for Quad Input Page Program Kuniyuki Iwashima <kuniyu(a)google.com> af_unix: Set gc_in_progress to true in unix_gc(). Sean Christopherson <seanjc(a)google.com> KVM: SEV: Unmap and unpin the GHCB as needed on vCPU free Sean Christopherson <seanjc(a)google.com> KVM: SEV: Move sev_free_vcpu() down below sev_es_unmap_ghcb() Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> ntfs3: reject direct userspace writes to reserved $LX* xattrs Wongi Lee <qw3rtyp0(a)gmail.com> ipv4: account for fraggap on the paged allocation path Eric Dumazet <edumazet(a)google.com> inet: add indirect call wrapper for getfrag() calls Paul Moore <paul(a)paul-moore.com> selinux: fix overlayfs mmap() and mprotect() access checks Paul Moore <paul(a)paul-moore.com> lsm: add backing_file LSM hooks Amir Goldstein <amir73il(a)gmail.com> fs: constify file ptr in backing_file accessor helpers Wongi Lee <qw3rtyp0(a)gmail.com> ipv6: account for fraggap on the paged allocation path Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: avoid race of cifsnotfound handler state Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: enforce 2-byte alignment Sven Eckelmann <sven(a)narfation.org> batman-adv: dat: prevent false sharing between VLANs Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: track roam count per VID Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: don't merge change entries with different VIDs Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: handle overlapping packets Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: prevent parallel modifications of last_recv Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: restrict number of unacked list entries Sven Eckelmann <sven(a)narfation.org> batman-adv: v: prevent OGM aggregation on disabled hardif Sven Eckelmann <sven(a)narfation.org> batman-adv: frag: avoid underflow of TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: frag: ensure fragment is writable before modifying TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: fix (m|b)cast csum after decrementing TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: ensure bcast is writable before modifying TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: initialize last_recv_time during init Sven Eckelmann <sven(a)narfation.org> batman-adv: prevent ELP transmission interval underflow Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: add only finished tp_vars to lists Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: fix fast recovery precondition Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: avoid window underflow Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: initialize dec_cwnd explicitly Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: initialize dup_acks explicitly Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: keep unacked list in ascending ordered Sean Christopherson <seanjc(a)google.com> KVM: SEV: Ignore Port I/O requests of length '0' Sean Christopherson <seanjc(a)google.com> KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ Sean Christopherson <seanjc(a)google.com> KVM: SEV: Ignore MMIO requests of length '0' Sasha Levin <sashal(a)kernel.org> Revert "PCI: qcom: Advertise Hotplug Slot Capability with no Command Completion support" Sean Christopherson <seanjc(a)google.com> KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level Paolo Bonzini <pbonzini(a)redhat.com> KVM: x86: Fix shadow paging use-after-free due to unexpected role Miklos Szeredi <mszeredi(a)redhat.com> virtiofs: fix UAF on submount umount Ruslan Valiyev <linuxoid(a)gmail.com> media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si Gil Portnoy <dddhkts1(a)gmail.com> ksmbd: reject non-VALID session in compound request branch Viken Dadhaniya <viken.dadhaniya(a)oss.qualcomm.com> serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero Yi Yang <yiyang13(a)huawei.com> vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write Sam Daly <sam(a)samdaly.ie> iio: adc: ti-ads1298: add bounds check to pga_settings index Sam Daly <sam(a)samdaly.ie> iio: light: veml6075: add bounds check to veml6075_it_ms index Xin Long <lucien.xin(a)gmail.com> sctp: disable BH before calling udp_tunnel_xmit_skb() Petr Machata <petrm(a)nvidia.com> net: ipv6: Make udp_tunnel6_xmit_skb() void Vasily Gorbik <gor(a)linux.ibm.com> scripts/sorttable: Fix endianness handling in build-time mcount sort Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Allow matches to functions before function entry Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Use normal sort if theres no relocs in the mcount section Steven Rostedt <rostedt(a)goodmis.org> ftrace: Check against is_kernel_text() instead of kaslr_offset() Steven Rostedt <rostedt(a)goodmis.org> ftrace: Test mcount_loc addr before calling ftrace_call_addr() Guenter Roeck <linux(a)roeck-us.net> ftrace: Do not over-allocate ftrace memory Steven Rostedt <rostedt(a)goodmis.org> ftrace: Have ftrace pages output reflect freed pages Steven Rostedt <rostedt(a)goodmis.org> ftrace: Update the mcount_loc check of skipped entries Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Zero out weak functions in mcount_loc table Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Always use an array for the mcount_loc sorting Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Have mcount rela sort use direct values Steven Rostedt <rostedt(a)goodmis.org> arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Use a structure of function pointers for elf helpers Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Get start/stop_mcount_loc from ELF file directly Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Move code from sorttable.h into sorttable.c Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Use uint64_t for mcount sorting Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Add helper functions for Elf_Sym Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Add helper functions for Elf_Shdr Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Add helper functions for Elf_Ehdr Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Convert Elf_Sym MACRO over to a union Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Replace Elf_Shdr Macro with a union Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Convert Elf_Ehdr to union Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Make compare_extable() into two functions Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Have the ORC code use the _r() functions to read Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Remove unneeded Elf_Rel Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Remove unused write functions Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Remove unused macro defines Joanne Koong <joannelkoong(a)gmail.com> fuse: re-lock request before replacing page cache folio David Howells <dhowells(a)redhat.com> rxrpc: Fix the ACK parser to extract the SACK table for parsing Santosh Kalluri <santosh.kalluri129(a)gmail.com> net: phonet: free phonet_device after RCU grace period Kuniyuki Iwashima <kuniyu(a)amazon.com> phonet: Pass net and ifindex to phonet_address_notify(). Kuniyuki Iwashima <kuniyu(a)amazon.com> phonet: Pass ifindex to fill_addr(). Davidlohr Bueso <dave(a)stgolabs.net> locking/rtmutex: Skip remove_waiter() when waiter is not enqueued Peter Zijlstra <peterz(a)infradead.org> locking/mutex: Remove wakeups from under mutex::wait_lock Thorsten Blum <thorsten.blum(a)linux.dev> hv: utils: handle and propagate errors in kvp_register Dexuan Cui <decui(a)microsoft.com> Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs Jann Horn <jannh(a)google.com> fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() Salman Alghamdi <me(a)cipherat.com> staging: rtl8723bs: fix buffer over-read in rtw_update_protection Hangbin Liu <liuhangbin(a)gmail.com> bonding: fix NULL pointer dereference in actor_port_prio setting Xiang Mei <xmei5(a)asu.edu> net: bonding: fix use-after-free in bond_xmit_broadcast() Eric Dumazet <edumazet(a)google.com> bonding: 3ad: implement proper RCU rules for port->aggregator Hangbin Liu <liuhangbin(a)gmail.com> bonding: print churn state via netlink Hangbin Liu <liuhangbin(a)gmail.com> bonding: add support for per-port LACP actor priority Tonghao Zhang <tonghao(a)bamaicloud.com> net: bonding: add broadcast_neighbor option for 802.3ad Kevin Berry <kpberry(a)google.com> Revert "net: bonding: fix use-after-free in bond_xmit_broadcast()" Yingjie Gao <gaoyingjie(a)uniontech.com> xfs: fix error returns in CoW fork repair Christoph Hellwig <hch(a)lst.de> xfs: remove the expr argument to XFS_TEST_ERROR Thadeu Lima de Souza Cascardo <cascardo(a)igalia.com> dlm: prevent NPD when writing a positive value to event_done André Draszik <andre.draszik(a)linaro.org> regulator: core: fix locking in regulator_resolve_supply() error path Yicong Yang <yang.yicong(a)picoheart.com> ACPI: scan: Use async schedule function in acpi_scan_clear_dep_fn() Varun R Mallya <varunrmallya(a)gmail.com> selftests/bpf: Add test to ensure kprobe_multi is not sleepable Varun R Mallya <varunrmallya(a)gmail.com> bpf: Reject sleepable kprobe_multi programs at attach time Mingyu Wang <25181214217(a)stu.xidian.edu.cn> agp/amd64: Fix broken error propagation in agp_amd64_probe() Weiming Shi <bestswngs(a)gmail.com> net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() Weiming Shi <bestswngs(a)gmail.com> i2c: stub: Reject I2C block transfers with invalid length Lord Ulf Henrik Holmberg <henrik.holmberg(a)defensify.se> RDMA/bnxt_re: zero shared page before exposing to userspace Waiman Long <longman(a)redhat.com> debugobjects: Dont call fill_pool() in early boot hardirq context Helen Koike <koike(a)igalia.com> debugobjects: Do not fill_pool() if pi_blocked_on Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> debugobjects: Use LD_WAIT_CONFIG instead of LD_WAIT_SLEEP Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> debugobjects: Allow to refill the pool before SYSTEM_SCHEDULING Petr Machata <petrm(a)nvidia.com> Reapply "selftest/ptp: update ptp selftest to exercise the gettimex options" Eric Dumazet <edumazet(a)google.com> ip6_vti: set netns_immutable on the fallback device. Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> net: Drop the lock in skb_may_tx_timestamp() Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: light: bh1780: fix PM runtime leak on error path Christian Brauner <brauner(a)kernel.org> eventpoll: fix ep_remove struct eventpoll / struct file UAF Christian Brauner <brauner(a)kernel.org> eventpoll: move epi_fget() up Christian Brauner <brauner(a)kernel.org> eventpoll: rename ep_remove_safe() back to ep_remove() Christian Brauner <brauner(a)kernel.org> eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() Christian Brauner <brauner(a)kernel.org> eventpoll: kill __ep_remove() Christian Brauner <brauner(a)kernel.org> eventpoll: split __ep_remove() Christian Brauner <brauner(a)kernel.org> eventpoll: use hlist_is_singular_node() in __ep_remove() Maíra Canal <mcanal(a)igalia.com> drm/v3d: Skip CSD when it has zeroed workgroups Maíra Canal <mcanal(a)igalia.com> drm/v3d: Store the active job inside the queue's state Jani Nikula <jani.nikula(a)intel.com> drm/xe/display: fix oops in suspend/shutdown without display Gabriel Krisman Bertazi <krisman(a)suse.de> io_uring/net: Avoid msghdr on op_connect/op_bind async data Tzung-Bi Shih <tzungbi(a)kernel.org> gpio: Fix resource leaks on errors in gpiochip_add_data_with_key() Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> gpiolib: Remove redundant assignment of return variable Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> gpiolib: Extract gpiochip_choose_fwnode() for wider use Jann Horn <jannh(a)google.com> fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios Sean Wang <sean.wang(a)mediatek.com> wifi: mt76: mt7921: fix potential deadlock in mt7921_roc_abort_sync Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7921: fix a potential scan no APs Leon Yen <leon.yen(a)mediatek.com> wifi: mt76: mt7921: avoid undesired changes of the preset regulatory domain ------------- Diffstat: Documentation/networking/bonding.rst | 15 + Documentation/userspace-api/ioctl/ioctl-number.rst | 485 +++++---- Makefile | 4 +- arch/arm64/Kconfig | 1 + arch/loongarch/kernel/smp.c | 1 + arch/mips/dec/prom/console.c | 7 +- arch/mips/kernel/smp.c | 2 + arch/riscv/include/asm/cacheflush.h | 25 +- arch/riscv/include/asm/kfence.h | 7 +- arch/riscv/kernel/entry.S | 6 +- arch/x86/kvm/hyperv.c | 5 + arch/x86/kvm/mmu/mmu.c | 28 +- arch/x86/kvm/svm/sev.c | 113 +- block/bdev.c | 5 - block/blk-cgroup.c | 21 +- drivers/acpi/scan.c | 41 +- drivers/base/memory.c | 3 +- drivers/char/agp/amd64-agp.c | 2 +- drivers/crypto/intel/qat/qat_common/adf_cfg.c | 10 - drivers/crypto/intel/qat/qat_common/adf_cfg.h | 1 - .../crypto/intel/qat/qat_common/adf_cfg_common.h | 32 - drivers/crypto/intel/qat/qat_common/adf_cfg_user.h | 38 - .../crypto/intel/qat/qat_common/adf_common_drv.h | 3 - drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c | 416 +------- drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c | 70 -- drivers/fpga/of-fpga-region.c | 3 +- drivers/gpio/gpiolib.c | 156 +-- drivers/gpu/drm/v3d/v3d_drv.h | 7 +- drivers/gpu/drm/v3d/v3d_gem.c | 7 +- drivers/gpu/drm/v3d/v3d_irq.c | 62 +- drivers/gpu/drm/v3d/v3d_sched.c | 42 +- drivers/gpu/drm/xe/display/xe_display.c | 11 +- drivers/hv/hv_kvp.c | 25 +- drivers/hv/vmbus_drv.c | 29 +- drivers/i2c/i2c-core-base.c | 8 +- drivers/i2c/i2c-stub.c | 5 + drivers/iio/adc/ti-ads1298.c | 7 +- drivers/iio/light/bh1780.c | 4 +- drivers/iio/light/veml6075.c | 8 +- drivers/infiniband/hw/bnxt_re/ib_verbs.c | 2 +- drivers/irqchip/irq-imgpdc.c | 6 + drivers/media/test-drivers/vidtv/vidtv_mux.c | 8 +- drivers/mtd/spi-nor/macronix.c | 31 + drivers/net/bonding/bond_3ad.c | 131 ++- drivers/net/bonding/bond_main.c | 86 +- drivers/net/bonding/bond_netlink.c | 37 +- drivers/net/bonding/bond_options.c | 71 ++ drivers/net/bonding/bond_procfs.c | 11 +- drivers/net/bonding/bond_sysfs_slave.c | 17 +- drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c | 8 +- drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h | 1 + drivers/net/wan/hdlc_ppp.c | 15 +- drivers/net/wireless/ath/ath11k/dp.c | 1 + drivers/net/wireless/intel/iwlwifi/mvm/ptp.c | 2 +- drivers/net/wireless/mediatek/mt76/mt76x2/usb.c | 1 + drivers/net/wireless/mediatek/mt76/mt7921/init.c | 7 + drivers/net/wireless/mediatek/mt76/mt7921/main.c | 14 +- drivers/net/wireless/mediatek/mt76/mt7925/main.c | 3 + .../net/wireless/realtek/rtlwifi/rtl8821ae/trx.h | 2 +- drivers/net/wireless/realtek/rtw88/tx.c | 7 +- drivers/net/wireless/realtek/rtw88/usb.c | 13 +- drivers/ntb/hw/epf/ntb_hw_epf.c | 3 +- drivers/pci/controller/dwc/pcie-qcom.c | 17 +- drivers/power/reset/linkstation-poweroff.c | 2 +- drivers/power/sequencing/core.c | 14 +- drivers/regulator/core.c | 10 +- drivers/rpmsg/rpmsg_char.c | 15 +- drivers/staging/rtl8723bs/core/rtw_mlme.c | 10 +- drivers/tty/serial/8250/8250_dw.c | 4 +- drivers/tty/serial/qcom_geni_serial.c | 9 +- drivers/tty/vt/vc_screen.c | 2 +- drivers/video/fbdev/core/fbmem.c | 12 + drivers/video/fbdev/core/fbsysfs.c | 10 +- drivers/video/fbdev/core/modedb.c | 5 +- fs/backing-file.c | 22 +- fs/dlm/lockspace.c | 2 +- fs/eventpoll.c | 142 +-- fs/exfat/dir.c | 4 +- fs/f2fs/acl.c | 18 +- fs/f2fs/data.c | 16 +- fs/f2fs/extent_cache.c | 19 +- fs/f2fs/file.c | 9 +- fs/f2fs/inode.c | 9 +- fs/fhandle.c | 16 +- fs/file_table.c | 40 +- fs/fuse/dev.c | 23 +- fs/fuse/file.c | 8 +- fs/fuse/passthrough.c | 2 +- fs/gfs2/super.c | 1 + fs/internal.h | 4 +- fs/mount.h | 10 +- fs/namespace.c | 6 +- fs/nfs/client.c | 1 + fs/nfs/pnfs.c | 2 +- fs/nfs/pnfs_nfs.c | 4 +- fs/nfsd/nfs2acl.c | 17 +- fs/nfsd/nfs3acl.c | 17 +- fs/nfsd/nfs4recover.c | 3 +- fs/nfsd/nfs4state.c | 1 + fs/nfsd/nfs4xdr.c | 3 +- fs/nfsd/vfs.c | 6 +- fs/ntfs3/xattr.c | 12 + fs/ocfs2/suballoc.c | 22 + fs/overlayfs/dir.c | 2 +- fs/overlayfs/file.c | 3 +- fs/smb/server/smb2pdu.c | 5 + fs/smb/server/smbacl.c | 4 +- fs/xfs/libxfs/xfs_ag_resv.c | 8 +- fs/xfs/libxfs/xfs_alloc.c | 5 +- fs/xfs/libxfs/xfs_attr_leaf.c | 2 +- fs/xfs/libxfs/xfs_bmap.c | 17 +- fs/xfs/libxfs/xfs_btree.c | 2 +- fs/xfs/libxfs/xfs_da_btree.c | 2 +- fs/xfs/libxfs/xfs_dir2.c | 2 +- fs/xfs/libxfs/xfs_exchmaps.c | 4 +- fs/xfs/libxfs/xfs_ialloc.c | 2 +- fs/xfs/libxfs/xfs_inode_buf.c | 4 +- fs/xfs/libxfs/xfs_inode_fork.c | 3 +- fs/xfs/libxfs/xfs_refcount.c | 5 +- fs/xfs/libxfs/xfs_rmap.c | 2 +- fs/xfs/scrub/cow_repair.c | 7 +- fs/xfs/scrub/repair.c | 2 +- fs/xfs/xfs_attr_item.c | 2 +- fs/xfs/xfs_buf.c | 4 +- fs/xfs/xfs_error.c | 5 +- fs/xfs/xfs_error.h | 10 +- fs/xfs/xfs_inode.c | 28 +- fs/xfs/xfs_iomap.c | 2 +- fs/xfs/xfs_log.c | 8 +- fs/xfs/xfs_trans_ail.c | 2 +- include/keys/request_key_auth-type.h | 2 + include/linux/backing-file.h | 4 +- include/linux/blkdev.h | 16 +- include/linux/err.h | 12 +- include/linux/fs.h | 19 +- include/linux/kvm_host.h | 7 +- include/linux/lsm_audit.h | 2 +- include/linux/lsm_hook_defs.h | 5 + include/linux/lsm_hooks.h | 1 + include/linux/security.h | 22 + include/linux/skmsg.h | 15 +- include/net/bond_3ad.h | 3 +- include/net/bond_options.h | 2 + include/net/bonding.h | 3 + include/net/phonet/pn_dev.h | 2 +- include/net/rtnetlink.h | 2 + include/net/sock.h | 2 +- include/net/udp_tunnel.h | 14 +- include/uapi/linux/if_link.h | 3 + io_uring/net.c | 36 +- io_uring/opdef.c | 4 +- kernel/bpf/cgroup.c | 2 +- kernel/futex/pi.c | 6 +- kernel/locking/mutex.c | 16 +- kernel/locking/rtmutex.c | 51 +- kernel/locking/rtmutex_api.c | 14 +- kernel/locking/rtmutex_common.h | 3 +- kernel/locking/rwbase_rt.c | 8 +- kernel/locking/rwsem.c | 4 +- kernel/locking/spinlock_rt.c | 5 +- kernel/locking/ww_mutex.h | 30 +- kernel/sched/core.c | 12 +- kernel/trace/bpf_trace.c | 4 + kernel/trace/ftrace.c | 68 +- lib/debugobjects.c | 56 +- net/9p/client.c | 3 +- net/batman-adv/bat_iv_ogm.c | 11 +- net/batman-adv/bat_v.c | 1 + net/batman-adv/bat_v_ogm.c | 23 +- net/batman-adv/bridge_loop_avoidance.c | 28 +- net/batman-adv/distributed-arp-table.c | 12 +- net/batman-adv/fragmentation.c | 22 +- net/batman-adv/fragmentation.h | 3 +- net/batman-adv/netlink.c | 10 +- net/batman-adv/routing.c | 73 +- net/batman-adv/tp_meter.c | 115 +- net/batman-adv/translation-table.c | 12 +- net/batman-adv/tvlv.c | 69 +- net/batman-adv/types.h | 21 +- net/core/filter.c | 27 + net/core/rtnetlink.c | 8 + net/core/skbuff.c | 23 +- net/core/skmsg.c | 2 + net/ipv4/ip_gre.c | 6 + net/ipv4/ip_output.c | 20 +- net/ipv4/tcp_ao.c | 4 + net/ipv6/ip6_output.c | 22 +- net/ipv6/ip6_udp_tunnel.c | 15 +- net/ipv6/ip6_vti.c | 1 + net/mac802154/llsec.c | 14 + net/phonet/pn_dev.c | 12 +- net/phonet/pn_netlink.c | 23 +- net/rxrpc/input.c | 21 +- net/sctp/ipv6.c | 9 +- net/sctp/protocol.c | 2 + net/socket.c | 2 +- net/tipc/crypto.c | 9 + net/tipc/udp_media.c | 10 +- net/tls/tls_sw.c | 4 + net/unix/garbage.c | 2 + scripts/link-vmlinux.sh | 4 +- scripts/sorttable.c | 1119 +++++++++++++++++++- scripts/sorttable.h | 500 --------- security/apparmor/include/policy_unpack.h | 19 + security/apparmor/lsm.c | 16 +- security/apparmor/policy.c | 8 +- security/keys/internal.h | 2 + security/keys/keyctl.c | 24 +- security/keys/keyctl_pkey.c | 9 +- security/keys/request_key_auth.c | 33 +- security/security.c | 109 ++ security/selinux/hooks.c | 256 +++-- security/selinux/include/objsec.h | 11 + .../selftests/bpf/prog_tests/kprobe_multi_test.c | 35 +- .../selftests/bpf/progs/kprobe_multi_sleepable.c | 25 + tools/testing/selftests/ptp/testptp.c | 62 +- virt/kvm/eventfd.c | 12 +- 217 files changed, 3875 insertions(+), 2346 deletions(-)

3 months, 3 weeks

[PATCH 6.18 000/109] 6.18.38-rc2 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.18.38 release. There are 109 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sun, 05 Jul 2026 07:28:03 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.38-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.18.38-rc2 John Johansen <john.johansen(a)canonical.com> apparmor: advertise the tcp fast open fix is applied HanQuan <eilaimemedsnaimel(a)gmail.com> net/tcp-ao: fix use-after-free of key in del_async path Stepan Ionichev <sozdayvek(a)gmail.com> serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails Hem Parekh <hemparekh1596(a)gmail.com> ksmbd: fix out-of-bounds read in smb_check_perm_dacl() Markus Elfring <elfring(a)users.sourceforge.net> NFS: Prevent resource leak in nfs_alloc_server() Igor Raits <igor.raits(a)gmail.com> NFSv4: clear exception state on successful mkdir retry Michael Bommarito <michael.bommarito(a)gmail.com> NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr Michael Bommarito <michael.bommarito(a)gmail.com> NFSv4/flexfiles: reject zero filehandle version count Jeff Layton <jlayton(a)kernel.org> nfsd: reset write verifier on deferred writeback errors Jeff Layton <jlayton(a)kernel.org> nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race Dominik Woźniak <stalion(a)gmail.com> nfsd: check get_user() return when reading princhashlen Jeff Layton <jlayton(a)kernel.org> nfsd: fix inverted cp_ttl check in async copy reaper Jeff Layton <jlayton(a)kernel.org> nfsd: fix posix_acl leak on SETACL decode failure Guannan Wang <wgnbuaa(a)gmail.com> NFSD: Fix SECINFO_NO_NAME decode error cleanup Johan Hovold <johan(a)kernel.org> i2c: core: fix adapter registration race Steffen Persvold <spersvold(a)gmail.com> fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode Tuo Li <islituo(a)gmail.com> fbdev: modedb: fix a possible UAF in fb_find_mode() Ian Bridges <icb(a)fastmail.org> fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var Vivian Wang <wangruikang(a)iscas.ac.cn> riscv: kfence: Call mark_new_valid_map() for kfence_unprotect() Vivian Wang <wangruikang(a)iscas.ac.cn> riscv: mm: Extract helper mark_new_valid_map() Wentao Liang <vulab(a)iscas.ac.cn> power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() Ashutosh Desai <ashutoshdesai993(a)gmail.com> KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path Hyunwoo Kim <imv4bel(a)gmail.com> KVM: x86: hyper-v: Bound the bank index when querying sparse banks Jonas Jelonek <jelonek.jonas(a)gmail.com> MIPS: smp: report dying CPU to RCU in stop_this_cpu() Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> 9p: avoid putting oldfid in p9_client_walk() error path Zhang Cen <rollkingzzc(a)gmail.com> ocfs2: reject oversized group bitmap descriptors Yuho Choi <dbgh9129(a)gmail.com> rpmsg: char: Fix use-after-free on probe error path Wentao Liang <vulab(a)iscas.ac.cn> fpga: region: fix use-after-free in child_regions_with_firmware() Qingshuang Fu <fuqingshuang(a)kylinos.cn> irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove Wentao Liang <vulab(a)iscas.ac.cn> pNFS: Fix use-after-free in pnfs_update_layout() Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Report dying CPU to RCU in stop_this_cpu() Doruk Tan Ozturk <doruk(a)0sec.ai> tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done Michal Koutný <mkoutny(a)suse.com> blk-cgroup: fix UAF in __blkcg_rstat_flush() Fan Wu <fanwu01(a)zju.edu.cn> hdlc_ppp: sync per-proto timers before freeing hdlc state Wentao Liang <vulab(a)iscas.ac.cn> pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next() Tristan Madani <tristan(a)talencesecurity.com> gfs2: fix use-after-free in gfs2_qd_dealloc Sam James <sam(a)gentoo.org> crypto: nx - fix nx_crypto_ctx_exit argument Sean Christopherson <seanjc(a)google.com> KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() Sean Christopherson <seanjc(a)google.com> KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level Michael Bommarito <michael.bommarito(a)gmail.com> exfat: fix potential use-after-free in exfat_find_dir_entry() Maciej W. Rozycki <macro(a)orcam.me.uk> MIPS: DEC: Prevent initial console buffer from landing in XKPHYS Dawei Feng <dawei.feng(a)seu.edu.cn> bpf: use kvfree() for replaced sysctl write buffer Denis Arefev <arefev(a)swemel.ru> block: Avoid mounting the bdev pseudo-filesystem in userspace Wenjie Qi <qwjhust(a)gmail.com> f2fs: keep atomic write retry from zeroing original data Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node() Zhang Cen <rollkingzzc(a)gmail.com> f2fs: validate ACL entry sizes in f2fs_acl_from_disk() Sunmin Jeong <s_min.jeong(a)samsung.com> f2fs: fix to round down start offset of fallocate for pin file Wenjie Qi <qwjhust(a)gmail.com> f2fs: validate compress cache inode only when enabled Wenjie Qi <qwjhust(a)gmail.com> f2fs: validate orphan inode entry count Wenjie Qi <qwjhust(a)gmail.com> f2fs: pass correct iostat type for single node writes Junrui Luo <moonafterrain(a)outlook.com> wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers Junjie Cao <junjie.cao(a)intel.com> wifi: iwlwifi: mld: fix race condition in PTP removal Junjie Cao <junjie.cao(a)intel.com> wifi: iwlwifi: mvm: fix race condition in PTP removal Luka Gejak <luka.gejak(a)linux.dev> wifi: rtw88: usb: fix memory leaks on USB write failures Luka Gejak <luka.gejak(a)linux.dev> wifi: rtw88: increase TX report timeout to fix race condition Bitterblue Smith <rtl8821cerfe2(a)gmail.com> wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor Jose Ignacio Tornos Martinez <jtornosm(a)redhat.com> wifi: ath11k: fix warning when unbinding ElXreno <elxreno(a)gmail.com> wifi: mt76: mt7925: don't disable AP BSS when removing TDLS peer Zenm Chen <zenmchen(a)gmail.com> wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S Mike Rapoport (Microsoft) <rppt(a)kernel.org> userfaultfd: ensure mremap_userfaultfd_fail() releases mmap_changing Shaomin Chen <eeesssooo020(a)gmail.com> keys: Pin request_key_auth payload in instantiate paths Jarkko Sakkinen <jarkko(a)kernel.org> KEYS: fix overflow in keyctl_pkey_params_get_2() Konstantin Khorenko <khorenko(a)virtuozzo.com> gcov: use atomic counter updates to fix concurrent access crashes Arnd Bergmann <arnd(a)arndb.de> err.h: use __always_inline on all error pointer helpers Ard Biesheuvel <ardb(a)kernel.org> KVM: arm64: Omit tag sync on stage-2 mappings of the zero page Usama Arif <usama.arif(a)linux.dev> block: invalidate cached plug timestamp after task switch Ian Bridges <icb(a)fastmail.org> fbdev: fix use-after-free in store_modes() Koichiro Den <den(a)valinux.co.jp> NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR Ruslan Valiyev <linuxoid(a)gmail.com> apparmor: fix use-after-free in rawdata dedup loop Bryam Vargas <hexlabsecurity(a)proton.me> apparmor: mediate the implicit connect of TCP fast open sendmsg Maoyi Xie <maoyixie.tju(a)gmail.com> net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink Yiming Qian <yimingqian591(a)gmail.com> net: skmsg: preserve sg.copy across SG transforms Doruk Tan Ozturk <doruk(a)0sec.ai> mac802154: llsec: add skb_cow_data() before in-place crypto Kuniyuki Iwashima <kuniyu(a)google.com> af_unix: Set gc_in_progress to true in unix_gc(). Jiajia Liu <liujiajia(a)kylinos.cn> wifi: mt76: add wcid publish check in mt76_sta_add Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> ntfs3: reject direct userspace writes to reserved $LX* xattrs Wongi Lee <qw3rtyp0(a)gmail.com> ipv4: account for fraggap on the paged allocation path Wongi Lee <qw3rtyp0(a)gmail.com> ipv6: account for fraggap on the paged allocation path Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: avoid race of cifsnotfound handler state Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: enforce 2-byte alignment Sven Eckelmann <sven(a)narfation.org> batman-adv: dat: prevent false sharing between VLANs Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: track roam count per VID Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: don't merge change entries with different VIDs Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: handle overlapping packets Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: prevent parallel modifications of last_recv Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: restrict number of unacked list entries Sven Eckelmann <sven(a)narfation.org> batman-adv: v: prevent OGM aggregation on disabled hardif Sven Eckelmann <sven(a)narfation.org> batman-adv: frag: avoid underflow of TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: frag: ensure fragment is writable before modifying TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: fix (m|b)cast csum after decrementing TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: ensure bcast is writable before modifying TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: gw: don't deselect gateway with active hardif Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: initialize last_recv_time during init Sven Eckelmann <sven(a)narfation.org> batman-adv: prevent ELP transmission interval underflow Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: add only finished tp_vars to lists Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: fix fast recovery precondition Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: avoid window underflow Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: initialize dec_cwnd explicitly Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: initialize dup_acks explicitly Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: keep unacked list in ascending ordered NeilBrown <neil(a)brown.name> lockd: fix TEST handling when not all permissions are available. Sasha Levin <sashal(a)kernel.org> Revert "PCI: qcom: Advertise Hotplug Slot Capability with no Command Completion support" Paul Moore <paul(a)paul-moore.com> selinux: fix overlayfs mmap() and mprotect() access checks Paul Moore <paul(a)paul-moore.com> lsm: add backing_file LSM hooks Paolo Bonzini <pbonzini(a)redhat.com> KVM: x86: Fix shadow paging use-after-free due to unexpected role ------------- Diffstat: Makefile | 31 ++- arch/arm64/kvm/mmu.c | 5 + arch/loongarch/kernel/smp.c | 1 + arch/mips/dec/prom/console.c | 7 +- arch/mips/kernel/smp.c | 2 + arch/riscv/include/asm/cacheflush.h | 25 +- arch/riscv/include/asm/kfence.h | 7 +- arch/riscv/kernel/entry.S | 6 +- arch/x86/kvm/hyperv.c | 5 + arch/x86/kvm/mmu/mmu.c | 28 ++- arch/x86/kvm/svm/sev.c | 1 + block/bdev.c | 5 - block/blk-cgroup.c | 21 +- drivers/crypto/nx/nx.c | 6 +- drivers/crypto/nx/nx.h | 2 +- drivers/fpga/of-fpga-region.c | 3 +- drivers/i2c/i2c-core-base.c | 8 +- drivers/irqchip/irq-imgpdc.c | 6 + drivers/net/wan/hdlc_ppp.c | 15 +- drivers/net/wireless/ath/ath11k/dp.c | 1 + drivers/net/wireless/intel/iwlwifi/mld/agg.c | 9 + drivers/net/wireless/intel/iwlwifi/mld/ptp.c | 2 +- drivers/net/wireless/intel/iwlwifi/mvm/ptp.c | 2 +- drivers/net/wireless/mediatek/mt76/mac80211.c | 15 +- drivers/net/wireless/mediatek/mt76/mt76x2/usb.c | 1 + drivers/net/wireless/mediatek/mt76/mt7925/main.c | 3 + .../net/wireless/realtek/rtlwifi/rtl8821ae/trx.h | 2 +- drivers/net/wireless/realtek/rtw88/tx.c | 7 +- drivers/net/wireless/realtek/rtw88/usb.c | 13 +- drivers/ntb/hw/epf/ntb_hw_epf.c | 3 +- drivers/pci/controller/dwc/pcie-qcom.c | 17 +- drivers/power/reset/linkstation-poweroff.c | 2 +- drivers/power/sequencing/core.c | 14 +- drivers/rpmsg/rpmsg_char.c | 15 +- drivers/tty/serial/8250/8250_dw.c | 4 +- drivers/video/fbdev/core/fbmem.c | 12 + drivers/video/fbdev/core/fbsysfs.c | 10 +- drivers/video/fbdev/core/modedb.c | 5 +- fs/backing-file.c | 17 +- fs/exfat/dir.c | 4 +- fs/f2fs/acl.c | 18 +- fs/f2fs/checkpoint.c | 14 +- fs/f2fs/data.c | 16 +- fs/f2fs/extent_cache.c | 19 +- fs/f2fs/file.c | 9 +- fs/f2fs/inode.c | 9 +- fs/f2fs/node.c | 2 +- fs/file_table.c | 27 ++- fs/fuse/passthrough.c | 2 +- fs/gfs2/super.c | 1 + fs/internal.h | 3 +- fs/lockd/svc4proc.c | 13 +- fs/lockd/svclock.c | 4 +- fs/lockd/svcproc.c | 15 +- fs/lockd/svcsubs.c | 35 ++- fs/nfs/client.c | 1 + fs/nfs/flexfilelayout/flexfilelayout.c | 4 + fs/nfs/nfs4proc.c | 5 +- fs/nfs/pnfs.c | 2 +- fs/nfs/pnfs_nfs.c | 4 +- fs/nfsd/nfs2acl.c | 17 +- fs/nfsd/nfs3acl.c | 17 +- fs/nfsd/nfs4proc.c | 2 +- fs/nfsd/nfs4recover.c | 3 +- fs/nfsd/nfs4state.c | 1 + fs/nfsd/nfs4xdr.c | 3 +- fs/nfsd/vfs.c | 6 +- fs/ntfs3/xattr.c | 12 + fs/ocfs2/suballoc.c | 22 ++ fs/overlayfs/dir.c | 2 +- fs/overlayfs/file.c | 2 +- fs/smb/server/smbacl.c | 4 +- fs/userfaultfd.c | 2 + include/keys/request_key_auth-type.h | 2 + include/linux/backing-file.h | 4 +- include/linux/blkdev.h | 16 +- include/linux/err.h | 12 +- include/linux/f2fs_fs.h | 1 + include/linux/fs.h | 13 ++ include/linux/kvm_host.h | 7 +- include/linux/lockd/lockd.h | 2 +- include/linux/lsm_audit.h | 2 +- include/linux/lsm_hook_defs.h | 5 + include/linux/lsm_hooks.h | 1 + include/linux/security.h | 22 ++ include/linux/skmsg.h | 15 +- include/net/rtnetlink.h | 2 + kernel/bpf/cgroup.c | 2 +- kernel/sched/core.c | 12 +- net/9p/client.c | 3 +- net/batman-adv/bat_iv_ogm.c | 11 +- net/batman-adv/bat_v.c | 1 + net/batman-adv/bat_v_ogm.c | 23 +- net/batman-adv/bridge_loop_avoidance.c | 28 +-- net/batman-adv/distributed-arp-table.c | 12 +- net/batman-adv/fragmentation.c | 22 +- net/batman-adv/fragmentation.h | 3 +- net/batman-adv/hard-interface.c | 28 +-- net/batman-adv/netlink.c | 10 +- net/batman-adv/routing.c | 73 +++++- net/batman-adv/tp_meter.c | 115 +++++---- net/batman-adv/translation-table.c | 12 +- net/batman-adv/tvlv.c | 69 +++++- net/batman-adv/types.h | 21 +- net/core/filter.c | 27 +++ net/core/rtnetlink.c | 8 + net/core/skmsg.c | 2 + net/ipv4/ip_gre.c | 6 + net/ipv4/ip_output.c | 7 +- net/ipv4/tcp_ao.c | 4 + net/ipv6/ip6_output.c | 9 +- net/mac802154/llsec.c | 14 ++ net/tipc/crypto.c | 9 + net/tls/tls_sw.c | 4 + net/unix/garbage.c | 2 + security/apparmor/include/policy_unpack.h | 19 ++ security/apparmor/lsm.c | 16 +- security/apparmor/net.c | 2 + security/apparmor/policy.c | 8 +- security/keys/internal.h | 2 + security/keys/keyctl.c | 24 +- security/keys/keyctl_pkey.c | 9 +- security/keys/request_key_auth.c | 33 ++- security/security.c | 109 +++++++++ security/selinux/hooks.c | 256 +++++++++++++++------ security/selinux/include/objsec.h | 11 + virt/kvm/eventfd.c | 12 +- 127 files changed, 1368 insertions(+), 412 deletions(-)

3 months, 3 weeks

[PATCH 6.1 000/129] 6.1.177-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.1.177 release. There are 129 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat, 04 Jul 2026 15:50:58 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.177-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.1.177-rc1 Wongi Lee <qw3rtyp0(a)gmail.com> ipv6: account for fraggap on the paged allocation path Giovanni Cabiddu <giovanni.cabiddu(a)intel.com> crypto: qat - remove unused character device and IOCTLs Herbert Xu <herbert(a)gondor.apana.org.au> crypto: qat - Return pointer directly in adf_ctl_alloc_resources Thorsten Blum <thorsten.blum(a)linux.dev> crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() Bagas Sanjaya <bagasdotme(a)gmail.com> Documentation: ioctl-number: Extend "Include File" column width Stepan Ionichev <sozdayvek(a)gmail.com> serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails Joanne Koong <joannelkoong(a)gmail.com> fuse: re-lock request before replacing page cache folio Santosh Kalluri <santosh.kalluri129(a)gmail.com> net: phonet: free phonet_device after RCU grace period Kuniyuki Iwashima <kuniyu(a)amazon.com> phonet: Pass net and ifindex to phonet_address_notify(). Kuniyuki Iwashima <kuniyu(a)amazon.com> phonet: Pass ifindex to fill_addr(). Davidlohr Bueso <dave(a)stgolabs.net> locking/rtmutex: Skip remove_waiter() when waiter is not enqueued Dexuan Cui <decui(a)microsoft.com> Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs Ji'an Zhou <eilaimemedsnaimel(a)gmail.com> futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock Mukesh Ojha <mukesh.ojha(a)oss.qualcomm.com> misc: fastrpc: Fix NULL pointer dereference in rpmsg callback Abel Vesa <abel.vesa(a)linaro.org> misc: fastrpc: Add dma_mask to fastrpc_channel_ctx Thorsten Blum <thorsten.blum(a)linux.dev> hv: utils: handle and propagate errors in kvp_register Paolo Abeni <pabeni(a)redhat.com> mptcp: fix missing wakeups in edge scenarios Tao Cui <cuitao(a)kylinos.cn> mptcp: pm: fix extra_subflows underflow on userspace PM subflow creation Deepak Kumar Singh <quic_deesin(a)quicinc.com> rpmsg: char: Add lock to avoid race when rpmsg device is released Hem Parekh <hemparekh1596(a)gmail.com> ksmbd: fix out-of-bounds read in smb_check_perm_dacl() Michael Bommarito <michael.bommarito(a)gmail.com> NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr Dominik Woźniak <stalion(a)gmail.com> nfsd: check get_user() return when reading princhashlen Jeff Layton <jlayton(a)kernel.org> nfsd: fix posix_acl leak on SETACL decode failure Guannan Wang <wgnbuaa(a)gmail.com> NFSD: Fix SECINFO_NO_NAME decode error cleanup Steffen Persvold <spersvold(a)gmail.com> fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode Ian Bridges <icb(a)fastmail.org> fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var Wentao Liang <vulab(a)iscas.ac.cn> power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() Ashutosh Desai <ashutoshdesai993(a)gmail.com> KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path Jonas Jelonek <jelonek.jonas(a)gmail.com> MIPS: smp: report dying CPU to RCU in stop_this_cpu() Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> 9p: avoid putting oldfid in p9_client_walk() error path Zhang Cen <rollkingzzc(a)gmail.com> ocfs2: reject oversized group bitmap descriptors Wentao Liang <vulab(a)iscas.ac.cn> fpga: region: fix use-after-free in child_regions_with_firmware() Qingshuang Fu <fuqingshuang(a)kylinos.cn> irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove Wentao Liang <vulab(a)iscas.ac.cn> pNFS: Fix use-after-free in pnfs_update_layout() Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Report dying CPU to RCU in stop_this_cpu() Doruk Tan Ozturk <doruk(a)0sec.ai> tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done Fan Wu <fanwu01(a)zju.edu.cn> hdlc_ppp: sync per-proto timers before freeing hdlc state Michael Bommarito <michael.bommarito(a)gmail.com> exfat: fix potential use-after-free in exfat_find_dir_entry() Maciej W. Rozycki <macro(a)orcam.me.uk> MIPS: DEC: Prevent initial console buffer from landing in XKPHYS Dawei Feng <dawei.feng(a)seu.edu.cn> bpf: use kvfree() for replaced sysctl write buffer Zhang Cen <rollkingzzc(a)gmail.com> f2fs: validate ACL entry sizes in f2fs_acl_from_disk() Sunmin Jeong <s_min.jeong(a)samsung.com> f2fs: fix to round down start offset of fallocate for pin file Wenjie Qi <qwjhust(a)gmail.com> f2fs: validate compress cache inode only when enabled Bitterblue Smith <rtl8821cerfe2(a)gmail.com> wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor Jose Ignacio Tornos Martinez <jtornosm(a)redhat.com> wifi: ath11k: fix warning when unbinding Zenm Chen <zenmchen(a)gmail.com> wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S Shaomin Chen <eeesssooo020(a)gmail.com> keys: Pin request_key_auth payload in instantiate paths Jarkko Sakkinen <jarkko(a)kernel.org> KEYS: fix overflow in keyctl_pkey_params_get_2() Koichiro Den <den(a)valinux.co.jp> NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR Ruslan Valiyev <linuxoid(a)gmail.com> apparmor: fix use-after-free in rawdata dedup loop Bryam Vargas <hexlabsecurity(a)proton.me> apparmor: mediate the implicit connect of TCP fast open sendmsg Yiming Qian <yimingqian591(a)gmail.com> net: skmsg: preserve sg.copy across SG transforms Doruk Tan Ozturk <doruk(a)0sec.ai> mac802154: llsec: add skb_cow_data() before in-place crypto Yuto Ohnuki <ytohnuki(a)amazon.com> ext4: add bounds check for inline data length in ext4_read_inline_page Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> ntfs3: reject direct userspace writes to reserved $LX* xattrs Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: avoid race of cifsnotfound handler state Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: enforce 2-byte alignment Sven Eckelmann <sven(a)narfation.org> batman-adv: dat: prevent false sharing between VLANs Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: track roam count per VID Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: don't merge change entries with different VIDs Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: handle overlapping packets Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: prevent parallel modifications of last_recv Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: restrict number of unacked list entries Sven Eckelmann <sven(a)narfation.org> batman-adv: v: prevent OGM aggregation on disabled hardif Sven Eckelmann <sven(a)narfation.org> batman-adv: frag: avoid underflow of TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: frag: ensure fragment is writable before modifying TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: fix (m|b)cast csum after decrementing TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: ensure bcast is writable before modifying TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: initialize last_recv_time during init Sven Eckelmann <sven(a)narfation.org> batman-adv: prevent ELP transmission interval underflow Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: add only finished tp_vars to lists Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: fix fast recovery precondition Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: avoid window underflow Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: initialize dec_cwnd explicitly Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: initialize dup_acks explicitly Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: keep unacked list in ascending ordered Yu Zhao <yuzhao(a)google.com> mm/mglru: skip special VMAs in lru_gen_look_around() Petr Machata <petrm(a)nvidia.com> Revert "ptp: add testptp mask test" Sean Christopherson <seanjc(a)google.com> KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level Paolo Bonzini <pbonzini(a)redhat.com> KVM: x86: Fix shadow paging use-after-free due to unexpected role Ian Rogers <irogers(a)google.com> perf block-range: Move debug code behind ifndef NDEBUG Ian Rogers <irogers(a)google.com> perf bench: Avoid NDEBUG warning Miklos Szeredi <mszeredi(a)redhat.com> virtiofs: fix UAF on submount umount Ruslan Valiyev <linuxoid(a)gmail.com> media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si Gil Portnoy <dddhkts1(a)gmail.com> ksmbd: reject non-VALID session in compound request branch Yi Yang <yiyang13(a)huawei.com> vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write Florian Westphal <fw(a)strlen.de> netfilter: nf_tables: always walk all pending catchall elements Thadeu Lima de Souza Cascardo <cascardo(a)igalia.com> dlm: prevent NPD when writing a positive value to event_done André Draszik <andre.draszik(a)linaro.org> regulator: core: fix locking in regulator_resolve_supply() error path Bjoern Doebel <doebel(a)amazon.de> ring-buffer: Remove ring_buffer_read_prepare_sync() Jiexun Wang <wangjiexun2025(a)gmail.com> af_unix: Reject SIOCATMARK on non-stream sockets Mingyu Wang <25181214217(a)stu.xidian.edu.cn> agp/amd64: Fix broken error propagation in agp_amd64_probe() Weiming Shi <bestswngs(a)gmail.com> net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() Weiming Shi <bestswngs(a)gmail.com> i2c: stub: Reject I2C block transfers with invalid length Lord Ulf Henrik Holmberg <henrik.holmberg(a)defensify.se> RDMA/bnxt_re: zero shared page before exposing to userspace Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> ARM: fix branch predictor hardening Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> ARM: fix hash_name() fault Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> ARM: allow __do_kernel_fault() to report execution of memory faults Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> ARM: group is_permission_fault() with is_translation_fault() Waiman Long <longman(a)redhat.com> debugobjects: Dont call fill_pool() in early boot hardirq context Helen Koike <koike(a)igalia.com> debugobjects: Do not fill_pool() if pi_blocked_on Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> debugobjects: Use LD_WAIT_CONFIG instead of LD_WAIT_SLEEP Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> debugobjects: Allow to refill the pool before SYSTEM_SCHEDULING Peter Zijlstra <peterz(a)infradead.org> debugobjects,locking: Annotate debug_object_fill_pool() wait type violation Eric Dumazet <edumazet(a)google.com> net: annotate data-races around sk->sk_{data_ready,write_space} Sean Christopherson <seanjc(a)google.com> KVM: nVMX: Fold requested virtual interrupt check into has_nested_events() Sean Christopherson <seanjc(a)google.com> KVM: nVMX: Check for pending posted interrupts when looking for nested events Sean Christopherson <seanjc(a)google.com> KVM: nVMX: Add a helper to get highest pending from Posted Interrupt vector Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: prevent TVLV entry number overflow Maíra Canal <mcanal(a)igalia.com> drm/v3d: Skip CSD when it has zeroed workgroups Maíra Canal <mcanal(a)igalia.com> drm/v3d: Store the active job inside the queue's state Ihor Solodrai <ihor.solodrai(a)pm.me> selftests/bpf: Check for timeout in perf_link test Jiri Olsa <jolsa(a)kernel.org> selftests/bpf: Move get_time_ns to testing_helpers.h Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_tables: unconditionally bump set->nelems before insertion Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_tables: fix set size with rbtree backend Florian Westphal <fw(a)strlen.de> netfilter: nf_tables: always increment set element count Eric Dumazet <edumazet(a)google.com> ip6_vti: set netns_immutable on the fallback device. Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Bound VBIOS record-chain walk loops Sean Christopherson <seanjc(a)google.com> KVM: VMX: Make vmread_error_trampoline() uncallable from C code Hangbin Liu <liuhangbin(a)gmail.com> selftests/bpf: move SYS() macro into the test_progs.h Pedro Tammela <pctammela(a)mojatatu.com> net/sched: act_pedit: free pedit keys on bail from offset check Rajat Gupta <rajat.gupta(a)oss.qualcomm.com> net/sched: fix pedit partial COW leading to page cache corruption Pedro Tammela <pctammela(a)mojatatu.com> net/sched: act_pedit: rate limit datapath messages Pedro Tammela <pctammela(a)mojatatu.com> net/sched: act_pedit: check static offsets a priori Jann Horn <jannh(a)google.com> fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios ------------- Diffstat: Documentation/userspace-api/ioctl/ioctl-number.rst | 463 ++++++++++----------- Makefile | 4 +- arch/arm/mm/alignment.c | 4 + arch/arm/mm/fault.c | 94 ++++- arch/loongarch/kernel/smp.c | 1 + arch/mips/dec/prom/console.c | 7 +- arch/mips/kernel/smp.c | 2 + arch/x86/include/asm/kvm-x86-ops.h | 1 - arch/x86/include/asm/kvm_host.h | 1 - arch/x86/kvm/mmu/mmu.c | 28 +- arch/x86/kvm/svm/sev.c | 1 + arch/x86/kvm/vmx/nested.c | 45 +- arch/x86/kvm/vmx/posted_intr.h | 10 + arch/x86/kvm/vmx/vmenter.S | 2 + arch/x86/kvm/vmx/vmx.c | 21 - arch/x86/kvm/vmx/vmx_ops.h | 18 +- arch/x86/kvm/x86.c | 10 +- drivers/char/agp/amd64-agp.c | 2 +- drivers/crypto/qat/qat_common/adf_cfg_common.h | 32 -- drivers/crypto/qat/qat_common/adf_cfg_user.h | 38 -- drivers/crypto/qat/qat_common/adf_common_drv.h | 3 - drivers/crypto/qat/qat_common/adf_ctl_drv.c | 425 +------------------ drivers/crypto/qat/qat_common/adf_dev_mgr.c | 70 ---- drivers/fpga/of-fpga-region.c | 3 +- drivers/gpu/drm/amd/display/dc/bios/bios_parser.c | 15 +- drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | 27 +- .../drm/amd/display/dc/bios/bios_parser_helper.h | 5 + drivers/gpu/drm/v3d/v3d_drv.h | 8 +- drivers/gpu/drm/v3d/v3d_gem.c | 5 +- drivers/gpu/drm/v3d/v3d_irq.c | 24 +- drivers/gpu/drm/v3d/v3d_sched.c | 36 +- drivers/hv/hv_kvp.c | 25 +- drivers/hv/vmbus_drv.c | 29 +- drivers/i2c/i2c-stub.c | 5 + drivers/infiniband/hw/bnxt_re/ib_verbs.c | 2 +- drivers/irqchip/irq-imgpdc.c | 6 + drivers/media/test-drivers/vidtv/vidtv_mux.c | 8 +- drivers/misc/fastrpc.c | 7 +- drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c | 8 +- drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h | 1 + drivers/net/wan/hdlc_ppp.c | 15 +- drivers/net/wireless/ath/ath11k/dp.c | 1 + drivers/net/wireless/mediatek/mt76/mt76x2/usb.c | 1 + .../net/wireless/realtek/rtlwifi/rtl8821ae/trx.h | 2 +- drivers/ntb/hw/epf/ntb_hw_epf.c | 3 +- drivers/power/reset/linkstation-poweroff.c | 2 +- drivers/regulator/core.c | 10 +- drivers/rpmsg/rpmsg_char.c | 8 + drivers/tty/serial/8250/8250_dw.c | 4 +- drivers/tty/vt/vc_screen.c | 2 +- drivers/video/fbdev/core/fbmem.c | 12 + drivers/video/fbdev/core/modedb.c | 2 +- fs/dlm/lockspace.c | 2 +- fs/exfat/dir.c | 4 +- fs/ext4/inline.c | 8 + fs/f2fs/acl.c | 18 +- fs/f2fs/file.c | 9 +- fs/f2fs/inode.c | 9 +- fs/fuse/dev.c | 23 +- fs/fuse/file.c | 8 +- fs/nfs/pnfs.c | 2 +- fs/nfs/pnfs_nfs.c | 4 +- fs/nfsd/nfs2acl.c | 17 +- fs/nfsd/nfs3acl.c | 17 +- fs/nfsd/nfs4recover.c | 3 +- fs/nfsd/nfs4xdr.c | 3 +- fs/ntfs3/xattr.c | 12 + fs/ocfs2/suballoc.c | 22 + fs/smb/server/smb2pdu.c | 5 + fs/smb/server/smbacl.c | 4 +- include/keys/request_key_auth-type.h | 2 + include/linux/kvm_host.h | 7 +- include/linux/lockdep.h | 14 + include/linux/lockdep_types.h | 1 + include/linux/ring_buffer.h | 4 +- include/linux/skmsg.h | 15 +- include/net/netfilter/nf_tables.h | 6 + include/net/phonet/pn_dev.h | 2 +- include/net/tc_act/tc_pedit.h | 1 - kernel/bpf/cgroup.c | 2 +- kernel/futex/requeue.c | 6 + kernel/locking/lockdep.c | 28 +- kernel/locking/rtmutex.c | 3 + kernel/locking/rtmutex_api.c | 2 +- kernel/trace/ring_buffer.c | 67 +-- kernel/trace/trace.c | 14 +- kernel/trace/trace_kdb.c | 8 +- lib/debugobjects.c | 57 ++- mm/vmscan.c | 13 +- net/9p/client.c | 3 +- net/batman-adv/bat_iv_ogm.c | 11 +- net/batman-adv/bat_v.c | 1 + net/batman-adv/bat_v_ogm.c | 23 +- net/batman-adv/bridge_loop_avoidance.c | 28 +- net/batman-adv/distributed-arp-table.c | 12 +- net/batman-adv/fragmentation.c | 22 +- net/batman-adv/fragmentation.h | 3 +- net/batman-adv/netlink.c | 10 +- net/batman-adv/routing.c | 64 ++- net/batman-adv/tp_meter.c | 115 +++-- net/batman-adv/translation-table.c | 32 +- net/batman-adv/tvlv.c | 69 ++- net/batman-adv/types.h | 21 +- net/core/filter.c | 27 ++ net/core/skmsg.c | 16 +- net/ipv4/tcp.c | 4 +- net/ipv4/tcp_bpf.c | 2 +- net/ipv4/tcp_input.c | 14 +- net/ipv4/tcp_minisocks.c | 2 +- net/ipv4/udp.c | 2 +- net/ipv4/udp_bpf.c | 2 +- net/ipv6/ip6_output.c | 4 +- net/ipv6/ip6_vti.c | 1 + net/mac802154/llsec.c | 14 + net/mptcp/pm_userspace.c | 13 +- net/mptcp/protocol.c | 4 +- net/netfilter/nf_tables_api.c | 74 +++- net/netfilter/nft_set_rbtree.c | 43 ++ net/phonet/pn_dev.c | 12 +- net/phonet/pn_netlink.c | 23 +- net/sched/act_pedit.c | 101 +++-- net/tipc/crypto.c | 9 + net/tls/tls_sw.c | 4 + net/unix/af_unix.c | 11 +- security/apparmor/include/policy_unpack.h | 19 + security/apparmor/lsm.c | 16 +- security/apparmor/policy.c | 8 +- security/keys/internal.h | 2 + security/keys/keyctl.c | 24 +- security/keys/keyctl_pkey.c | 9 +- security/keys/request_key_auth.c | 33 +- tools/perf/bench/find-bit-bench.c | 8 +- tools/perf/util/block-range.c | 6 +- tools/testing/selftests/bpf/bench.h | 9 - tools/testing/selftests/bpf/prog_tests/empty_skb.c | 25 +- .../selftests/bpf/prog_tests/kprobe_multi_test.c | 8 - tools/testing/selftests/bpf/prog_tests/perf_link.c | 15 +- .../testing/selftests/bpf/prog_tests/tc_redirect.c | 154 ++++--- .../testing/selftests/bpf/prog_tests/test_tunnel.c | 71 ++-- .../testing/selftests/bpf/prog_tests/xdp_bonding.c | 38 +- .../selftests/bpf/prog_tests/xdp_do_redirect.c | 30 +- .../selftests/bpf/prog_tests/xdp_synproxy.c | 41 +- tools/testing/selftests/bpf/test_progs.h | 15 + tools/testing/selftests/bpf/testing_helpers.h | 10 + tools/testing/selftests/ptp/testptp.c | 19 +- 145 files changed, 1807 insertions(+), 1529 deletions(-)

3 months, 3 weeks

[PATCH 5.15 00/95] 5.15.211-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 5.15.211 release. There are 95 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat, 04 Jul 2026 15:50:58 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.211-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 5.15.211-rc1 Thadeu Lima de Souza Cascardo <cascardo(a)igalia.com> dlm: prevent NPD when writing a positive value to event_done Giovanni Cabiddu <giovanni.cabiddu(a)intel.com> crypto: qat - remove unused character device and IOCTLs Herbert Xu <herbert(a)gondor.apana.org.au> crypto: qat - Return pointer directly in adf_ctl_alloc_resources Thorsten Blum <thorsten.blum(a)linux.dev> crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() Bagas Sanjaya <bagasdotme(a)gmail.com> Documentation: ioctl-number: Extend "Include File" column width Gil Portnoy <dddhkts1(a)gmail.com> ksmbd: reject non-VALID session in compound request branch Joanne Koong <joannelkoong(a)gmail.com> fuse: re-lock request before replacing page cache folio Santosh Kalluri <santosh.kalluri129(a)gmail.com> net: phonet: free phonet_device after RCU grace period Kuniyuki Iwashima <kuniyu(a)amazon.com> phonet: Pass net and ifindex to phonet_address_notify(). Kuniyuki Iwashima <kuniyu(a)amazon.com> phonet: Pass ifindex to fill_addr(). Dexuan Cui <decui(a)microsoft.com> Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs Mukesh Ojha <mukesh.ojha(a)oss.qualcomm.com> misc: fastrpc: Fix NULL pointer dereference in rpmsg callback Abel Vesa <abel.vesa(a)linaro.org> misc: fastrpc: Add dma_mask to fastrpc_channel_ctx Thorsten Blum <thorsten.blum(a)linux.dev> hv: utils: handle and propagate errors in kvp_register Paolo Abeni <pabeni(a)redhat.com> mptcp: fix missing wakeups in edge scenarios Michael Bommarito <michael.bommarito(a)gmail.com> NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr Dominik Woźniak <stalion(a)gmail.com> nfsd: check get_user() return when reading princhashlen Jeff Layton <jlayton(a)kernel.org> nfsd: fix posix_acl leak on SETACL decode failure Guannan Wang <wgnbuaa(a)gmail.com> NFSD: Fix SECINFO_NO_NAME decode error cleanup Steffen Persvold <spersvold(a)gmail.com> fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode Ian Bridges <icb(a)fastmail.org> fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var Wentao Liang <vulab(a)iscas.ac.cn> power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() Ashutosh Desai <ashutoshdesai993(a)gmail.com> KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path Zhang Cen <rollkingzzc(a)gmail.com> ocfs2: reject oversized group bitmap descriptors Wentao Liang <vulab(a)iscas.ac.cn> fpga: region: fix use-after-free in child_regions_with_firmware() Qingshuang Fu <fuqingshuang(a)kylinos.cn> irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove Wentao Liang <vulab(a)iscas.ac.cn> pNFS: Fix use-after-free in pnfs_update_layout() Doruk Tan Ozturk <doruk(a)0sec.ai> tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done Fan Wu <fanwu01(a)zju.edu.cn> hdlc_ppp: sync per-proto timers before freeing hdlc state Michael Bommarito <michael.bommarito(a)gmail.com> exfat: fix potential use-after-free in exfat_find_dir_entry() Maciej W. Rozycki <macro(a)orcam.me.uk> MIPS: DEC: Prevent initial console buffer from landing in XKPHYS Dawei Feng <dawei.feng(a)seu.edu.cn> bpf: use kvfree() for replaced sysctl write buffer Zhang Cen <rollkingzzc(a)gmail.com> f2fs: validate ACL entry sizes in f2fs_acl_from_disk() Bitterblue Smith <rtl8821cerfe2(a)gmail.com> wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor Jose Ignacio Tornos Martinez <jtornosm(a)redhat.com> wifi: ath11k: fix warning when unbinding Zenm Chen <zenmchen(a)gmail.com> wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S Shaomin Chen <eeesssooo020(a)gmail.com> keys: Pin request_key_auth payload in instantiate paths Jarkko Sakkinen <jarkko(a)kernel.org> KEYS: fix overflow in keyctl_pkey_params_get_2() Doruk Tan Ozturk <doruk(a)0sec.ai> mac802154: llsec: add skb_cow_data() before in-place crypto Herbert Xu <herbert(a)gondor.apana.org.au> crypto: af_alg - Set merge to zero early in af_alg_sendmsg Yuto Ohnuki <ytohnuki(a)amazon.com> ext4: add bounds check for inline data length in ext4_read_inline_page Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> ntfs3: reject direct userspace writes to reserved $LX* xattrs Bjoern Doebel <doebel(a)amazon.de> ring-buffer: Remove ring_buffer_read_prepare_sync() Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: avoid race of cifsnotfound handler state Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: enforce 2-byte alignment Sven Eckelmann <sven(a)narfation.org> batman-adv: dat: prevent false sharing between VLANs Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: track roam count per VID Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: don't merge change entries with different VIDs Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: handle overlapping packets Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: prevent parallel modifications of last_recv Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: restrict number of unacked list entries Sven Eckelmann <sven(a)narfation.org> batman-adv: v: prevent OGM aggregation on disabled hardif Sven Eckelmann <sven(a)narfation.org> batman-adv: frag: avoid underflow of TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: frag: ensure fragment is writable before modifying TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: fix (m|b)cast csum after decrementing TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: ensure bcast is writable before modifying TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: initialize last_recv_time during init Sven Eckelmann <sven(a)narfation.org> batman-adv: prevent ELP transmission interval underflow Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: add only finished tp_vars to lists Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: fix fast recovery precondition Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: avoid window underflow Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: initialize dec_cwnd explicitly Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: initialize dup_acks explicitly Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: keep unacked list in ascending ordered Yijia Wang <wangyijia.yeah(a)bytedance.com> kselftest/arm64: signal: Skip SVE signal test if not enough VLs supported Sean Christopherson <seanjc(a)google.com> KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level Petr Machata <petrm(a)nvidia.com> Revert "ptp: add testptp mask test" Petr Machata <petrm(a)nvidia.com> Revert "selftest/ptp: update ptp selftest to exercise the gettimex options" Miklos Szeredi <mszeredi(a)redhat.com> virtiofs: fix UAF on submount umount Ruslan Valiyev <linuxoid(a)gmail.com> media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si Yi Yang <yiyang13(a)huawei.com> vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write André Draszik <andre.draszik(a)linaro.org> regulator: core: fix locking in regulator_resolve_supply() error path Jiexun Wang <wangjiexun2025(a)gmail.com> af_unix: Reject SIOCATMARK on non-stream sockets Mathias Nyman <mathias.nyman(a)linux.intel.com> xhci: fix memory leak regression when freeing xhci vdev devices depth first Mingyu Wang <25181214217(a)stu.xidian.edu.cn> agp/amd64: Fix broken error propagation in agp_amd64_probe() Weiming Shi <bestswngs(a)gmail.com> net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() Weiming Shi <bestswngs(a)gmail.com> i2c: stub: Reject I2C block transfers with invalid length Lord Ulf Henrik Holmberg <henrik.holmberg(a)defensify.se> RDMA/bnxt_re: zero shared page before exposing to userspace Jiacheng Shi <billsjc(a)sjtu.edu.cn> vfio/iommu_type1: replace kfree with kvfree Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: light: bh1780: fix PM runtime leak on error path Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: prevent TVLV entry number overflow Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: reject oversized local TVLV buffers Maíra Canal <mcanal(a)igalia.com> drm/v3d: Skip CSD when it has zeroed workgroups Maíra Canal <mcanal(a)igalia.com> drm/v3d: Store the active job inside the queue's state Eric Dumazet <edumazet(a)google.com> ip6_vti: set netns_immutable on the fallback device. Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Bound VBIOS record-chain walk loops Pedro Tammela <pctammela(a)mojatatu.com> net/sched: act_pedit: free pedit keys on bail from offset check Rajat Gupta <rajat.gupta(a)oss.qualcomm.com> net/sched: fix pedit partial COW leading to page cache corruption Pedro Tammela <pctammela(a)mojatatu.com> net/sched: act_pedit: rate limit datapath messages Pedro Tammela <pctammela(a)mojatatu.com> net/sched: act_pedit: check static offsets a priori Jann Horn <jannh(a)google.com> fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios ------------- Diffstat: Documentation/userspace-api/ioctl/ioctl-number.rst | 447 ++++++++++----------- Makefile | 4 +- arch/mips/dec/prom/console.c | 7 +- arch/x86/kvm/mmu/mmu.c | 19 +- arch/x86/kvm/svm/sev.c | 1 + crypto/af_alg.c | 2 + drivers/char/agp/amd64-agp.c | 2 +- drivers/crypto/qat/qat_common/adf_cfg_common.h | 32 -- drivers/crypto/qat/qat_common/adf_cfg_user.h | 38 -- drivers/crypto/qat/qat_common/adf_common_drv.h | 3 - drivers/crypto/qat/qat_common/adf_ctl_drv.c | 421 +------------------ drivers/crypto/qat/qat_common/adf_dev_mgr.c | 70 ---- drivers/fpga/of-fpga-region.c | 3 +- drivers/gpu/drm/amd/display/dc/bios/bios_parser.c | 15 +- drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | 15 +- .../drm/amd/display/dc/bios/bios_parser_helper.h | 5 + drivers/gpu/drm/v3d/v3d_drv.h | 8 +- drivers/gpu/drm/v3d/v3d_gem.c | 5 +- drivers/gpu/drm/v3d/v3d_irq.c | 24 +- drivers/gpu/drm/v3d/v3d_sched.c | 36 +- drivers/hv/hv_kvp.c | 25 +- drivers/hv/vmbus_drv.c | 56 ++- drivers/i2c/i2c-stub.c | 5 + drivers/iio/light/bh1780.c | 4 +- drivers/infiniband/hw/bnxt_re/ib_verbs.c | 2 +- drivers/irqchip/irq-imgpdc.c | 6 + drivers/media/test-drivers/vidtv/vidtv_mux.c | 8 +- drivers/misc/fastrpc.c | 7 +- drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c | 8 +- drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h | 1 + drivers/net/wan/hdlc_ppp.c | 15 +- drivers/net/wireless/ath/ath11k/dp.c | 1 + drivers/net/wireless/mediatek/mt76/mt76x2/usb.c | 1 + .../net/wireless/realtek/rtlwifi/rtl8821ae/trx.h | 2 +- drivers/power/reset/linkstation-poweroff.c | 2 +- drivers/regulator/core.c | 10 +- drivers/tty/vt/vc_screen.c | 2 +- drivers/usb/host/xhci-mem.c | 2 +- drivers/vfio/vfio_iommu_type1.c | 2 +- drivers/video/fbdev/core/fbmem.c | 12 + drivers/video/fbdev/core/modedb.c | 2 +- fs/dlm/lockspace.c | 2 +- fs/exfat/dir.c | 4 +- fs/ext4/inline.c | 8 + fs/f2fs/acl.c | 18 +- fs/fuse/dev.c | 23 +- fs/fuse/file.c | 8 +- fs/ksmbd/smb2pdu.c | 5 + fs/nfs/pnfs.c | 2 +- fs/nfs/pnfs_nfs.c | 4 +- fs/nfsd/nfs2acl.c | 17 +- fs/nfsd/nfs3acl.c | 17 +- fs/nfsd/nfs4recover.c | 3 +- fs/nfsd/nfs4xdr.c | 3 +- fs/ntfs3/xattr.c | 12 + fs/ocfs2/suballoc.c | 22 + include/keys/request_key_auth-type.h | 2 + include/linux/kvm_host.h | 7 +- include/linux/ring_buffer.h | 4 +- include/net/phonet/pn_dev.h | 2 +- include/net/tc_act/tc_pedit.h | 1 - kernel/bpf/cgroup.c | 2 +- kernel/trace/ring_buffer.c | 74 +--- kernel/trace/trace.c | 14 +- kernel/trace/trace_kdb.c | 8 +- net/batman-adv/bat_iv_ogm.c | 11 +- net/batman-adv/bat_v.c | 1 + net/batman-adv/bat_v_ogm.c | 23 +- net/batman-adv/bridge_loop_avoidance.c | 28 +- net/batman-adv/distributed-arp-table.c | 12 +- net/batman-adv/fragmentation.c | 22 +- net/batman-adv/fragmentation.h | 3 +- net/batman-adv/netlink.c | 10 +- net/batman-adv/routing.c | 64 ++- net/batman-adv/tp_meter.c | 115 ++++-- net/batman-adv/translation-table.c | 40 +- net/batman-adv/tvlv.c | 69 +++- net/batman-adv/types.h | 21 +- net/ipv6/ip6_vti.c | 1 + net/mac802154/llsec.c | 14 + net/mptcp/protocol.c | 4 +- net/phonet/pn_dev.c | 12 +- net/phonet/pn_netlink.c | 23 +- net/sched/act_pedit.c | 101 +++-- net/tipc/crypto.c | 9 + net/unix/af_unix.c | 3 + security/keys/internal.h | 2 + security/keys/keyctl.c | 24 +- security/keys/keyctl_pkey.c | 9 +- security/keys/request_key_auth.c | 33 +- .../testcases/fake_sigreturn_sve_change_vl.c | 2 + tools/testing/selftests/ptp/testptp.c | 79 +--- 92 files changed, 1104 insertions(+), 1223 deletions(-)

3 months, 3 weeks

[PATCH 7.1 000/120] 7.1.3-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 7.1.3 release. There are 120 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat, 04 Jul 2026 15:50:58 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.1.3-rc1.… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.1.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 7.1.3-rc1 John Johansen <john.johansen(a)canonical.com> apparmor: advertise the tcp fast open fix is applied HanQuan <eilaimemedsnaimel(a)gmail.com> net/tcp-ao: fix use-after-free of key in del_async path Hem Parekh <hemparekh1596(a)gmail.com> ksmbd: fix out-of-bounds read in smb_check_perm_dacl() Markus Elfring <elfring(a)users.sourceforge.net> NFS: Prevent resource leak in nfs_alloc_server() Igor Raits <igor.raits(a)gmail.com> NFSv4: clear exception state on successful mkdir retry Michael Bommarito <michael.bommarito(a)gmail.com> NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr Michael Bommarito <michael.bommarito(a)gmail.com> NFSv4/flexfiles: reject zero filehandle version count Jeff Layton <jlayton(a)kernel.org> nfsd: reset write verifier on deferred writeback errors Jeff Layton <jlayton(a)kernel.org> nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race Jeff Layton <jlayton(a)kernel.org> nfsd: fix dead ACL conflict guard in nfsd4_create Dominik Woźniak <stalion(a)gmail.com> nfsd: check get_user() return when reading princhashlen Jeff Layton <jlayton(a)kernel.org> nfsd: fix posix_acl leak and ignored error in nfsd4_create_file Jeff Layton <jlayton(a)kernel.org> nfsd: fix inverted cp_ttl check in async copy reaper Jeff Layton <jlayton(a)kernel.org> nfsd: fix posix_acl leak on SETACL decode failure Guannan Wang <wgnbuaa(a)gmail.com> NFSD: Fix SECINFO_NO_NAME decode error cleanup Chris Mason <clm(a)meta.com> nfsd: release layout stid on setlease failure Johan Hovold <johan(a)kernel.org> i2c: core: fix adapter registration race Steffen Persvold <spersvold(a)gmail.com> fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode Tuo Li <islituo(a)gmail.com> fbdev: modedb: fix a possible UAF in fb_find_mode() Hongling Zeng <zenghongling(a)kylinos.cn> fbdev: omap2: fix use-after-free in omapfb_mmap Mingyu Wang <25181214217(a)stu.xidian.edu.cn> fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font() Ian Bridges <icb(a)fastmail.org> fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var Hyunchul Lee <hyc.lee(a)gmail.com> ntfs: serialize volume label accesses Vivian Wang <wangruikang(a)iscas.ac.cn> riscv: kfence: Call mark_new_valid_map() for kfence_unprotect() Wentao Liang <vulab(a)iscas.ac.cn> power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() Ashutosh Desai <ashutoshdesai993(a)gmail.com> KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path Hyunwoo Kim <imv4bel(a)gmail.com> KVM: x86: hyper-v: Bound the bank index when querying sparse banks Jonas Jelonek <jelonek.jonas(a)gmail.com> MIPS: smp: report dying CPU to RCU in stop_this_cpu() Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> 9p: avoid putting oldfid in p9_client_walk() error path Zhang Cen <rollkingzzc(a)gmail.com> ocfs2: reject oversized group bitmap descriptors Yuho Choi <dbgh9129(a)gmail.com> rpmsg: char: Fix use-after-free on probe error path Wentao Liang <vulab(a)iscas.ac.cn> fpga: region: fix use-after-free in child_regions_with_firmware() Qingshuang Fu <fuqingshuang(a)kylinos.cn> irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove Rik van Riel <riel(a)surriel.com> sched/mmcid: Fix OOB clear_bit when CID is MM_CID_UNSET in fixup path Wentao Liang <vulab(a)iscas.ac.cn> pNFS: Fix use-after-free in pnfs_update_layout() Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Report dying CPU to RCU in stop_this_cpu() Doruk Tan Ozturk <doruk(a)0sec.ai> tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done Michal Koutný <mkoutny(a)suse.com> blk-cgroup: fix UAF in __blkcg_rstat_flush() Fan Wu <fanwu01(a)zju.edu.cn> hdlc_ppp: sync per-proto timers before freeing hdlc state Wentao Liang <vulab(a)iscas.ac.cn> pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next() Tristan Madani <tristan(a)talencesecurity.com> gfs2: fix use-after-free in gfs2_qd_dealloc Sam James <sam(a)gentoo.org> crypto: nx - fix nx_crypto_ctx_exit argument Sean Christopherson <seanjc(a)google.com> KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() Sean Christopherson <seanjc(a)google.com> KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level Michael Bommarito <michael.bommarito(a)gmail.com> exfat: fix potential use-after-free in exfat_find_dir_entry() Maciej W. Rozycki <macro(a)orcam.me.uk> MIPS: DEC: Prevent initial console buffer from landing in XKPHYS Dawei Feng <dawei.feng(a)seu.edu.cn> bpf: use kvfree() for replaced sysctl write buffer Denis Arefev <arefev(a)swemel.ru> block: Avoid mounting the bdev pseudo-filesystem in userspace Mikhail Lobanov <m.lobanov(a)rosa.ru> f2fs: read COW data with the original inode during atomic write Wenjie Qi <qwjhust(a)gmail.com> f2fs: keep atomic write retry from zeroing original data Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node() Zhaoyang Huang <zhaoyang.huang(a)unisoc.com> Revert "f2fs: remove non-uptodate folio from the page cache in move_data_block" Zhang Cen <rollkingzzc(a)gmail.com> f2fs: validate ACL entry sizes in f2fs_acl_from_disk() Bryam Vargas <hexlabsecurity(a)proton.me> f2fs: bound i_inline_xattr_size for non-inline-xattr inodes Sunmin Jeong <s_min.jeong(a)samsung.com> f2fs: fix to round down start offset of fallocate for pin file Chao Yu <chao(a)kernel.org> f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode Wenjie Qi <qwjhust(a)gmail.com> f2fs: validate compress cache inode only when enabled Wenjie Qi <qwjhust(a)gmail.com> f2fs: validate orphan inode entry count Chao Yu <chao(a)kernel.org> f2fs: fix to do sanity check on f2fs_get_node_folio_ra() Wenjie Qi <qwjhust(a)gmail.com> f2fs: reject setattr size changes on large folio files Wenjie Qi <qwjhust(a)gmail.com> f2fs: pass correct iostat type for single node writes Wenjie Qi <qiwenjie(a)xiaomi.com> f2fs: fix missing read bio submission on large folio error Junrui Luo <moonafterrain(a)outlook.com> wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers Junjie Cao <junjie.cao(a)intel.com> wifi: iwlwifi: mld: fix race condition in PTP removal Junjie Cao <junjie.cao(a)intel.com> wifi: iwlwifi: mvm: fix race condition in PTP removal Luka Gejak <luka.gejak(a)linux.dev> wifi: rtw88: usb: fix memory leaks on USB write failures Luka Gejak <luka.gejak(a)linux.dev> wifi: rtw88: increase TX report timeout to fix race condition Bitterblue Smith <rtl8821cerfe2(a)gmail.com> wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor Bitterblue Smith <rtl8821cerfe2(a)gmail.com> wifi: rtl8xxxu: Detect the maximum supported channel width Jose Ignacio Tornos Martinez <jtornosm(a)redhat.com> wifi: ath11k: fix warning when unbinding ElXreno <elxreno(a)gmail.com> wifi: mt76: mt7925: don't disable AP BSS when removing TDLS peer Zenm Chen <zenmchen(a)gmail.com> wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S Kiryl Shutsemau (Meta) <kas(a)kernel.org> userfaultfd: build __VMA_UFFD_FLAGS from config-gated masks Mike Rapoport (Microsoft) <rppt(a)kernel.org> userfaultfd: ensure mremap_userfaultfd_fail() releases mmap_changing Shaomin Chen <eeesssooo020(a)gmail.com> keys: Pin request_key_auth payload in instantiate paths Jarkko Sakkinen <jarkko(a)kernel.org> KEYS: fix overflow in keyctl_pkey_params_get_2() Konstantin Khorenko <khorenko(a)virtuozzo.com> gcov: use atomic counter updates to fix concurrent access crashes Arnd Bergmann <arnd(a)arndb.de> err.h: use __always_inline on all error pointer helpers Ard Biesheuvel <ardb(a)kernel.org> KVM: arm64: Omit tag sync on stage-2 mappings of the zero page Usama Arif <usama.arif(a)linux.dev> block: invalidate cached plug timestamp after task switch Eric Biggers <ebiggers(a)kernel.org> fscrypt: Fix key setup in edge case with multiple data unit sizes Ian Bridges <icb(a)fastmail.org> fbdev: fix use-after-free in store_modes() Koichiro Den <den(a)valinux.co.jp> NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR Ruslan Valiyev <linuxoid(a)gmail.com> apparmor: fix use-after-free in rawdata dedup loop Bryam Vargas <hexlabsecurity(a)proton.me> apparmor: mediate the implicit connect of TCP fast open sendmsg Lukas Wunner <lukas(a)wunner.de> PCI/P2PDMA: Add Intel QAT, DSA, IAA devices to whitelist Maoyi Xie <maoyixie.tju(a)gmail.com> net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink Yiming Qian <yimingqian591(a)gmail.com> net: skmsg: preserve sg.copy across SG transforms Doruk Tan Ozturk <doruk(a)0sec.ai> mac802154: llsec: add skb_cow_data() before in-place crypto Jiajia Liu <liujiajia(a)kylinos.cn> wifi: mt76: add wcid publish check in mt76_sta_add Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> ntfs3: reject direct userspace writes to reserved $LX* xattrs Wongi Lee <qw3rtyp0(a)gmail.com> ipv4: account for fraggap on the paged allocation path Wongi Lee <qw3rtyp0(a)gmail.com> ipv6: account for fraggap on the paged allocation path Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: avoid race of cifsnotfound handler state Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: enforce 2-byte alignment Sven Eckelmann <sven(a)narfation.org> batman-adv: dat: prevent false sharing between VLANs Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: track roam count per VID Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: don't merge change entries with different VIDs Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: handle overlapping packets Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: prevent parallel modifications of last_recv Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: restrict number of unacked list entries Sven Eckelmann <sven(a)narfation.org> batman-adv: v: prevent OGM aggregation on disabled hardif Sven Eckelmann <sven(a)narfation.org> batman-adv: frag: avoid underflow of TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: frag: ensure fragment is writable before modifying TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: fix (m|b)cast csum after decrementing TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: ensure bcast is writable before modifying TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: gw: don't deselect gateway with active hardif Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: initialize last_recv_time during init Sven Eckelmann <sven(a)narfation.org> batman-adv: prevent ELP transmission interval underflow Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: add only finished tp_vars to lists Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: fix fast recovery precondition Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: avoid window underflow Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: initialize dec_cwnd explicitly Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: initialize dup_acks explicitly Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: keep unacked list in ascending ordered Paolo Bonzini <pbonzini(a)redhat.com> KVM: x86: Fix shadow paging use-after-free due to unexpected role ------------- Diffstat: Makefile | 31 ++++-- arch/arm64/kvm/mmu.c | 5 + arch/loongarch/kernel/smp.c | 1 + arch/mips/dec/prom/console.c | 7 +- arch/mips/kernel/smp.c | 2 + arch/riscv/include/asm/kfence.h | 7 +- arch/riscv/kernel/entry.S | 6 +- arch/x86/kvm/hyperv.c | 5 + arch/x86/kvm/mmu/mmu.c | 28 +++-- arch/x86/kvm/svm/sev.c | 1 + block/bdev.c | 5 - block/blk-cgroup.c | 21 ++-- .../intel/qat/qat_common/adf_accel_devices.h | 5 - drivers/crypto/nx/nx.c | 6 +- drivers/crypto/nx/nx.h | 2 +- drivers/dma/idxd/registers.h | 3 - drivers/fpga/of-fpga-region.c | 3 +- drivers/i2c/i2c-core-base.c | 8 +- drivers/irqchip/irq-imgpdc.c | 6 ++ drivers/net/wan/hdlc_ppp.c | 15 ++- drivers/net/wireless/ath/ath11k/dp.c | 1 + drivers/net/wireless/intel/iwlwifi/mld/agg.c | 9 ++ drivers/net/wireless/intel/iwlwifi/mld/ptp.c | 2 +- drivers/net/wireless/intel/iwlwifi/mvm/ptp.c | 2 +- drivers/net/wireless/mediatek/mt76/mac80211.c | 15 ++- drivers/net/wireless/mediatek/mt76/mt76x2/usb.c | 1 + drivers/net/wireless/mediatek/mt76/mt7925/main.c | 3 + drivers/net/wireless/realtek/rtl8xxxu/8188e.c | 1 + drivers/net/wireless/realtek/rtl8xxxu/8188f.c | 1 + drivers/net/wireless/realtek/rtl8xxxu/8192c.c | 1 + drivers/net/wireless/realtek/rtl8xxxu/8192e.c | 1 + drivers/net/wireless/realtek/rtl8xxxu/8192f.c | 1 + drivers/net/wireless/realtek/rtl8xxxu/8710b.c | 1 + drivers/net/wireless/realtek/rtl8xxxu/8723a.c | 1 + drivers/net/wireless/realtek/rtl8xxxu/8723b.c | 1 + drivers/net/wireless/realtek/rtl8xxxu/core.c | 64 ++++++++++- drivers/net/wireless/realtek/rtl8xxxu/regs.h | 2 + drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h | 7 ++ .../net/wireless/realtek/rtlwifi/rtl8821ae/trx.h | 2 +- drivers/net/wireless/realtek/rtw88/tx.c | 7 +- drivers/net/wireless/realtek/rtw88/usb.c | 13 ++- drivers/ntb/hw/epf/ntb_hw_epf.c | 3 +- drivers/pci/p2pdma.c | 10 ++ drivers/power/reset/linkstation-poweroff.c | 2 +- drivers/power/sequencing/core.c | 14 ++- drivers/rpmsg/rpmsg_char.c | 15 ++- drivers/video/fbdev/core/fbcon.c | 7 ++ drivers/video/fbdev/core/fbmem.c | 12 +++ drivers/video/fbdev/core/fbsysfs.c | 10 +- drivers/video/fbdev/core/modedb.c | 5 +- drivers/video/fbdev/omap2/omapfb/omapfb-main.c | 9 +- fs/crypto/fscrypt_private.h | 52 +++++---- fs/crypto/inline_crypt.c | 8 +- fs/crypto/keyring.c | 23 ++-- fs/crypto/keysetup.c | 118 +++++++++++++-------- fs/exfat/dir.c | 4 +- fs/f2fs/acl.c | 18 +++- fs/f2fs/checkpoint.c | 14 ++- fs/f2fs/data.c | 49 +++++---- fs/f2fs/extent_cache.c | 19 ++-- fs/f2fs/f2fs.h | 1 + fs/f2fs/file.c | 11 +- fs/f2fs/gc.c | 56 +++++++--- fs/f2fs/inode.c | 26 +++-- fs/f2fs/node.c | 8 +- fs/gfs2/super.c | 1 + fs/nfs/client.c | 1 + fs/nfs/flexfilelayout/flexfilelayout.c | 4 + fs/nfs/nfs4proc.c | 5 +- fs/nfs/pnfs.c | 2 +- fs/nfs/pnfs_nfs.c | 4 +- fs/nfsd/nfs2acl.c | 17 ++- fs/nfsd/nfs3acl.c | 17 ++- fs/nfsd/nfs4layouts.c | 12 +-- fs/nfsd/nfs4proc.c | 19 ++-- fs/nfsd/nfs4recover.c | 3 +- fs/nfsd/nfs4state.c | 1 + fs/nfsd/nfs4xdr.c | 3 +- fs/nfsd/vfs.c | 6 +- fs/ntfs/file.c | 17 ++- fs/ntfs/super.c | 21 ++-- fs/ntfs/volume.h | 2 + fs/ntfs3/xattr.c | 12 +++ fs/ocfs2/suballoc.c | 22 ++++ fs/smb/server/smbacl.c | 4 +- fs/userfaultfd.c | 2 + include/keys/request_key_auth-type.h | 2 + include/linux/blkdev.h | 16 ++- include/linux/err.h | 12 +-- include/linux/f2fs_fs.h | 1 + include/linux/kvm_host.h | 7 +- include/linux/mm.h | 39 +++++++ include/linux/pci_ids.h | 8 ++ include/linux/skmsg.h | 15 ++- include/linux/userfaultfd_k.h | 4 +- include/net/rtnetlink.h | 2 + kernel/bpf/cgroup.c | 2 +- kernel/sched/core.c | 27 +++-- net/9p/client.c | 3 +- net/batman-adv/bat_iv_ogm.c | 11 +- net/batman-adv/bat_v.c | 1 + net/batman-adv/bat_v_ogm.c | 23 +++- net/batman-adv/bridge_loop_avoidance.c | 28 ++--- net/batman-adv/distributed-arp-table.c | 12 ++- net/batman-adv/fragmentation.c | 22 +++- net/batman-adv/fragmentation.h | 3 +- net/batman-adv/hard-interface.c | 28 +---- net/batman-adv/netlink.c | 10 +- net/batman-adv/routing.c | 73 ++++++++++++- net/batman-adv/tp_meter.c | 115 +++++++++++++------- net/batman-adv/translation-table.c | 12 ++- net/batman-adv/tvlv.c | 69 ++++++++++-- net/batman-adv/types.h | 21 ++-- net/core/filter.c | 27 +++++ net/core/rtnetlink.c | 8 ++ net/core/skmsg.c | 2 + net/ipv4/ip_gre.c | 6 ++ net/ipv4/ip_output.c | 7 +- net/ipv4/tcp_ao.c | 4 + net/ipv6/ip6_output.c | 9 +- net/mac802154/llsec.c | 14 +++ net/tipc/crypto.c | 9 ++ net/tls/tls_sw.c | 4 + security/apparmor/include/policy_unpack.h | 19 ++++ security/apparmor/lsm.c | 16 ++- security/apparmor/net.c | 2 + security/apparmor/policy.c | 8 +- security/keys/internal.h | 2 + security/keys/keyctl.c | 24 +++-- security/keys/keyctl_pkey.c | 9 +- security/keys/request_key_auth.c | 33 +++++- virt/kvm/eventfd.c | 12 +-- 132 files changed, 1312 insertions(+), 441 deletions(-)

3 months, 3 weeks

[PATCH 5.10 00/96] 5.10.260-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 5.10.260 release. There are 96 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat, 04 Jul 2026 15:50:58 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.260-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 5.10.260-rc1 Miklos Szeredi <mszeredi(a)redhat.com> virtiofs: fix UAF on submount umount Junrui Luo <moonafterrain(a)outlook.com> misc: fastrpc: fix DMA address corruption due to find_vma misuse Lad Prabhakar <prabhakar.mahadev-lad.rj(a)bp.renesas.com> mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC Santosh Kalluri <santosh.kalluri129(a)gmail.com> net: phonet: free phonet_device after RCU grace period Kuniyuki Iwashima <kuniyu(a)amazon.com> phonet: Pass net and ifindex to phonet_address_notify(). Kuniyuki Iwashima <kuniyu(a)amazon.com> phonet: Pass ifindex to fill_addr(). Dexuan Cui <decui(a)microsoft.com> Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs Mukesh Ojha <mukesh.ojha(a)oss.qualcomm.com> misc: fastrpc: Fix NULL pointer dereference in rpmsg callback Abel Vesa <abel.vesa(a)linaro.org> misc: fastrpc: Add dma_mask to fastrpc_channel_ctx Paolo Abeni <pabeni(a)redhat.com> mptcp: fix missing wakeups in edge scenarios Thorsten Blum <thorsten.blum(a)linux.dev> hv: utils: handle and propagate errors in kvp_register Kyle Meyer <kyle.meyer(a)hpe.com> bnxt_en: Fix NULL pointer dereference Michael Chan <michael.chan(a)broadcom.com> bnxt_en: Modify bnxt_disable_int_sync() to be called more than once. Yongchao Wu <yongchao.wu(a)autochips.com> usb: cdns3: gadget: fix NULL pointer dereference in ep_queue Thadeu Lima de Souza Cascardo <cascardo(a)igalia.com> dlm: prevent NPD when writing a positive value to event_done Dominik Woźniak <stalion(a)gmail.com> nfsd: check get_user() return when reading princhashlen Jeff Layton <jlayton(a)kernel.org> nfsd: fix posix_acl leak on SETACL decode failure Guannan Wang <wgnbuaa(a)gmail.com> NFSD: Fix SECINFO_NO_NAME decode error cleanup Steffen Persvold <spersvold(a)gmail.com> fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode Ian Bridges <icb(a)fastmail.org> fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var Ashutosh Desai <ashutoshdesai993(a)gmail.com> KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path Zhang Cen <rollkingzzc(a)gmail.com> ocfs2: reject oversized group bitmap descriptors Wentao Liang <vulab(a)iscas.ac.cn> fpga: region: fix use-after-free in child_regions_with_firmware() Qingshuang Fu <fuqingshuang(a)kylinos.cn> irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove Wentao Liang <vulab(a)iscas.ac.cn> pNFS: Fix use-after-free in pnfs_update_layout() Doruk Tan Ozturk <doruk(a)0sec.ai> tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done Michael Bommarito <michael.bommarito(a)gmail.com> exfat: fix potential use-after-free in exfat_find_dir_entry() Maciej W. Rozycki <macro(a)orcam.me.uk> MIPS: DEC: Prevent initial console buffer from landing in XKPHYS Dawei Feng <dawei.feng(a)seu.edu.cn> bpf: use kvfree() for replaced sysctl write buffer Zhang Cen <rollkingzzc(a)gmail.com> f2fs: validate ACL entry sizes in f2fs_acl_from_disk() Bitterblue Smith <rtl8821cerfe2(a)gmail.com> wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor Jose Ignacio Tornos Martinez <jtornosm(a)redhat.com> wifi: ath11k: fix warning when unbinding Zenm Chen <zenmchen(a)gmail.com> wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S Shaomin Chen <eeesssooo020(a)gmail.com> keys: Pin request_key_auth payload in instantiate paths Jarkko Sakkinen <jarkko(a)kernel.org> KEYS: fix overflow in keyctl_pkey_params_get_2() Doruk Tan Ozturk <doruk(a)0sec.ai> mac802154: llsec: add skb_cow_data() before in-place crypto Kevin Hao <haokexin(a)gmail.com> net: cpsw_new: Fix potential unregister of netdev that has not been registered yet Herbert Xu <herbert(a)gondor.apana.org.au> crypto: af_alg - Set merge to zero early in af_alg_sendmsg Yuto Ohnuki <ytohnuki(a)amazon.com> ext4: add bounds check for inline data length in ext4_read_inline_page Bjoern Doebel <doebel(a)amazon.de> ring-buffer: Remove ring_buffer_read_prepare_sync() Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: avoid race of cifsnotfound handler state Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: enforce 2-byte alignment Sven Eckelmann <sven(a)narfation.org> batman-adv: dat: prevent false sharing between VLANs Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: track roam count per VID Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: don't merge change entries with different VIDs Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: handle overlapping packets Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: prevent parallel modifications of last_recv Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: restrict number of unacked list entries Sven Eckelmann <sven(a)narfation.org> batman-adv: v: prevent OGM aggregation on disabled hardif Sven Eckelmann <sven(a)narfation.org> batman-adv: frag: avoid underflow of TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: frag: ensure fragment is writable before modifying TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: initialize last_recv_time during init Sven Eckelmann <sven(a)narfation.org> batman-adv: prevent ELP transmission interval underflow Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: add only finished tp_vars to lists Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: fix fast recovery precondition Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: avoid window underflow Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: initialize dec_cwnd explicitly Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: initialize dup_acks explicitly Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: keep unacked list in ascending ordered Pedro Tammela <pctammela(a)mojatatu.com> net/sched: act_pedit: fix action bind logic Giovanni Cabiddu <giovanni.cabiddu(a)intel.com> crypto: qat - remove unused character device and IOCTLs Herbert Xu <herbert(a)gondor.apana.org.au> crypto: qat - Return pointer directly in adf_ctl_alloc_resources Thorsten Blum <thorsten.blum(a)linux.dev> crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() Bagas Sanjaya <bagasdotme(a)gmail.com> Documentation: ioctl-number: Extend "Include File" column width Ruslan Valiyev <linuxoid(a)gmail.com> media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si Yi Yang <yiyang13(a)huawei.com> vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write André Draszik <andre.draszik(a)linaro.org> regulator: core: fix locking in regulator_resolve_supply() error path Mingyu Wang <25181214217(a)stu.xidian.edu.cn> agp/amd64: Fix broken error propagation in agp_amd64_probe() Weiming Shi <bestswngs(a)gmail.com> net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() Weiming Shi <bestswngs(a)gmail.com> i2c: stub: Reject I2C block transfers with invalid length Lord Ulf Henrik Holmberg <henrik.holmberg(a)defensify.se> RDMA/bnxt_re: zero shared page before exposing to userspace Jiacheng Shi <billsjc(a)sjtu.edu.cn> vfio/iommu_type1: replace kfree with kvfree Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: prevent TVLV entry number overflow Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: reject oversized local TVLV buffers Wang Yufen <wangyufen(a)huawei.com> netdevsim: Fix memory leak of nsim_dev->fa_cookie Hangyu Hua <hbh25y(a)gmail.com> net: 9p: fix refcount leak in p9_read_work() error handling Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Use krealloc_array() in dal_vector_reserve() Eric Dumazet <edumazet(a)google.com> net/sched: cls_u32: use skb_header_pointer_careful() Eric Dumazet <edumazet(a)google.com> net: add skb_header_pointer_careful() helper Eric Dumazet <edumazet(a)google.com> ip6_vti: set netns_immutable on the fallback device. Harry Wentland <harry.wentland(a)amd.com> drm/amd/display: Bound VBIOS record-chain walk loops Bjorn Andersson <bjorn.andersson(a)oss.qualcomm.com> slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd Jann Horn <jannh(a)google.com> fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios Pedro Tammela <pctammela(a)mojatatu.com> net/sched: act_pedit: free pedit keys on bail from offset check Rajat Gupta <rajat.gupta(a)oss.qualcomm.com> net/sched: fix pedit partial COW leading to page cache corruption Max Tottenham <mtottenh(a)akamai.com> net/sched: act_pedit: Parse L3 Header for L4 offset Pedro Tammela <pctammela(a)mojatatu.com> net/sched: act_pedit: rate limit datapath messages Pedro Tammela <pctammela(a)mojatatu.com> net/sched: act_pedit: check static offsets a priori Pedro Tammela <pctammela(a)mojatatu.com> net/sched: act_pedit: remove extra check for key type Pedro Tammela <pctammela(a)mojatatu.com> net/sched: simplify tcf_pedit_act Pedro Tammela <pctammela(a)mojatatu.com> net/sched: transition act_pedit to rcu and percpu stats Pedro Tammela <pctammela(a)mojatatu.com> net/sched: act_pedit: use NLA_POLICY for parsing 'ex' keys ------------- Diffstat: Documentation/userspace-api/ioctl/ioctl-number.rst | 427 ++++++++++----------- Makefile | 4 +- arch/mips/dec/prom/console.c | 7 +- arch/x86/kvm/svm/sev.c | 1 + crypto/af_alg.c | 2 + drivers/char/agp/amd64-agp.c | 2 +- drivers/crypto/qat/qat_common/adf_cfg_common.h | 32 -- drivers/crypto/qat/qat_common/adf_cfg_user.h | 38 -- drivers/crypto/qat/qat_common/adf_common_drv.h | 3 - drivers/crypto/qat/qat_common/adf_ctl_drv.c | 421 +------------------- drivers/crypto/qat/qat_common/adf_dev_mgr.c | 70 ---- drivers/fpga/of-fpga-region.c | 3 +- drivers/gpu/drm/amd/display/dc/basics/vector.c | 2 +- drivers/gpu/drm/amd/display/dc/bios/bios_parser.c | 15 +- drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | 12 +- .../drm/amd/display/dc/bios/bios_parser_helper.h | 5 + drivers/hv/hv_kvp.c | 25 +- drivers/hv/vmbus_drv.c | 56 ++- drivers/i2c/i2c-stub.c | 5 + drivers/infiniband/hw/bnxt_re/ib_verbs.c | 2 +- drivers/irqchip/irq-imgpdc.c | 6 + drivers/media/test-drivers/vidtv/vidtv_mux.c | 8 +- drivers/misc/fastrpc.c | 9 +- drivers/mmc/host/renesas_sdhi_internal_dmac.c | 1 + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 3 + drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c | 8 +- drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h | 1 + drivers/net/ethernet/ti/cpsw_new.c | 4 +- drivers/net/netdevsim/dev.c | 1 + drivers/net/wireless/ath/ath11k/dp.c | 1 + drivers/net/wireless/mediatek/mt76/mt76x2/usb.c | 1 + .../net/wireless/realtek/rtlwifi/rtl8821ae/trx.h | 2 +- drivers/regulator/core.c | 10 +- drivers/slimbus/qcom-ngd-ctrl.c | 11 +- drivers/tty/vt/vc_screen.c | 2 +- drivers/usb/cdns3/gadget.c | 3 + drivers/vfio/vfio_iommu_type1.c | 2 +- drivers/video/fbdev/core/fbmem.c | 12 + drivers/video/fbdev/core/modedb.c | 2 +- fs/dlm/lockspace.c | 2 +- fs/exfat/dir.c | 4 +- fs/ext4/inline.c | 8 + fs/f2fs/acl.c | 18 +- fs/fuse/dev.c | 4 + fs/fuse/file.c | 8 +- fs/nfs/pnfs.c | 2 +- fs/nfsd/nfs2acl.c | 17 +- fs/nfsd/nfs3acl.c | 17 +- fs/nfsd/nfs4recover.c | 3 +- fs/nfsd/nfs4xdr.c | 3 +- fs/ocfs2/suballoc.c | 22 ++ include/keys/request_key_auth-type.h | 2 + include/linux/ring_buffer.h | 4 +- include/linux/skbuff.h | 12 + include/net/phonet/pn_dev.h | 2 +- include/net/tc_act/tc_pedit.h | 80 +++- kernel/bpf/cgroup.c | 2 +- kernel/trace/ring_buffer.c | 74 +--- kernel/trace/trace.c | 14 +- kernel/trace/trace_kdb.c | 8 +- net/9p/trans_fd.c | 1 + net/batman-adv/bat_iv_ogm.c | 11 +- net/batman-adv/bat_v.c | 1 + net/batman-adv/bat_v_ogm.c | 23 +- net/batman-adv/bridge_loop_avoidance.c | 28 +- net/batman-adv/distributed-arp-table.c | 12 +- net/batman-adv/fragmentation.c | 22 +- net/batman-adv/fragmentation.h | 3 +- net/batman-adv/netlink.c | 10 +- net/batman-adv/routing.c | 3 +- net/batman-adv/tp_meter.c | 115 ++++-- net/batman-adv/translation-table.c | 40 +- net/batman-adv/tvlv.c | 69 +++- net/batman-adv/types.h | 21 +- net/ipv6/ip6_vti.c | 1 + net/mac802154/llsec.c | 14 + net/mptcp/protocol.c | 8 + net/phonet/pn_dev.c | 12 +- net/phonet/pn_netlink.c | 23 +- net/sched/act_pedit.c | 420 +++++++++++--------- net/sched/cls_u32.c | 13 +- net/tipc/crypto.c | 9 + security/keys/internal.h | 2 + security/keys/keyctl.c | 24 +- security/keys/keyctl_pkey.c | 9 +- security/keys/request_key_auth.c | 33 +- 86 files changed, 1206 insertions(+), 1246 deletions(-)

3 months, 3 weeks

[PATCH 6.12 000/204] 6.12.95-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.12.95 release. There are 204 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat, 04 Jul 2026 15:50:58 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.95-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.12.95-rc1 Hangbin Liu <liuhangbin(a)gmail.com> bonding: do not set usable_slaves for broadcast mode Eric Dumazet <edumazet(a)google.com> bonding: annotate data-races arcound churn variables Tonghao Zhang <tonghao(a)bamaicloud.com> net: bonding: update the slave array for broadcast mode John Stultz <jstultz(a)google.com> locking: rtmutex: Fix wake_q logic in task_blocks_on_rt_mutex HanQuan <eilaimemedsnaimel(a)gmail.com> net/tcp-ao: fix use-after-free of key in del_async path Giovanni Cabiddu <giovanni.cabiddu(a)intel.com> crypto: qat - remove unused character device and IOCTLs Herbert Xu <herbert(a)gondor.apana.org.au> crypto: qat - Return pointer directly in adf_ctl_alloc_resources Thorsten Blum <thorsten.blum(a)linux.dev> crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() Bagas Sanjaya <bagasdotme(a)gmail.com> Documentation: ioctl-number: Extend "Include File" column width Bagas Sanjaya <bagasdotme(a)gmail.com> Documentation: ioctl-number: Fix linuxppc-dev mailto link Georgi Djakov <georgi.djakov(a)oss.qualcomm.com> drivers/base/memory: set mem->altmap after successful device registration Stepan Ionichev <sozdayvek(a)gmail.com> serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails Hem Parekh <hemparekh1596(a)gmail.com> ksmbd: fix out-of-bounds read in smb_check_perm_dacl() Markus Elfring <elfring(a)users.sourceforge.net> NFS: Prevent resource leak in nfs_alloc_server() Michael Bommarito <michael.bommarito(a)gmail.com> NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr Jeff Layton <jlayton(a)kernel.org> nfsd: reset write verifier on deferred writeback errors Jeff Layton <jlayton(a)kernel.org> nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race Dominik Woźniak <stalion(a)gmail.com> nfsd: check get_user() return when reading princhashlen Jeff Layton <jlayton(a)kernel.org> nfsd: fix posix_acl leak on SETACL decode failure Guannan Wang <wgnbuaa(a)gmail.com> NFSD: Fix SECINFO_NO_NAME decode error cleanup Johan Hovold <johan(a)kernel.org> i2c: core: fix adapter registration race Steffen Persvold <spersvold(a)gmail.com> fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode Tuo Li <islituo(a)gmail.com> fbdev: modedb: fix a possible UAF in fb_find_mode() Ian Bridges <icb(a)fastmail.org> fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var Vivian Wang <wangruikang(a)iscas.ac.cn> riscv: kfence: Call mark_new_valid_map() for kfence_unprotect() Wentao Liang <vulab(a)iscas.ac.cn> power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() Ashutosh Desai <ashutoshdesai993(a)gmail.com> KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path Hyunwoo Kim <imv4bel(a)gmail.com> KVM: x86: hyper-v: Bound the bank index when querying sparse banks Jonas Jelonek <jelonek.jonas(a)gmail.com> MIPS: smp: report dying CPU to RCU in stop_this_cpu() Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> 9p: avoid putting oldfid in p9_client_walk() error path Zhang Cen <rollkingzzc(a)gmail.com> ocfs2: reject oversized group bitmap descriptors Yuho Choi <dbgh9129(a)gmail.com> rpmsg: char: Fix use-after-free on probe error path Wentao Liang <vulab(a)iscas.ac.cn> fpga: region: fix use-after-free in child_regions_with_firmware() Qingshuang Fu <fuqingshuang(a)kylinos.cn> irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove Wentao Liang <vulab(a)iscas.ac.cn> pNFS: Fix use-after-free in pnfs_update_layout() Huacai Chen <chenhuacai(a)kernel.org> LoongArch: Report dying CPU to RCU in stop_this_cpu() Doruk Tan Ozturk <doruk(a)0sec.ai> tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done Michal Koutný <mkoutny(a)suse.com> blk-cgroup: fix UAF in __blkcg_rstat_flush() Fan Wu <fanwu01(a)zju.edu.cn> hdlc_ppp: sync per-proto timers before freeing hdlc state Wentao Liang <vulab(a)iscas.ac.cn> pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next() Tristan Madani <tristan(a)talencesecurity.com> gfs2: fix use-after-free in gfs2_qd_dealloc Sean Christopherson <seanjc(a)google.com> KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() Michael Bommarito <michael.bommarito(a)gmail.com> exfat: fix potential use-after-free in exfat_find_dir_entry() Maciej W. Rozycki <macro(a)orcam.me.uk> MIPS: DEC: Prevent initial console buffer from landing in XKPHYS Dawei Feng <dawei.feng(a)seu.edu.cn> bpf: use kvfree() for replaced sysctl write buffer Denis Arefev <arefev(a)swemel.ru> block: Avoid mounting the bdev pseudo-filesystem in userspace Wenjie Qi <qwjhust(a)gmail.com> f2fs: keep atomic write retry from zeroing original data Yongpeng Yang <yangyongpeng(a)xiaomi.com> f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node() Zhang Cen <rollkingzzc(a)gmail.com> f2fs: validate ACL entry sizes in f2fs_acl_from_disk() Sunmin Jeong <s_min.jeong(a)samsung.com> f2fs: fix to round down start offset of fallocate for pin file Wenjie Qi <qwjhust(a)gmail.com> f2fs: validate compress cache inode only when enabled Junjie Cao <junjie.cao(a)intel.com> wifi: iwlwifi: mvm: fix race condition in PTP removal Luka Gejak <luka.gejak(a)linux.dev> wifi: rtw88: usb: fix memory leaks on USB write failures Luka Gejak <luka.gejak(a)linux.dev> wifi: rtw88: increase TX report timeout to fix race condition Bitterblue Smith <rtl8821cerfe2(a)gmail.com> wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor Jose Ignacio Tornos Martinez <jtornosm(a)redhat.com> wifi: ath11k: fix warning when unbinding ElXreno <elxreno(a)gmail.com> wifi: mt76: mt7925: don't disable AP BSS when removing TDLS peer Zenm Chen <zenmchen(a)gmail.com> wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S Shaomin Chen <eeesssooo020(a)gmail.com> keys: Pin request_key_auth payload in instantiate paths Jarkko Sakkinen <jarkko(a)kernel.org> KEYS: fix overflow in keyctl_pkey_params_get_2() Arnd Bergmann <arnd(a)arndb.de> err.h: use __always_inline on all error pointer helpers Usama Arif <usama.arif(a)linux.dev> block: invalidate cached plug timestamp after task switch Ian Bridges <icb(a)fastmail.org> fbdev: fix use-after-free in store_modes() Koichiro Den <den(a)valinux.co.jp> NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR Ruslan Valiyev <linuxoid(a)gmail.com> apparmor: fix use-after-free in rawdata dedup loop Bryam Vargas <hexlabsecurity(a)proton.me> apparmor: mediate the implicit connect of TCP fast open sendmsg Maoyi Xie <maoyixie.tju(a)gmail.com> net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink Yiming Qian <yimingqian591(a)gmail.com> net: skmsg: preserve sg.copy across SG transforms Doruk Tan Ozturk <doruk(a)0sec.ai> mac802154: llsec: add skb_cow_data() before in-place crypto Cheng Ming Lin <chengminglin(a)mxic.com.tw> mtd: spi-nor: macronix: add support for mx66{l2, u1}g45g Cheng Ming Lin <chengminglin(a)mxic.com.tw> mtd: spi-nor: macronix: Add post_sfdp fixups for Quad Input Page Program Kuniyuki Iwashima <kuniyu(a)google.com> af_unix: Set gc_in_progress to true in unix_gc(). Sean Christopherson <seanjc(a)google.com> KVM: SEV: Unmap and unpin the GHCB as needed on vCPU free Sean Christopherson <seanjc(a)google.com> KVM: SEV: Move sev_free_vcpu() down below sev_es_unmap_ghcb() Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> ntfs3: reject direct userspace writes to reserved $LX* xattrs Wongi Lee <qw3rtyp0(a)gmail.com> ipv4: account for fraggap on the paged allocation path Eric Dumazet <edumazet(a)google.com> inet: add indirect call wrapper for getfrag() calls Paul Moore <paul(a)paul-moore.com> selinux: fix overlayfs mmap() and mprotect() access checks Paul Moore <paul(a)paul-moore.com> lsm: add backing_file LSM hooks Amir Goldstein <amir73il(a)gmail.com> fs: constify file ptr in backing_file accessor helpers Wongi Lee <qw3rtyp0(a)gmail.com> ipv6: account for fraggap on the paged allocation path Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: avoid race of cifsnotfound handler state Sven Eckelmann <sven(a)narfation.org> batman-adv: tvlv: enforce 2-byte alignment Sven Eckelmann <sven(a)narfation.org> batman-adv: dat: prevent false sharing between VLANs Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: track roam count per VID Sven Eckelmann <sven(a)narfation.org> batman-adv: tt: don't merge change entries with different VIDs Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: handle overlapping packets Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: prevent parallel modifications of last_recv Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: restrict number of unacked list entries Sven Eckelmann <sven(a)narfation.org> batman-adv: v: prevent OGM aggregation on disabled hardif Sven Eckelmann <sven(a)narfation.org> batman-adv: frag: avoid underflow of TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: frag: ensure fragment is writable before modifying TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: fix (m|b)cast csum after decrementing TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: ensure bcast is writable before modifying TTL Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: initialize last_recv_time during init Sven Eckelmann <sven(a)narfation.org> batman-adv: prevent ELP transmission interval underflow Sven Eckelmann <sven(a)narfation.org> batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: add only finished tp_vars to lists Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: fix fast recovery precondition Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: avoid window underflow Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: initialize dec_cwnd explicitly Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: initialize dup_acks explicitly Sven Eckelmann <sven(a)narfation.org> batman-adv: tp_meter: keep unacked list in ascending ordered Sean Christopherson <seanjc(a)google.com> KVM: SEV: Ignore Port I/O requests of length '0' Sean Christopherson <seanjc(a)google.com> KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ Sean Christopherson <seanjc(a)google.com> KVM: SEV: Ignore MMIO requests of length '0' Sasha Levin <sashal(a)kernel.org> Revert "PCI: qcom: Advertise Hotplug Slot Capability with no Command Completion support" Sean Christopherson <seanjc(a)google.com> KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level Paolo Bonzini <pbonzini(a)redhat.com> KVM: x86: Fix shadow paging use-after-free due to unexpected role Miklos Szeredi <mszeredi(a)redhat.com> virtiofs: fix UAF on submount umount Ruslan Valiyev <linuxoid(a)gmail.com> media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si Gil Portnoy <dddhkts1(a)gmail.com> ksmbd: reject non-VALID session in compound request branch Viken Dadhaniya <viken.dadhaniya(a)oss.qualcomm.com> serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero Yi Yang <yiyang13(a)huawei.com> vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write Sam Daly <sam(a)samdaly.ie> iio: adc: ti-ads1298: add bounds check to pga_settings index Sam Daly <sam(a)samdaly.ie> iio: light: veml6075: add bounds check to veml6075_it_ms index Xin Long <lucien.xin(a)gmail.com> sctp: disable BH before calling udp_tunnel_xmit_skb() Petr Machata <petrm(a)nvidia.com> net: ipv6: Make udp_tunnel6_xmit_skb() void Vasily Gorbik <gor(a)linux.ibm.com> scripts/sorttable: Fix endianness handling in build-time mcount sort Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Allow matches to functions before function entry Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Use normal sort if theres no relocs in the mcount section Steven Rostedt <rostedt(a)goodmis.org> ftrace: Check against is_kernel_text() instead of kaslr_offset() Steven Rostedt <rostedt(a)goodmis.org> ftrace: Test mcount_loc addr before calling ftrace_call_addr() Guenter Roeck <linux(a)roeck-us.net> ftrace: Do not over-allocate ftrace memory Steven Rostedt <rostedt(a)goodmis.org> ftrace: Have ftrace pages output reflect freed pages Steven Rostedt <rostedt(a)goodmis.org> ftrace: Update the mcount_loc check of skipped entries Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Zero out weak functions in mcount_loc table Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Always use an array for the mcount_loc sorting Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Have mcount rela sort use direct values Steven Rostedt <rostedt(a)goodmis.org> arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Use a structure of function pointers for elf helpers Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Get start/stop_mcount_loc from ELF file directly Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Move code from sorttable.h into sorttable.c Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Use uint64_t for mcount sorting Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Add helper functions for Elf_Sym Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Add helper functions for Elf_Shdr Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Add helper functions for Elf_Ehdr Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Convert Elf_Sym MACRO over to a union Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Replace Elf_Shdr Macro with a union Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Convert Elf_Ehdr to union Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Make compare_extable() into two functions Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Have the ORC code use the _r() functions to read Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Remove unneeded Elf_Rel Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Remove unused write functions Steven Rostedt <rostedt(a)goodmis.org> scripts/sorttable: Remove unused macro defines Joanne Koong <joannelkoong(a)gmail.com> fuse: re-lock request before replacing page cache folio David Howells <dhowells(a)redhat.com> rxrpc: Fix the ACK parser to extract the SACK table for parsing Santosh Kalluri <santosh.kalluri129(a)gmail.com> net: phonet: free phonet_device after RCU grace period Kuniyuki Iwashima <kuniyu(a)amazon.com> phonet: Pass net and ifindex to phonet_address_notify(). Kuniyuki Iwashima <kuniyu(a)amazon.com> phonet: Pass ifindex to fill_addr(). Davidlohr Bueso <dave(a)stgolabs.net> locking/rtmutex: Skip remove_waiter() when waiter is not enqueued Peter Zijlstra <peterz(a)infradead.org> locking/mutex: Remove wakeups from under mutex::wait_lock Ji'an Zhou <eilaimemedsnaimel(a)gmail.com> futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock Thorsten Blum <thorsten.blum(a)linux.dev> hv: utils: handle and propagate errors in kvp_register Dexuan Cui <decui(a)microsoft.com> Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs Jann Horn <jannh(a)google.com> fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() Salman Alghamdi <me(a)cipherat.com> staging: rtl8723bs: fix buffer over-read in rtw_update_protection Hangbin Liu <liuhangbin(a)gmail.com> bonding: fix NULL pointer dereference in actor_port_prio setting Xiang Mei <xmei5(a)asu.edu> net: bonding: fix use-after-free in bond_xmit_broadcast() Eric Dumazet <edumazet(a)google.com> bonding: 3ad: implement proper RCU rules for port->aggregator Hangbin Liu <liuhangbin(a)gmail.com> bonding: print churn state via netlink Hangbin Liu <liuhangbin(a)gmail.com> bonding: add support for per-port LACP actor priority Tonghao Zhang <tonghao(a)bamaicloud.com> net: bonding: add broadcast_neighbor option for 802.3ad Kevin Berry <kpberry(a)google.com> Revert "net: bonding: fix use-after-free in bond_xmit_broadcast()" Yingjie Gao <gaoyingjie(a)uniontech.com> xfs: fix error returns in CoW fork repair Christoph Hellwig <hch(a)lst.de> xfs: remove the expr argument to XFS_TEST_ERROR Thadeu Lima de Souza Cascardo <cascardo(a)igalia.com> dlm: prevent NPD when writing a positive value to event_done André Draszik <andre.draszik(a)linaro.org> regulator: core: fix locking in regulator_resolve_supply() error path Yicong Yang <yang.yicong(a)picoheart.com> ACPI: scan: Use async schedule function in acpi_scan_clear_dep_fn() Varun R Mallya <varunrmallya(a)gmail.com> selftests/bpf: Add test to ensure kprobe_multi is not sleepable Varun R Mallya <varunrmallya(a)gmail.com> bpf: Reject sleepable kprobe_multi programs at attach time Mingyu Wang <25181214217(a)stu.xidian.edu.cn> agp/amd64: Fix broken error propagation in agp_amd64_probe() Weiming Shi <bestswngs(a)gmail.com> net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() Weiming Shi <bestswngs(a)gmail.com> i2c: stub: Reject I2C block transfers with invalid length Lord Ulf Henrik Holmberg <henrik.holmberg(a)defensify.se> RDMA/bnxt_re: zero shared page before exposing to userspace Waiman Long <longman(a)redhat.com> debugobjects: Dont call fill_pool() in early boot hardirq context Helen Koike <koike(a)igalia.com> debugobjects: Do not fill_pool() if pi_blocked_on Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> debugobjects: Use LD_WAIT_CONFIG instead of LD_WAIT_SLEEP Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> debugobjects: Allow to refill the pool before SYSTEM_SCHEDULING Petr Machata <petrm(a)nvidia.com> Reapply "selftest/ptp: update ptp selftest to exercise the gettimex options" Eric Dumazet <edumazet(a)google.com> ip6_vti: set netns_immutable on the fallback device. Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> net: Drop the lock in skb_may_tx_timestamp() Antoniu Miclaus <antoniu.miclaus(a)analog.com> iio: light: bh1780: fix PM runtime leak on error path Christian Brauner <brauner(a)kernel.org> eventpoll: fix ep_remove struct eventpoll / struct file UAF Christian Brauner <brauner(a)kernel.org> eventpoll: move epi_fget() up Christian Brauner <brauner(a)kernel.org> eventpoll: rename ep_remove_safe() back to ep_remove() Christian Brauner <brauner(a)kernel.org> eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() Christian Brauner <brauner(a)kernel.org> eventpoll: kill __ep_remove() Christian Brauner <brauner(a)kernel.org> eventpoll: split __ep_remove() Christian Brauner <brauner(a)kernel.org> eventpoll: use hlist_is_singular_node() in __ep_remove() Maíra Canal <mcanal(a)igalia.com> drm/v3d: Skip CSD when it has zeroed workgroups Maíra Canal <mcanal(a)igalia.com> drm/v3d: Store the active job inside the queue's state Jani Nikula <jani.nikula(a)intel.com> drm/xe/display: fix oops in suspend/shutdown without display Gabriel Krisman Bertazi <krisman(a)suse.de> io_uring/net: Avoid msghdr on op_connect/op_bind async data Tzung-Bi Shih <tzungbi(a)kernel.org> gpio: Fix resource leaks on errors in gpiochip_add_data_with_key() Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> gpiolib: Remove redundant assignment of return variable Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> gpiolib: Extract gpiochip_choose_fwnode() for wider use Jann Horn <jannh(a)google.com> fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios Sean Wang <sean.wang(a)mediatek.com> wifi: mt76: mt7921: fix potential deadlock in mt7921_roc_abort_sync Quan Zhou <quan.zhou(a)mediatek.com> wifi: mt76: mt7921: fix a potential scan no APs Leon Yen <leon.yen(a)mediatek.com> wifi: mt76: mt7921: avoid undesired changes of the preset regulatory domain ------------- Diffstat: Documentation/networking/bonding.rst | 15 + Documentation/userspace-api/ioctl/ioctl-number.rst | 485 +++++---- Makefile | 4 +- arch/arm64/Kconfig | 1 + arch/loongarch/kernel/smp.c | 1 + arch/mips/dec/prom/console.c | 7 +- arch/mips/kernel/smp.c | 2 + arch/riscv/include/asm/kfence.h | 7 +- arch/riscv/kernel/entry.S | 6 +- arch/x86/kvm/hyperv.c | 5 + arch/x86/kvm/mmu/mmu.c | 28 +- arch/x86/kvm/svm/sev.c | 113 +- block/bdev.c | 5 - block/blk-cgroup.c | 21 +- drivers/acpi/scan.c | 41 +- drivers/base/memory.c | 3 +- drivers/char/agp/amd64-agp.c | 2 +- drivers/crypto/intel/qat/qat_common/adf_cfg.c | 10 - drivers/crypto/intel/qat/qat_common/adf_cfg.h | 1 - .../crypto/intel/qat/qat_common/adf_cfg_common.h | 32 - drivers/crypto/intel/qat/qat_common/adf_cfg_user.h | 38 - .../crypto/intel/qat/qat_common/adf_common_drv.h | 3 - drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c | 416 +------- drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c | 70 -- drivers/fpga/of-fpga-region.c | 3 +- drivers/gpio/gpiolib.c | 156 +-- drivers/gpu/drm/v3d/v3d_drv.h | 7 +- drivers/gpu/drm/v3d/v3d_gem.c | 7 +- drivers/gpu/drm/v3d/v3d_irq.c | 62 +- drivers/gpu/drm/v3d/v3d_sched.c | 42 +- drivers/gpu/drm/xe/display/xe_display.c | 11 +- drivers/hv/hv_kvp.c | 25 +- drivers/hv/vmbus_drv.c | 29 +- drivers/i2c/i2c-core-base.c | 8 +- drivers/i2c/i2c-stub.c | 5 + drivers/iio/adc/ti-ads1298.c | 7 +- drivers/iio/light/bh1780.c | 4 +- drivers/iio/light/veml6075.c | 8 +- drivers/infiniband/hw/bnxt_re/ib_verbs.c | 2 +- drivers/irqchip/irq-imgpdc.c | 6 + drivers/media/test-drivers/vidtv/vidtv_mux.c | 8 +- drivers/mtd/spi-nor/macronix.c | 31 + drivers/net/bonding/bond_3ad.c | 131 ++- drivers/net/bonding/bond_main.c | 86 +- drivers/net/bonding/bond_netlink.c | 37 +- drivers/net/bonding/bond_options.c | 71 ++ drivers/net/bonding/bond_procfs.c | 11 +- drivers/net/bonding/bond_sysfs_slave.c | 17 +- drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c | 8 +- drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h | 1 + drivers/net/wan/hdlc_ppp.c | 15 +- drivers/net/wireless/ath/ath11k/dp.c | 1 + drivers/net/wireless/intel/iwlwifi/mvm/ptp.c | 2 +- drivers/net/wireless/mediatek/mt76/mt76x2/usb.c | 1 + drivers/net/wireless/mediatek/mt76/mt7921/init.c | 7 + drivers/net/wireless/mediatek/mt76/mt7921/main.c | 14 +- drivers/net/wireless/mediatek/mt76/mt7925/main.c | 3 + .../net/wireless/realtek/rtlwifi/rtl8821ae/trx.h | 2 +- drivers/net/wireless/realtek/rtw88/tx.c | 7 +- drivers/net/wireless/realtek/rtw88/usb.c | 13 +- drivers/ntb/hw/epf/ntb_hw_epf.c | 3 +- drivers/pci/controller/dwc/pcie-qcom.c | 17 +- drivers/power/reset/linkstation-poweroff.c | 2 +- drivers/power/sequencing/core.c | 14 +- drivers/regulator/core.c | 10 +- drivers/rpmsg/rpmsg_char.c | 15 +- drivers/staging/rtl8723bs/core/rtw_mlme.c | 10 +- drivers/tty/serial/8250/8250_dw.c | 4 +- drivers/tty/serial/qcom_geni_serial.c | 9 +- drivers/tty/vt/vc_screen.c | 2 +- drivers/video/fbdev/core/fbmem.c | 12 + drivers/video/fbdev/core/fbsysfs.c | 10 +- drivers/video/fbdev/core/modedb.c | 5 +- fs/backing-file.c | 22 +- fs/dlm/lockspace.c | 2 +- fs/eventpoll.c | 142 +-- fs/exfat/dir.c | 4 +- fs/f2fs/acl.c | 18 +- fs/f2fs/data.c | 16 +- fs/f2fs/extent_cache.c | 19 +- fs/f2fs/file.c | 9 +- fs/f2fs/inode.c | 9 +- fs/fhandle.c | 16 +- fs/file_table.c | 40 +- fs/fuse/dev.c | 23 +- fs/fuse/file.c | 8 +- fs/fuse/passthrough.c | 2 +- fs/gfs2/super.c | 1 + fs/internal.h | 4 +- fs/mount.h | 10 +- fs/namespace.c | 6 +- fs/nfs/client.c | 1 + fs/nfs/pnfs.c | 2 +- fs/nfs/pnfs_nfs.c | 4 +- fs/nfsd/nfs2acl.c | 17 +- fs/nfsd/nfs3acl.c | 17 +- fs/nfsd/nfs4recover.c | 3 +- fs/nfsd/nfs4state.c | 1 + fs/nfsd/nfs4xdr.c | 3 +- fs/nfsd/vfs.c | 6 +- fs/ntfs3/xattr.c | 12 + fs/ocfs2/suballoc.c | 22 + fs/overlayfs/dir.c | 2 +- fs/overlayfs/file.c | 3 +- fs/smb/server/smb2pdu.c | 5 + fs/smb/server/smbacl.c | 4 +- fs/xfs/libxfs/xfs_ag_resv.c | 8 +- fs/xfs/libxfs/xfs_alloc.c | 5 +- fs/xfs/libxfs/xfs_attr_leaf.c | 2 +- fs/xfs/libxfs/xfs_bmap.c | 17 +- fs/xfs/libxfs/xfs_btree.c | 2 +- fs/xfs/libxfs/xfs_da_btree.c | 2 +- fs/xfs/libxfs/xfs_dir2.c | 2 +- fs/xfs/libxfs/xfs_exchmaps.c | 4 +- fs/xfs/libxfs/xfs_ialloc.c | 2 +- fs/xfs/libxfs/xfs_inode_buf.c | 4 +- fs/xfs/libxfs/xfs_inode_fork.c | 3 +- fs/xfs/libxfs/xfs_refcount.c | 5 +- fs/xfs/libxfs/xfs_rmap.c | 2 +- fs/xfs/scrub/cow_repair.c | 7 +- fs/xfs/scrub/repair.c | 2 +- fs/xfs/xfs_attr_item.c | 2 +- fs/xfs/xfs_buf.c | 4 +- fs/xfs/xfs_error.c | 5 +- fs/xfs/xfs_error.h | 10 +- fs/xfs/xfs_inode.c | 28 +- fs/xfs/xfs_iomap.c | 2 +- fs/xfs/xfs_log.c | 8 +- fs/xfs/xfs_trans_ail.c | 2 +- include/keys/request_key_auth-type.h | 2 + include/linux/backing-file.h | 4 +- include/linux/blkdev.h | 16 +- include/linux/err.h | 12 +- include/linux/fs.h | 19 +- include/linux/kvm_host.h | 7 +- include/linux/lsm_audit.h | 2 +- include/linux/lsm_hook_defs.h | 5 + include/linux/lsm_hooks.h | 1 + include/linux/security.h | 22 + include/linux/skmsg.h | 15 +- include/net/bond_3ad.h | 3 +- include/net/bond_options.h | 2 + include/net/bonding.h | 3 + include/net/phonet/pn_dev.h | 2 +- include/net/rtnetlink.h | 2 + include/net/sock.h | 2 +- include/net/udp_tunnel.h | 14 +- include/uapi/linux/if_link.h | 3 + io_uring/net.c | 36 +- io_uring/opdef.c | 4 +- kernel/bpf/cgroup.c | 2 +- kernel/futex/pi.c | 6 +- kernel/futex/requeue.c | 6 + kernel/locking/mutex.c | 16 +- kernel/locking/rtmutex.c | 51 +- kernel/locking/rtmutex_api.c | 14 +- kernel/locking/rtmutex_common.h | 3 +- kernel/locking/rwbase_rt.c | 8 +- kernel/locking/rwsem.c | 4 +- kernel/locking/spinlock_rt.c | 5 +- kernel/locking/ww_mutex.h | 30 +- kernel/sched/core.c | 12 +- kernel/trace/bpf_trace.c | 4 + kernel/trace/ftrace.c | 68 +- lib/debugobjects.c | 56 +- net/9p/client.c | 3 +- net/batman-adv/bat_iv_ogm.c | 11 +- net/batman-adv/bat_v.c | 1 + net/batman-adv/bat_v_ogm.c | 23 +- net/batman-adv/bridge_loop_avoidance.c | 28 +- net/batman-adv/distributed-arp-table.c | 12 +- net/batman-adv/fragmentation.c | 22 +- net/batman-adv/fragmentation.h | 3 +- net/batman-adv/netlink.c | 10 +- net/batman-adv/routing.c | 73 +- net/batman-adv/tp_meter.c | 115 +- net/batman-adv/translation-table.c | 12 +- net/batman-adv/tvlv.c | 69 +- net/batman-adv/types.h | 21 +- net/core/filter.c | 27 + net/core/rtnetlink.c | 8 + net/core/skbuff.c | 23 +- net/core/skmsg.c | 2 + net/ipv4/ip_gre.c | 6 + net/ipv4/ip_output.c | 20 +- net/ipv4/tcp_ao.c | 4 + net/ipv6/ip6_output.c | 22 +- net/ipv6/ip6_udp_tunnel.c | 15 +- net/ipv6/ip6_vti.c | 1 + net/mac802154/llsec.c | 14 + net/phonet/pn_dev.c | 12 +- net/phonet/pn_netlink.c | 23 +- net/rxrpc/input.c | 21 +- net/sctp/ipv6.c | 9 +- net/sctp/protocol.c | 2 + net/socket.c | 2 +- net/tipc/crypto.c | 9 + net/tipc/udp_media.c | 10 +- net/tls/tls_sw.c | 4 + net/unix/garbage.c | 2 + scripts/link-vmlinux.sh | 4 +- scripts/sorttable.c | 1119 +++++++++++++++++++- scripts/sorttable.h | 500 --------- security/apparmor/include/policy_unpack.h | 19 + security/apparmor/lsm.c | 16 +- security/apparmor/policy.c | 8 +- security/keys/internal.h | 2 + security/keys/keyctl.c | 24 +- security/keys/keyctl_pkey.c | 9 +- security/keys/request_key_auth.c | 33 +- security/security.c | 109 ++ security/selinux/hooks.c | 256 +++-- security/selinux/include/objsec.h | 11 + .../selftests/bpf/prog_tests/kprobe_multi_test.c | 35 +- .../selftests/bpf/progs/kprobe_multi_sleepable.c | 25 + tools/testing/selftests/ptp/testptp.c | 62 +- virt/kvm/eventfd.c | 12 +- 217 files changed, 3867 insertions(+), 2335 deletions(-)

4 months

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

Lkft-triage