Lkft-triage

lkft-triage@lists.linaro.org

19 participants
34241 discussions

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.6.156 release. There are 91 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 02 Sep 2026 13:32:19 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.156-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.6.156-rc1 Miguel Peñaranda <mig.penaranda07(a)gmail.com> usb: usbfs: fix use-after-free of usb_device in usbdev_release() Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> USB: c67x00: fix use-after-free in c67x00_add_iso_urb() Johan Hovold <johan(a)kernel.org> USB: serial: spcp8x5: drop broken carrier detect support Jiale Yao <yaojiale02(a)163.com> USB: serial: option: fix slab OOB read in interrupt URB callback Will Porter <mrwillporter(a)gmail.com> ALSA: usb-audio: Complete cleanup after system-resume errors Marouane El Moufid <eun0us(a)espilon.net> ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() Griffin Kroah-Hartman <griffin(a)kroah.com> usb: core: Strengthen error handling in hub_hub_status() Griffin Kroah-Hartman <griffin(a)kroah.com> usb: core: Add lock to usb_wakeup_notification() Christian Borntraeger <borntraeger(a)linux.ibm.com> KVM: s390: vsie: zero stale crypto bits Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> crypto: qce - Remove unsafe/deprecated algorithms Thorsten Blum <thorsten.blum(a)linux.dev> crypto: mxs-dcp - fix source scatterlist length access Md Sadre Alam <md.alam(a)oss.qualcomm.com> crypto: qce - fix CCM AAD buffer underallocation Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-tdes - use scatterlist length before DMA mapping Eric Biggers <ebiggers(a)kernel.org> mm/swap: reject swapon() on filesystem-level encrypted files Kyle Zeng <kylebot(a)openai.com> ipv6: seg6: clear IPv4 control block on IPIP decapsulation Norbert Szetei <norbert(a)doyensec.com> net: bridge: mcast: fix use-after-free of a master VLAN's multicast context Zihan Xi <zihanx(a)nebusec.ai> xfrm: fix xfrm_state_construct() auth-trunc leak Asim Viladi Oglu Manizada <manizada(a)pm.me> xfrm: ah6: validate routing header segments_left Zhiling Zou <roxy520tt(a)gmail.com> xfrm: drop ESP-in-TCP packets with no ingress device Sabrina Dubroca <sd(a)queasysnail.net> xfrm: espintcp: fix UAF during close Pratik Vishwakarma <Pratik.Vishwakarma(a)amd.com> x86/CPU/AMD: Carve out a Zen5 models range Perry Yuan <perry.yuan(a)amd.com> x86/CPU/AMD: Add models 0x60-0x6f to the Zen5 range Wenkuan Wang <Wenkuan.Wang(a)amd.com> x86/CPU/AMD: Add models 0x10-0x1f to the Zen5 range Mario Limonciello <mario.limonciello(a)amd.com> x86/CPU/AMD: Add more models to X86_FEATURE_ZEN5 Borislav Petkov (AMD) <bp(a)alien8.de> x86/CPU/AMD: Add X86_FEATURE_ZEN5 Jiayuan Chen <jiayuan.chen(a)linux.dev> tls: device: fix out-of-bounds write in tls_append_frag() Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> usb: gadget: f_tcm: keep port count until LUN teardown completes Aleksandr Nogikh <nogikh(a)google.com> usb: usbtest: disable dynamic ID support Baokun Li <libaokun(a)linux.alibaba.com> fuse: fix invalidate lock leak on open O_TRUNC DAX failure Baokun Li <libaokun(a)linux.alibaba.com> fuse: fix invalidate lock leak on setattr writeback failure Lucas De Marchi <ldemarchi(a)nvidia.com> xhci: dbgtty: Fix unregister on tty_alloc_driver() failure Lucas De Marchi <ldemarchi(a)nvidia.com> xhci: dbgtty: Fix unregister on tty_register_driver() failure Semih Baskan <strst.gs(a)gmail.com> usb: xhci: Handle USB3 port events when there is one roothub Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> accessibility: speakup: unregister tty ldisc on later init failures Griffin Kroah-Hartman <griffin(a)kroah.com> fpga: dfl: fme: add error handling Darrick J. Wong <djwong(a)kernel.org> xfs: remove file_path tracepoint data Chengfeng Ye <nicoyip.dev(a)gmail.com> Bluetooth: hci_sync: Fix accept list UAF during suspend Zijun Hu <zijun.hu(a)oss.qualcomm.com> Bluetooth: hci_sync: Use bt_dev_err() to log error message in hci_update_event_filter_sync() Baul Lee <baul.lee(a)xbow.com> HID: pidff: fix OOB write when hid->inputs is empty Tomasz Pakuła <tomasz.pakula.oficjalny(a)gmail.com> HID: pidff: clang-format pass Tomasz Pakuła <tomasz.pakula.oficjalny(a)gmail.com> HID: pidff: Support device error response from PID_BLOCK_LOAD Ibrahim Hashimov <security(a)auditcode.ai> HID: uclogic: fix use-after-free of inrange_timer on remove Raman Varabets <kernel-linux-20260610-80b7ab08(a)raman.v1.sg> HID: ft260: fix stack-use-after-return write in I2C read race Michael Zaidman <michael.zaidman(a)gmail.com> HID: ft260: validate i2c input report length Jiangshan Yi <yijiangshan(a)kylinos.cn> HID: nintendo: stop device IO before hid_hw_stop on probe failure Ibrahim Hashimov <security(a)auditcode.ai> nvmet-tcp: bound SGL data length before allocating command buffers Weiwen Hu <huweiwen(a)linux.alibaba.com> nvme: rename CDR/MORE/DNR to NVME_STATUS_* Weiwen Hu <huweiwen(a)linux.alibaba.com> nvme: fix status magic numbers Weiwen Hu <huweiwen(a)linux.alibaba.com> nvme: rename nvme_sc_to_pr_err to nvme_status_to_pr_err Jose Villaseñor Montfort <pepemontfort(a)gmail.com> HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event() Christopher Kodama <ckhordiasma(a)gmail.com> HID: magicmouse: re-enable multitouch after reset-resume Bryam Vargas <hexlabsecurity(a)proton.me> nfc: nci: add data_len bound checks to activation parameter extractors Ryusuke Konishi <konishi.ryusuke(a)gmail.com> nilfs2: reject invalid block index in GC ioctl Ryusuke Konishi <konishi.ryusuke(a)gmail.com> nilfs2: correct return value kernel-doc descriptions for ioctl functions Guanghui Yang <3497809730(a)qq.com> ext4: propagate errors from fast commit range replay Baokun Li <libaokun1(a)huawei.com> ext4: make some fast commit functions reuse extents path Kemeng Shi <shikemeng(a)huaweicloud.com> ext4: make state in ext4_mb_mark_bb to be bool DaeMyung Kang <charsyam(a)gmail.com> ksmbd: harden file lifetime during session teardown Jia Jie Ho <jiajie.ho(a)starfivetech.com> crypto: starfive - Do not free stack buffer Aboorva Devarajan <aboorvad(a)linux.ibm.com> powerpc/hv-gpci: fix preempt count leak in sysfs show paths Johannes Berg <johannes.berg(a)intel.com> net/sched: initialize noop_qdisc owner Eric Dumazet <edumazet(a)google.com> net/sched: Fix mirred deadlock on device recursion Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: switch two allocations to use kzalloc_objs() Kuniyuki Iwashima <kuniyu(a)google.com> smc: Use __sk_dst_get() and dst_dev_rcu() in smc_vlan_by_tcpsk(). Cristian Ciocaltea <cristian.ciocaltea(a)collabora.com> ASoC: nau8821: Cancel pending work before suspend Sasha Levin <sashal(a)kernel.org> Revert "PM: sleep: Use complete() in device_pm_sleep_init()" Michael Neuling <mikey(a)neuling.org> riscv: Fix register corruption from uninitialized cregs on error Jiayuan Chen <jiayuan.chen(a)linux.dev> bpf: Fix use-after-free in offloaded map/prog info fill Cristian Ciocaltea <cristian.ciocaltea(a)collabora.com> ASoC: nau8821: Cancel delayed work on component remove Kuniyuki Iwashima <kuniyu(a)google.com> smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). Kuniyuki Iwashima <kuniyu(a)google.com> smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set(). Oliver Upton <oliver.upton(a)linux.dev> KVM: arm64: Prevent access to vCPU events before init Kuniyuki Iwashima <kuniyu(a)google.com> smc: Fix use-after-free in __pnet_find_base_ndev(). Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> can: j1939: make j1939_sk_bind() fail if device is no longer registered Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> can: j1939: add missing calls in NETDEV_UNREGISTER notification handler Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> can: j1939: implement NETDEV_UNREGISTER notification handler Vladimir Riabchun <ferr.lambarginio(a)gmail.com> mISDN: hfcpci: Fix warning when deleting uninitialized timer Wentao Liang <vulab(a)iscas.ac.cn> media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode() Namjae Jeon <linkinjeon(a)kernel.org> exfat: fix double free in delayed_free Dylan Wolff <wolffd(a)comp.nus.edu.sg> jfs: Fix null-ptr-deref in jfs_ioc_trim Nick Child <nnac123(a)linux.ibm.com> ibmvnic: Use kernel helpers for hex dumps Vasiliy Kovalev <kovalev(a)altlinux.org> jfs: add check read-only before txBeginAnon() call Vasiliy Kovalev <kovalev(a)altlinux.org> jfs: add check read-only before truncation in jfs_truncate_nolock() Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> bpf: Remove tst_run from lwt_seg6local_prog_ops. Kyle Zeng <kylebot(a)openai.com> perf: Reject exited events as group leaders Tao Lyu <tao.lyu(a)epfl.ch> bpf: Ensure reg is PTR_TO_STACK in process_iter_arg Ralf Lici <ralf(a)mandelbit.com> Revert "usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal" Vishnu Razdan <vrazdan(a)openai.com> io_uring/io-wq: fix worker accounting when canceling creation callbacks Eric Biggers <ebiggers(a)kernel.org> ext4: don't enable DAX on new encrypted files Jinu Kim <kimjw04271234(a)gmail.com> KVM: x86/mmu: Check write tracking in all address spaces Peiyang He <peiyang_he(a)smail.nju.edu.cn> RDMA/rxe: Fix OOB in free_rd_atomic_resources() ------------- Diffstat: Documentation/filesystems/fscrypt.rst | 4 + Makefile | 4 +- arch/arm64/kvm/arm.c | 6 + arch/powerpc/perf/hv-gpci.c | 24 +- arch/riscv/kernel/compat_signal.c | 2 + arch/riscv/kernel/ptrace.c | 4 +- arch/s390/kvm/vsie.c | 1 + arch/x86/include/asm/cpufeatures.h | 4 +- arch/x86/kernel/cpu/amd.c | 28 ++- arch/x86/kvm/mmu/page_track.c | 32 ++- drivers/accessibility/speakup/main.c | 1 + drivers/base/power/main.c | 6 +- drivers/crypto/atmel-tdes.c | 5 +- drivers/crypto/mxs-dcp.c | 2 +- drivers/crypto/qce/aead.c | 58 +---- drivers/crypto/qce/common.c | 55 +---- drivers/crypto/qce/common.h | 16 +- drivers/crypto/qce/regs-v5.h | 4 - drivers/crypto/qce/sha.c | 30 +-- drivers/crypto/qce/sha.h | 1 - drivers/crypto/qce/skcipher.c | 97 +------- drivers/crypto/starfive/jh7110-rsa.c | 1 - drivers/fpga/dfl-fme-perf.c | 2 + drivers/hid/hid-ft260.c | 41 +++- drivers/hid/hid-magicmouse.c | 44 +++- drivers/hid/hid-nintendo.c | 13 +- drivers/hid/hid-uclogic-core.c | 12 +- drivers/hid/usbhid/hid-pidff.c | 21 +- drivers/infiniband/sw/rxe/rxe_qp.c | 3 +- drivers/isdn/hardware/mISDN/hfcpci.c | 12 +- .../platform/samsung/exynos4-is/fimc-is-regs.c | 1 + drivers/net/ethernet/ibm/ibmvnic.c | 30 ++- drivers/nvme/host/constants.c | 2 +- drivers/nvme/host/core.c | 32 +-- drivers/nvme/host/fabrics.c | 8 +- drivers/nvme/host/fault_inject.c | 2 +- drivers/nvme/host/fc.c | 8 +- drivers/nvme/host/multipath.c | 2 +- drivers/nvme/host/nvme.h | 4 +- drivers/nvme/host/pr.c | 10 +- drivers/nvme/target/admin-cmd.c | 24 +- drivers/nvme/target/core.c | 46 ++-- drivers/nvme/target/discovery.c | 14 +- drivers/nvme/target/fabrics-cmd-auth.c | 16 +- drivers/nvme/target/fabrics-cmd.c | 36 +-- drivers/nvme/target/io-cmd-bdev.c | 12 +- drivers/nvme/target/passthru.c | 10 +- drivers/nvme/target/rdma.c | 10 +- drivers/nvme/target/tcp.c | 17 +- drivers/nvme/target/zns.c | 30 +-- drivers/target/target_core_fabric_configfs.c | 8 + drivers/usb/c67x00/c67x00-sched.c | 4 +- drivers/usb/core/devio.c | 2 +- drivers/usb/core/hub.c | 7 +- drivers/usb/gadget/function/f_tcm.c | 2 +- drivers/usb/host/xhci-dbgtty.c | 15 +- drivers/usb/host/xhci-ring.c | 2 +- drivers/usb/misc/usbtest.c | 1 + drivers/usb/phy/phy-fsl-usb.c | 1 - drivers/usb/serial/option.c | 20 +- drivers/usb/serial/spcp8x5.c | 13 -- fs/exfat/nls.c | 1 + fs/ext4/crypto.c | 40 ++-- fs/ext4/ext4.h | 2 +- fs/ext4/extents.c | 55 ++--- fs/ext4/fast_commit.c | 35 ++- fs/ext4/ialloc.c | 4 + fs/ext4/mballoc.c | 4 +- fs/fuse/dir.c | 9 +- fs/fuse/file.c | 4 +- fs/jfs/inode.c | 2 +- fs/jfs/jfs_discard.c | 3 +- fs/jfs/jfs_extent.c | 10 + fs/nilfs2/ioctl.c | 251 ++++++++++----------- fs/smb/server/smb2pdu.c | 6 +- fs/smb/server/vfs_cache.c | 179 +++++++++++++-- fs/smb/server/vfs_cache.h | 4 +- fs/xfs/scrub/trace.h | 12 +- include/linux/nvme.h | 16 +- include/net/sch_generic.h | 1 + include/target/target_core_fabric.h | 2 + io_uring/io-wq.c | 9 +- kernel/bpf/offload.c | 10 +- kernel/bpf/verifier.c | 5 + kernel/events/core.c | 10 + mm/swapfile.c | 7 + net/bluetooth/hci_sync.c | 48 +++- net/bridge/br_multicast.c | 4 +- net/can/j1939/j1939-priv.h | 1 + net/can/j1939/main.c | 5 + net/can/j1939/socket.c | 55 +++++ net/core/dev.c | 6 + net/core/filter.c | 1 - net/ipv6/ah6.c | 29 ++- net/ipv6/seg6_local.c | 7 + net/nfc/nci/ntf.c | 26 ++- net/sched/sch_generic.c | 2 + net/smc/smc_clc.c | 67 +++--- net/smc/smc_core.c | 27 +-- net/smc/smc_pnet.c | 43 ++-- net/tls/tls_device.c | 3 +- net/xfrm/espintcp.c | 9 +- net/xfrm/xfrm_user.c | 2 +- security/selinux/ss/conditional.c | 12 +- sound/soc/codecs/nau8821.c | 13 ++ sound/usb/card.c | 14 +- sound/usb/midi.c | 2 + 107 files changed, 1133 insertions(+), 846 deletions(-)

3 days, 15 hours

[PATCH 6.12 00/99] 6.12.108-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.12.108 release. There are 99 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 02 Sep 2026 13:32:19 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.108-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.12.108-rc1 Miguel Peñaranda <mig.penaranda07(a)gmail.com> usb: usbfs: fix use-after-free of usb_device in usbdev_release() Devin Wittmayer <lucid_duck(a)justthetip.ca> wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> USB: c67x00: fix use-after-free in c67x00_add_iso_urb() Johan Hovold <johan(a)kernel.org> USB: serial: spcp8x5: drop broken carrier detect support Jiale Yao <yaojiale02(a)163.com> USB: serial: option: fix slab OOB read in interrupt URB callback Will Porter <mrwillporter(a)gmail.com> ALSA: usb-audio: Complete cleanup after system-resume errors Marouane El Moufid <eun0us(a)espilon.net> ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() Griffin Kroah-Hartman <griffin(a)kroah.com> usb: core: Strengthen error handling in hub_hub_status() Griffin Kroah-Hartman <griffin(a)kroah.com> usb: core: Add lock to usb_wakeup_notification() Christian Borntraeger <borntraeger(a)linux.ibm.com> KVM: s390: vsie: zero stale crypto bits Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> crypto: qce - Remove unsafe/deprecated algorithms Thorsten Blum <thorsten.blum(a)linux.dev> crypto: mxs-dcp - fix source scatterlist length access Md Sadre Alam <md.alam(a)oss.qualcomm.com> crypto: qce - fix CCM AAD buffer underallocation Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-tdes - use scatterlist length before DMA mapping Eric Biggers <ebiggers(a)kernel.org> crypto: qcom-rng - Remove crypto_rng interface Eric Biggers <ebiggers(a)kernel.org> crypto: qcom-rng - Allow zero as a random number Eric Biggers <ebiggers(a)kernel.org> crypto: qcom-rng - Enable clock in hwrng case Eric Biggers <ebiggers(a)kernel.org> mm/swap: reject swapon() on filesystem-level encrypted files Fourie Zhang <littleddfu(a)gmail.com> netfilter: nf_tables: don't queue packet path object notifications Kyle Zeng <kylebot(a)openai.com> vxlan: keep the last remote linked during FDB flush Kyle Zeng <kylebot(a)openai.com> batman-adv: reject unrepresentable multicast TVLV offsets Kyle Zeng <kylebot(a)openai.com> ipv6: seg6: clear IPv4 control block on IPIP decapsulation Norbert Szetei <norbert(a)doyensec.com> net: bridge: mcast: fix use-after-free of a master VLAN's multicast context Zihan Xi <zihanx(a)nebusec.ai> xfrm: bound nat keepalive state collection Zihan Xi <zihanx(a)nebusec.ai> xfrm: fix xfrm_state_construct() auth-trunc leak Asim Viladi Oglu Manizada <manizada(a)pm.me> xfrm: ah6: validate routing header segments_left Zihan Xi <xizh2024(a)lzu.edu.cn> xfrm: avoid lock inversion in nat keepalive work Zhiling Zou <roxy520tt(a)gmail.com> xfrm: drop ESP-in-TCP packets with no ingress device Sabrina Dubroca <sd(a)queasysnail.net> xfrm: espintcp: fix UAF during close Hyunwoo Kim <imv4bel(a)gmail.com> net/tcp-ao: fix use-after-free of current_key on reconnect to another peer Qing Ming <a0yami(a)mailbox.org> tcp: fix AO info use-after-free in tcp_ao_connect_init() Rastislav Szabo <rastislav.szabo(a)isovalent.com> net/tcp: fix TCP-AO key deletion in VRFs Pratik Vishwakarma <Pratik.Vishwakarma(a)amd.com> x86/CPU/AMD: Carve out a Zen5 models range Qing Ming <a0yami(a)mailbox.org> gtp: serialize PDP context updates Jiayuan Chen <jiayuan.chen(a)linux.dev> tls: device: fix out-of-bounds write in tls_append_frag() Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> usb: gadget: f_tcm: keep port count until LUN teardown completes Aleksandr Nogikh <nogikh(a)google.com> usb: usbtest: disable dynamic ID support Baokun Li <libaokun(a)linux.alibaba.com> fuse: fix invalidate lock leak on open O_TRUNC DAX failure Baokun Li <libaokun(a)linux.alibaba.com> fuse: fix invalidate lock leak on setattr writeback failure Lucas De Marchi <ldemarchi(a)nvidia.com> xhci: dbgtty: Fix unregister on tty_alloc_driver() failure Lucas De Marchi <ldemarchi(a)nvidia.com> xhci: dbgtty: Fix unregister on tty_register_driver() failure Semih Baskan <strst.gs(a)gmail.com> usb: xhci: Handle USB3 port events when there is one roothub Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> accessibility: speakup: unregister tty ldisc on later init failures Griffin Kroah-Hartman <griffin(a)kroah.com> fpga: dfl: fme: add error handling Jose Villaseñor Montfort <pepemontfort(a)gmail.com> HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event() Chengfeng Ye <nicoyip.dev(a)gmail.com> Bluetooth: hci_sync: Fix accept list UAF during suspend Zijun Hu <zijun.hu(a)oss.qualcomm.com> Bluetooth: hci_sync: Use bt_dev_err() to log error message in hci_update_event_filter_sync() Ibrahim Hashimov <security(a)auditcode.ai> HID: uclogic: fix use-after-free of inrange_timer on remove Raman Varabets <kernel-linux-20260610-80b7ab08(a)raman.v1.sg> HID: ft260: fix stack-use-after-return write in I2C read race Michael Zaidman <michael.zaidman(a)gmail.com> HID: ft260: validate i2c input report length Jann Horn <jannh(a)google.com> HID: asus: fix missing hid_is_usb() check Antheas Kapenekakis <lkml(a)antheas.dev> HID: asus: simplify RGB init sequence Baul Lee <baul.lee(a)xbow.com> HID: pidff: fix OOB write when hid->inputs is empty Tomasz Pakuła <tomasz.pakula.oficjalny(a)gmail.com> HID: pidff: clang-format pass Tomasz Pakuła <tomasz.pakula.oficjalny(a)gmail.com> HID: pidff: Use ARRAY_SIZE macro instead of sizeof Tomasz Pakuła <tomasz.pakula.oficjalny(a)gmail.com> HID: pidff: Rework pidff_set_time() to fix warnings Bryam Vargas <hexlabsecurity(a)proton.me> nfc: nci: add data_len bound checks to activation parameter extractors Ryusuke Konishi <konishi.ryusuke(a)gmail.com> nilfs2: reject invalid block index in GC ioctl Ryusuke Konishi <konishi.ryusuke(a)gmail.com> nilfs2: correct return value kernel-doc descriptions for ioctl functions DaeMyung Kang <charsyam(a)gmail.com> ksmbd: harden file lifetime during session teardown Aboorva Devarajan <aboorvad(a)linux.ibm.com> powerpc/hv-gpci: fix preempt count leak in sysfs show paths Jesper Dangaard Brouer <hawk(a)kernel.org> veth: fix OOB txq access in veth_poll() with asymmetric queue counts Ankit Khushwaha <ankitkhushwaha.linux(a)gmail.com> ring buffer: Propagate __rb_map_vma return value to caller Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: switch two allocations to use kzalloc_objs() Kuniyuki Iwashima <kuniyu(a)google.com> smc: Use __sk_dst_get() and dst_dev_rcu() in smc_vlan_by_tcpsk(). Cristian Ciocaltea <cristian.ciocaltea(a)collabora.com> ASoC: nau8821: Cancel pending work before suspend Sasha Levin <sashal(a)kernel.org> Revert "PM: sleep: Use complete() in device_pm_sleep_init()" Michael Neuling <mikey(a)neuling.org> riscv: Fix register corruption from uninitialized cregs on error Jiayuan Chen <jiayuan.chen(a)linux.dev> bpf: Fix use-after-free in offloaded map/prog info fill Cristian Ciocaltea <cristian.ciocaltea(a)collabora.com> ASoC: nau8821: Cancel delayed work on component remove Kuniyuki Iwashima <kuniyu(a)google.com> smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). Kuniyuki Iwashima <kuniyu(a)google.com> smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set(). Oliver Upton <oliver.upton(a)linux.dev> KVM: arm64: Prevent access to vCPU events before init Kuniyuki Iwashima <kuniyu(a)google.com> smc: Fix use-after-free in __pnet_find_base_ndev(). Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> can: j1939: make j1939_sk_bind() fail if device is no longer registered Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> can: j1939: add missing calls in NETDEV_UNREGISTER notification handler Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> can: j1939: implement NETDEV_UNREGISTER notification handler Vladimir Riabchun <ferr.lambarginio(a)gmail.com> mISDN: hfcpci: Fix warning when deleting uninitialized timer Wentao Liang <vulab(a)iscas.ac.cn> media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode() Namjae Jeon <linkinjeon(a)kernel.org> exfat: fix double free in delayed_free Dylan Wolff <wolffd(a)comp.nus.edu.sg> jfs: Fix null-ptr-deref in jfs_ioc_trim Nick Child <nnac123(a)linux.ibm.com> ibmvnic: Use kernel helpers for hex dumps Vasiliy Kovalev <kovalev(a)altlinux.org> jfs: add check read-only before txBeginAnon() call Vasiliy Kovalev <kovalev(a)altlinux.org> jfs: add check read-only before truncation in jfs_truncate_nolock() Kyle Zeng <kylebot(a)openai.com> perf: Reject exited events as group leaders Bryam Vargas <hexlabsecurity(a)proton.me> selinux: require a class's permission values to cover its permission count Bryam Vargas <hexlabsecurity(a)proton.me> selinux: reject a permission value exceeding the class permission count Christian Göttsche <cgzones(a)googlemail.com> selinux: more strict policy parsing Christian Göttsche <cgzones(a)googlemail.com> selinux: use u16 for security classes Christian Göttsche <cgzones(a)googlemail.com> selinux: make more use of str_read() when loading the policy Christian Göttsche <cgzones(a)googlemail.com> selinux: avoid unnecessary indirection in struct level_datum Christian Göttsche <cgzones(a)googlemail.com> selinux: use known type instead of void pointer Carlos Llamas <cmllamas(a)google.com> HID: uhid: convert to hid_safe_input_report() Dmitry Bogdanov <d.bogdanov(a)yadro.com> nvme-tcp: fix usage of page_frag_cache Vishnu Razdan <vrazdan(a)openai.com> io_uring/io-wq: fix worker accounting when canceling creation callbacks Eric Biggers <ebiggers(a)kernel.org> ext4: don't enable DAX on new encrypted files Jinu Kim <kimjw04271234(a)gmail.com> KVM: x86/mmu: Check write tracking in all address spaces Peiyang He <peiyang_he(a)smail.nju.edu.cn> RDMA/rxe: Fix OOB in free_rd_atomic_resources() Ibrahim Hashimov <security(a)auditcode.ai> RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp ------------- Diffstat: Documentation/filesystems/fscrypt.rst | 4 + Makefile | 4 +- arch/arm64/kvm/arm.c | 6 + arch/powerpc/perf/hv-gpci.c | 24 +- arch/riscv/kernel/compat_signal.c | 2 + arch/riscv/kernel/ptrace.c | 4 +- arch/s390/kvm/vsie.c | 1 + arch/x86/kernel/cpu/amd.c | 1 + arch/x86/kvm/mmu/page_track.c | 32 +- drivers/accessibility/speakup/main.c | 1 + drivers/base/power/main.c | 6 +- drivers/crypto/Kconfig | 1 - drivers/crypto/atmel-tdes.c | 5 +- drivers/crypto/mxs-dcp.c | 2 +- drivers/crypto/qce/aead.c | 58 +--- drivers/crypto/qce/common.c | 55 +-- drivers/crypto/qce/common.h | 16 +- drivers/crypto/qce/regs-v5.h | 4 - drivers/crypto/qce/sha.c | 30 +- drivers/crypto/qce/sha.h | 1 - drivers/crypto/qce/skcipher.c | 97 +----- drivers/crypto/qcom-rng.c | 156 ++------- drivers/fpga/dfl-fme-perf.c | 2 + drivers/hid/hid-asus.c | 52 ++- drivers/hid/hid-ft260.c | 41 ++- drivers/hid/hid-magicmouse.c | 25 +- drivers/hid/hid-uclogic-core.c | 12 +- drivers/hid/uhid.c | 8 +- drivers/hid/usbhid/hid-pidff.c | 106 +++--- drivers/infiniband/sw/rxe/rxe_qp.c | 18 +- drivers/isdn/hardware/mISDN/hfcpci.c | 12 +- .../platform/samsung/exynos4-is/fimc-is-regs.c | 1 + drivers/net/ethernet/ibm/ibmvnic.c | 30 +- drivers/net/gtp.c | 21 +- drivers/net/veth.c | 3 +- drivers/net/vxlan/vxlan_core.c | 11 +- drivers/net/wireless/mediatek/mt76/mt7925/mac.c | 4 + drivers/nvme/host/tcp.c | 8 + drivers/target/target_core_fabric_configfs.c | 8 + drivers/usb/c67x00/c67x00-sched.c | 4 +- drivers/usb/core/devio.c | 2 +- drivers/usb/core/hub.c | 7 +- drivers/usb/gadget/function/f_tcm.c | 2 +- drivers/usb/host/xhci-dbgtty.c | 15 +- drivers/usb/host/xhci-ring.c | 2 +- drivers/usb/misc/usbtest.c | 1 + drivers/usb/serial/option.c | 20 +- drivers/usb/serial/spcp8x5.c | 13 - fs/exfat/nls.c | 1 + fs/ext4/crypto.c | 40 +-- fs/ext4/ialloc.c | 4 + fs/fuse/dir.c | 9 +- fs/fuse/file.c | 4 +- fs/jfs/inode.c | 2 +- fs/jfs/jfs_discard.c | 3 +- fs/jfs/jfs_extent.c | 10 + fs/nilfs2/ioctl.c | 251 +++++++------- fs/smb/server/smb2pdu.c | 6 +- fs/smb/server/vfs_cache.c | 179 ++++++++-- fs/smb/server/vfs_cache.h | 4 +- include/linux/skbuff.h | 24 ++ include/target/target_core_fabric.h | 2 + io_uring/io-wq.c | 9 +- kernel/bpf/offload.c | 10 +- kernel/events/core.c | 10 + kernel/trace/ring_buffer.c | 2 +- mm/swapfile.c | 7 + net/batman-adv/tvlv.c | 5 +- net/bluetooth/hci_sync.c | 48 ++- net/bridge/br_multicast.c | 4 +- net/can/j1939/j1939-priv.h | 1 + net/can/j1939/main.c | 5 + net/can/j1939/socket.c | 55 +++ net/ipv4/tcp_ao.c | 19 +- net/ipv6/ah6.c | 29 +- net/ipv6/seg6_local.c | 7 + net/netfilter/nf_tables_api.c | 36 +- net/nfc/nci/ntf.c | 26 +- net/smc/smc_clc.c | 67 ++-- net/smc/smc_core.c | 27 +- net/smc/smc_pnet.c | 43 +-- net/tls/tls_device.c | 3 +- net/xfrm/espintcp.c | 9 +- net/xfrm/xfrm_nat_keepalive.c | 53 ++- net/xfrm/xfrm_user.c | 2 +- security/selinux/include/security.h | 1 + security/selinux/ss/avtab.c | 43 ++- security/selinux/ss/avtab.h | 21 +- security/selinux/ss/conditional.c | 47 +-- security/selinux/ss/conditional.h | 6 +- security/selinux/ss/constraint.h | 1 + security/selinux/ss/ebitmap.c | 4 +- security/selinux/ss/ebitmap.h | 5 +- security/selinux/ss/mls.c | 6 +- security/selinux/ss/policydb.c | 375 +++++++++++++++------ security/selinux/ss/policydb.h | 51 ++- security/selinux/ss/services.c | 8 +- sound/soc/codecs/nau8821.c | 13 + sound/usb/card.c | 14 +- sound/usb/midi.c | 2 + 100 files changed, 1484 insertions(+), 1067 deletions(-)

3 days, 16 hours

[PATCH 7.1 00/76] 7.1.13-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 7.1.13 release. There are 76 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 02 Sep 2026 13:32:19 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.1.13-rc1… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.1.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 7.1.13-rc1 Miguel Peñaranda <mig.penaranda07(a)gmail.com> usb: usbfs: fix use-after-free of usb_device in usbdev_release() Devin Wittmayer <lucid_duck(a)justthetip.ca> wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> USB: c67x00: fix use-after-free in c67x00_add_iso_urb() Johan Hovold <johan(a)kernel.org> USB: serial: spcp8x5: drop broken carrier detect support Jiale Yao <yaojiale02(a)163.com> USB: serial: option: fix slab OOB read in interrupt URB callback Will Porter <mrwillporter(a)gmail.com> ALSA: usb-audio: Complete cleanup after system-resume errors Marouane El Moufid <eun0us(a)espilon.net> ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() Trevor Vorhees <vorhees-work(a)proton.me> ALSA: usb-audio: Fix sample rates for PreSonus AudioBox USB Griffin Kroah-Hartman <griffin(a)kroah.com> usb: core: Strengthen error handling in hub_hub_status() Griffin Kroah-Hartman <griffin(a)kroah.com> usb: core: Add lock to usb_wakeup_notification() Christian Borntraeger <borntraeger(a)linux.ibm.com> KVM: s390: vsie: zero stale crypto bits Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> crypto: qce - Remove unsafe/deprecated algorithms Thorsten Blum <thorsten.blum(a)linux.dev> crypto: mxs-dcp - fix source scatterlist length access Giovanni Cabiddu <giovanni.cabiddu(a)intel.com> crypto: iaa - fall back to software for multi-entry scatterlists Md Sadre Alam <md.alam(a)oss.qualcomm.com> crypto: qce - fix CCM AAD buffer underallocation Jan Sebastian Götte <linux(a)jaseg.de> crypto: krb5 - use kfree_sensitive() for derived key buffers Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-tdes - use scatterlist length before DMA mapping Eric Biggers <ebiggers(a)kernel.org> crypto: qcom-rng - Allow zero as a random number Eric Biggers <ebiggers(a)kernel.org> crypto: qcom-rng - Remove crypto_rng interface Eric Biggers <ebiggers(a)kernel.org> crypto: qcom-rng - Enable clock in hwrng case Bryam Vargas <hexlabsecurity(a)proton.me> crypto: virtio - bound the akcipher result length Eric Biggers <ebiggers(a)kernel.org> kunit: irq: Continue increasing hrtimer interval for longer Eric Biggers <ebiggers(a)kernel.org> mm/swap: reject swapon() on filesystem-level encrypted files Fourie Zhang <littleddfu(a)gmail.com> netfilter: nf_tables: don't queue packet path object notifications Eric Biggers <ebiggers(a)kernel.org> netfilter: nft_set_pipapo_avx2: add missing vzeroupper Kyle Zeng <kylebot(a)openai.com> vxlan: keep the last remote linked during FDB flush Kyle Zeng <kylebot(a)openai.com> batman-adv: reject unrepresentable multicast TVLV offsets Kyle Zeng <kylebot(a)openai.com> ipv6: seg6: clear IPv4 control block on IPIP decapsulation Kyle Zeng <kylebot(a)openai.com> net/packet: defer vmalloc TX_RING free until skbs finish Norbert Szetei <norbert(a)doyensec.com> net: bridge: mcast: fix use-after-free of a master VLAN's multicast context Zihan Xi <zihanx(a)nebusec.ai> xfrm: bound nat keepalive state collection Zihan Xi <zihanx(a)nebusec.ai> xfrm: fix xfrm_state_construct() auth-trunc leak Asim Viladi Oglu Manizada <manizada(a)pm.me> xfrm: ah6: validate routing header segments_left Zihan Xi <xizh2024(a)lzu.edu.cn> xfrm: avoid lock inversion in nat keepalive work Zhiling Zou <roxy520tt(a)gmail.com> xfrm: drop ESP-in-TCP packets with no ingress device Yong Wang <edragain(a)163.com> tcp: clamp route advmss to TCP_MIN_MSS Sabrina Dubroca <sd(a)queasysnail.net> xfrm: espintcp: fix UAF during close Jiayuan Chen <jiayuan.chen(a)linux.dev> net: advertise TCP MSS from the configured MTU, not the learned PMTU Hyunwoo Kim <imv4bel(a)gmail.com> net/tcp-ao: fix use-after-free of current_key on reconnect to another peer Qing Ming <a0yami(a)mailbox.org> tcp: fix AO info use-after-free in tcp_ao_connect_init() Rastislav Szabo <rastislav.szabo(a)isovalent.com> net/tcp: fix TCP-AO key deletion in VRFs Qing Ming <a0yami(a)mailbox.org> gtp: serialize PDP context updates Jiayuan Chen <jiayuan.chen(a)linux.dev> tls: device: fix out-of-bounds write in tls_append_frag() Sean Christopherson <seanjc(a)google.com> KVM: SEV: Wire up kvm_x86_ops.gmem_xxx() if and only if CONFIG_KVM_AMD_SEV=y Sean Christopherson <seanjc(a)google.com> KVM: SEV: Mark vCPU RUNNABLE after AP_CREATE, even if VMSA is unusable Sean Christopherson <seanjc(a)google.com> KVM: SEV: Extract loading of guest-provided VMSA to a separate helper Sean Christopherson <seanjc(a)google.com> KVM: SEV: Track the GPA of the guest-controlled VMSA used for SNP guests Pankaj Gupta <pankaj.gupta(a)amd.com> KVM: SEV: Drop FOLL_WRITE for encrypted region registration Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> usb: gadget: f_tcm: keep port count until LUN teardown completes Aleksandr Nogikh <nogikh(a)google.com> usb: usbtest: disable dynamic ID support Baokun Li <libaokun(a)linux.alibaba.com> fuse: fix invalidate lock leak on open O_TRUNC DAX failure Baokun Li <libaokun(a)linux.alibaba.com> fuse: fix invalidate lock leak on setattr writeback failure Lucas De Marchi <ldemarchi(a)nvidia.com> xhci: dbgtty: Fix unregister on tty_alloc_driver() failure Lucas De Marchi <ldemarchi(a)nvidia.com> xhci: dbgtty: Fix unregister on tty_register_driver() failure Breno Leitao <leitao(a)debian.org> usb: xhci: bail out of setup if the controller is inaccessible Semih Baskan <strst.gs(a)gmail.com> usb: xhci: Handle USB3 port events when there is one roothub Michal Pecio <michal.pecio(a)gmail.com> usb: xhci: Handle bogus TRB pointers in Missed Service Error events Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> accessibility: speakup: unregister tty ldisc on later init failures Griffin Kroah-Hartman <griffin(a)kroah.com> fpga: dfl: fme: add error handling Zhang Yi <yi.zhang(a)huawei.com> ext4: zero out whole block for clean edges in WRITE_ZEROES Zhang Yi <yi.zhang(a)huawei.com> ext4: track partial-zero outcome per edge in ext4_zero_partial_blocks() Zhang Yi <yi.zhang(a)huawei.com> ext4: write back partial-zeroed edges in WRITE_ZEROES Zhang Yi <yi.zhang(a)huawei.com> ext4: move partial block zeroing earlier in ext4_zero_range() Zhang Yi <yi.zhang(a)huawei.com> ext4: protect WRITE_ZEROES written extents with orphan list Zhang Yi <yi.zhang(a)huawei.com> ext4: export converted block count from ext4_convert_unwritten_extents() Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: switch two allocations to use kzalloc_objs() Bryam Vargas <hexlabsecurity(a)proton.me> selinux: require a class's permission values to cover its permission count Bryam Vargas <hexlabsecurity(a)proton.me> selinux: reject a permission value exceeding the class permission count Christian Göttsche <cgzones(a)googlemail.com> selinux: more strict policy parsing Christian Göttsche <cgzones(a)googlemail.com> selinux: use u16 for security classes Wentao Guan <guanwentao(a)uniontech.com> Revert "selinux: reject a permission value exceeding the class permission count" Dmitry Bogdanov <d.bogdanov(a)yadro.com> nvme-tcp: fix usage of page_frag_cache Jinu Kim <kimjw04271234(a)gmail.com> KVM: x86/mmu: Check write tracking in all address spaces Peiyang He <peiyang_he(a)smail.nju.edu.cn> RDMA/rxe: Fix OOB in free_rd_atomic_resources() Ibrahim Hashimov <security(a)auditcode.ai> RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp Taegu Ha <hataegu0826(a)gmail.com> bpf: reject overlarge global subprog argument sizes ------------- Diffstat: Documentation/filesystems/fscrypt.rst | 4 + Makefile | 4 +- arch/s390/kvm/vsie.c | 1 + arch/x86/kvm/mmu/page_track.c | 32 ++- arch/x86/kvm/svm/sev.c | 76 +++--- arch/x86/kvm/svm/svm.c | 8 +- arch/x86/kvm/svm/svm.h | 13 +- crypto/krb5/krb5_api.c | 8 +- drivers/accessibility/speakup/main.c | 1 + drivers/crypto/Kconfig | 1 - drivers/crypto/atmel-tdes.c | 5 +- drivers/crypto/intel/iaa/iaa_crypto_main.c | 111 ++++----- drivers/crypto/intel/iaa/iaa_crypto_stats.c | 9 + drivers/crypto/intel/iaa/iaa_crypto_stats.h | 2 + drivers/crypto/mxs-dcp.c | 2 +- drivers/crypto/qce/aead.c | 58 +---- drivers/crypto/qce/common.c | 55 +---- drivers/crypto/qce/common.h | 16 +- drivers/crypto/qce/regs-v5.h | 4 - drivers/crypto/qce/sha.c | 30 +-- drivers/crypto/qce/sha.h | 1 - drivers/crypto/qce/skcipher.c | 97 +------- drivers/crypto/qcom-rng.c | 156 ++----------- .../crypto/virtio/virtio_crypto_akcipher_algs.c | 3 +- drivers/fpga/dfl-fme-perf.c | 2 + drivers/infiniband/sw/rxe/rxe_qp.c | 18 +- drivers/net/gtp.c | 21 +- drivers/net/vxlan/vxlan_core.c | 11 +- drivers/net/wireless/mediatek/mt76/mt7925/mac.c | 4 + drivers/nvme/host/tcp.c | 8 + drivers/target/target_core_fabric_configfs.c | 8 + drivers/usb/c67x00/c67x00-sched.c | 4 +- drivers/usb/core/devio.c | 2 +- drivers/usb/core/hub.c | 7 +- drivers/usb/gadget/function/f_tcm.c | 2 +- drivers/usb/host/xhci-dbgtty.c | 15 +- drivers/usb/host/xhci-ring.c | 20 +- drivers/usb/host/xhci.c | 11 +- drivers/usb/misc/usbtest.c | 1 + drivers/usb/serial/option.c | 20 +- drivers/usb/serial/spcp8x5.c | 13 -- fs/ext4/ext4.h | 8 +- fs/ext4/extents.c | 168 +++++++++++--- fs/ext4/file.c | 3 +- fs/ext4/inode.c | 36 ++- fs/fuse/dir.c | 9 +- fs/fuse/file.c | 4 +- include/kunit/run-in-irq-context.h | 10 +- include/linux/skbuff.h | 24 ++ include/net/ip.h | 25 ++ include/net/ip6_route.h | 37 +++ include/net/tcp.h | 5 + include/target/target_core_fabric.h | 2 + kernel/bpf/verifier.c | 6 + mm/swapfile.c | 7 + net/batman-adv/tvlv.c | 5 +- net/bridge/br_multicast.c | 4 +- net/ipv4/route.c | 4 +- net/ipv4/tcp_ao.c | 19 +- net/ipv4/tcp_ipv4.c | 2 +- net/ipv4/tcp_minisocks.c | 2 +- net/ipv4/tcp_output.c | 6 +- net/ipv6/ah6.c | 29 ++- net/ipv6/route.c | 2 +- net/ipv6/seg6_local.c | 7 + net/ipv6/tcp_ipv6.c | 2 +- net/netfilter/nf_tables_api.c | 36 +-- net/netfilter/nft_set_pipapo_avx2.c | 17 +- net/packet/af_packet.c | 96 +++++++- net/tls/tls_device.c | 3 +- net/xfrm/espintcp.c | 9 +- net/xfrm/xfrm_nat_keepalive.c | 53 ++++- net/xfrm/xfrm_user.c | 2 +- security/selinux/include/security.h | 1 + security/selinux/ss/avtab.c | 35 ++- security/selinux/ss/avtab.h | 13 ++ security/selinux/ss/conditional.c | 22 +- security/selinux/ss/constraint.h | 1 + security/selinux/ss/policydb.c | 254 +++++++++++++++++---- security/selinux/ss/policydb.h | 31 ++- security/selinux/ss/services.c | 8 +- sound/usb/card.c | 14 +- sound/usb/midi.c | 2 + sound/usb/quirks-table.h | 10 + .../selftests/bpf/progs/verifier_global_subprogs.c | 17 ++ 85 files changed, 1186 insertions(+), 728 deletions(-)

3 days, 17 hours

[PATCH 5.10 00/43] 5.10.269-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 5.10.269 release. There are 43 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 02 Sep 2026 13:32:19 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.269-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 5.10.269-rc1 Miguel Peñaranda <mig.penaranda07(a)gmail.com> usb: usbfs: fix use-after-free of usb_device in usbdev_release() Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> USB: c67x00: fix use-after-free in c67x00_add_iso_urb() Johan Hovold <johan(a)kernel.org> USB: serial: spcp8x5: drop broken carrier detect support Jiale Yao <yaojiale02(a)163.com> USB: serial: option: fix slab OOB read in interrupt URB callback Marouane El Moufid <eun0us(a)espilon.net> ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() Griffin Kroah-Hartman <griffin(a)kroah.com> usb: core: Strengthen error handling in hub_hub_status() Griffin Kroah-Hartman <griffin(a)kroah.com> usb: core: Add lock to usb_wakeup_notification() Christian Borntraeger <borntraeger(a)linux.ibm.com> KVM: s390: vsie: zero stale crypto bits Thorsten Blum <thorsten.blum(a)linux.dev> crypto: mxs-dcp - fix source scatterlist length access Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-tdes - use scatterlist length before DMA mapping Eric Biggers <ebiggers(a)kernel.org> mm/swap: reject swapon() on filesystem-level encrypted files Kyle Zeng <kylebot(a)openai.com> ipv6: seg6: clear IPv4 control block on IPIP decapsulation Zihan Xi <zihanx(a)nebusec.ai> xfrm: fix xfrm_state_construct() auth-trunc leak Asim Viladi Oglu Manizada <manizada(a)pm.me> xfrm: ah6: validate routing header segments_left Zhiling Zou <roxy520tt(a)gmail.com> xfrm: drop ESP-in-TCP packets with no ingress device Sabrina Dubroca <sd(a)queasysnail.net> xfrm: espintcp: fix UAF during close Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> usb: gadget: f_tcm: keep port count until LUN teardown completes Aleksandr Nogikh <nogikh(a)google.com> usb: usbtest: disable dynamic ID support Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> accessibility: speakup: unregister tty ldisc on later init failures Griffin Kroah-Hartman <griffin(a)kroah.com> fpga: dfl: fme: add error handling Jose Villaseñor Montfort <pepemontfort(a)gmail.com> HID: input: read battery capacity from its actual report offset Ibrahim Hashimov <security(a)auditcode.ai> nvmet-tcp: bound SGL data length before allocating command buffers Bryam Vargas <hexlabsecurity(a)proton.me> nfc: nci: add data_len bound checks to activation parameter extractors Jose Villaseñor Montfort <pepemontfort(a)gmail.com> HID: magicmouse: do not keep a stale msc->input if no input is claimed Samuel Page <sam(a)bynar.io> nfc: nci: fix uninit-value in the RF discover/activated NTF handlers Ryusuke Konishi <konishi.ryusuke(a)gmail.com> nilfs2: reject invalid block index in GC ioctl Guanghui Yang <3497809730(a)qq.com> ext4: propagate errors from fast commit range replay Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> kcov: fix data corruption and race conditions on PREEMPT_RT Eric Dumazet <edumazet(a)google.com> ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() Sasha Levin <sashal(a)kernel.org> Revert "smb: client: use kvzalloc() for megabyte buffer in simple fallocate" Sasha Levin <sashal(a)kernel.org> Revert "mtd: maps: vmu-flash: fix fault in unaligned fixup" Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: switch two allocations to use kzalloc_objs() Sasha Levin <sashal(a)kernel.org> Revert "PM: sleep: Use complete() in device_pm_sleep_init()" Jiayuan Chen <jiayuan.chen(a)linux.dev> bpf: Fix use-after-free in offloaded map/prog info fill Oliver Upton <oliver.upton(a)linux.dev> KVM: arm64: Prevent access to vCPU events before init Vasiliy Kovalev <kovalev(a)altlinux.org> jfs: add check read-only before txBeginAnon() call Vasiliy Kovalev <kovalev(a)altlinux.org> jfs: add check read-only before truncation in jfs_truncate_nolock() Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> bpf: Remove tst_run from lwt_seg6local_prog_ops. Vishnu Razdan <vrazdan(a)openai.com> io_uring/io-wq: fix worker accounting when canceling creation callbacks Florian Westphal <fw(a)strlen.de> ipvs: reload ip header after head reallocation Eric Biggers <ebiggers(a)kernel.org> ext4: don't enable DAX on new encrypted files Ido Schimmel <idosch(a)nvidia.com> ipv6: mcast: Fix use-after-free when processing MLD queries Peiyang He <peiyang_he(a)smail.nju.edu.cn> RDMA/rxe: Fix OOB in free_rd_atomic_resources() ------------- Diffstat: Documentation/filesystems/fscrypt.rst | 4 ++ Makefile | 4 +- arch/arm64/kvm/arm.c | 6 ++ arch/s390/kvm/vsie.c | 1 + drivers/accessibility/speakup/main.c | 1 + drivers/base/power/main.c | 6 +- drivers/crypto/atmel-tdes.c | 5 +- drivers/crypto/mxs-dcp.c | 2 +- drivers/fpga/dfl-fme-perf.c | 2 + drivers/hid/hid-input.c | 17 +++-- drivers/hid/hid-magicmouse.c | 10 +++ drivers/infiniband/sw/rxe/rxe_qp.c | 3 +- drivers/mtd/maps/vmu-flash.c | 8 ++- drivers/nvme/target/tcp.c | 13 ++++ drivers/target/target_core_fabric_configfs.c | 8 +++ drivers/usb/c67x00/c67x00-sched.c | 4 +- drivers/usb/core/devio.c | 2 +- drivers/usb/core/hub.c | 7 ++- drivers/usb/gadget/function/f_tcm.c | 2 +- drivers/usb/misc/usbtest.c | 1 + drivers/usb/serial/option.c | 20 +++++- drivers/usb/serial/spcp8x5.c | 13 ---- fs/cifs/smb2ops.c | 4 +- fs/ext4/fast_commit.c | 10 ++- fs/ext4/ialloc.c | 4 ++ fs/ext4/super.c | 40 ++++++------ fs/jfs/inode.c | 2 +- fs/jfs/jfs_extent.c | 10 +++ fs/nilfs2/ioctl.c | 21 ++++++- include/linux/hid.h | 1 + include/linux/inetdevice.h | 5 ++ include/linux/sched.h | 8 +++ include/target/target_core_fabric.h | 2 + io_uring/io-wq.c | 9 ++- kernel/bpf/offload.c | 10 ++- kernel/kcov.c | 93 ++++++++++++++-------------- lib/Kconfig.debug | 5 +- mm/swapfile.c | 7 +++ net/core/filter.c | 1 - net/ipv4/igmp.c | 14 +++-- net/ipv6/ah6.c | 29 +++++---- net/ipv6/mcast.c | 8 +-- net/ipv6/seg6_local.c | 7 +++ net/netfilter/ipvs/ip_vs_xmit.c | 6 +- net/nfc/nci/ntf.c | 32 ++++++++-- net/xfrm/espintcp.c | 9 ++- net/xfrm/xfrm_user.c | 2 +- security/selinux/ss/conditional.c | 12 ++-- sound/usb/midi.c | 2 + 49 files changed, 326 insertions(+), 166 deletions(-)

3 days, 19 hours

[PATCH 6.1 00/92] 6.1.187-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.1.187 release. There are 92 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 02 Sep 2026 13:32:19 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.187-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.1.187-rc1 Miguel Peñaranda <mig.penaranda07(a)gmail.com> usb: usbfs: fix use-after-free of usb_device in usbdev_release() Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> USB: c67x00: fix use-after-free in c67x00_add_iso_urb() Johan Hovold <johan(a)kernel.org> USB: serial: spcp8x5: drop broken carrier detect support Jiale Yao <yaojiale02(a)163.com> USB: serial: option: fix slab OOB read in interrupt URB callback Will Porter <mrwillporter(a)gmail.com> ALSA: usb-audio: Complete cleanup after system-resume errors Marouane El Moufid <eun0us(a)espilon.net> ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() Griffin Kroah-Hartman <griffin(a)kroah.com> usb: core: Strengthen error handling in hub_hub_status() Griffin Kroah-Hartman <griffin(a)kroah.com> usb: core: Add lock to usb_wakeup_notification() Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_core: Fix hci_conn_hash_lookup_cis Christian Borntraeger <borntraeger(a)linux.ibm.com> KVM: s390: vsie: zero stale crypto bits Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> crypto: qce - Remove unsafe/deprecated algorithms Thorsten Blum <thorsten.blum(a)linux.dev> crypto: mxs-dcp - fix source scatterlist length access Md Sadre Alam <md.alam(a)oss.qualcomm.com> crypto: qce - fix CCM AAD buffer underallocation Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-tdes - use scatterlist length before DMA mapping Eric Biggers <ebiggers(a)kernel.org> mm/swap: reject swapon() on filesystem-level encrypted files Kyle Zeng <kylebot(a)openai.com> ipv6: seg6: clear IPv4 control block on IPIP decapsulation Norbert Szetei <norbert(a)doyensec.com> net: bridge: mcast: fix use-after-free of a master VLAN's multicast context Zihan Xi <zihanx(a)nebusec.ai> xfrm: fix xfrm_state_construct() auth-trunc leak Asim Viladi Oglu Manizada <manizada(a)pm.me> xfrm: ah6: validate routing header segments_left Zhiling Zou <roxy520tt(a)gmail.com> xfrm: drop ESP-in-TCP packets with no ingress device Sabrina Dubroca <sd(a)queasysnail.net> xfrm: espintcp: fix UAF during close Jiayuan Chen <jiayuan.chen(a)linux.dev> tls: device: fix out-of-bounds write in tls_append_frag() Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> usb: gadget: f_tcm: keep port count until LUN teardown completes Aleksandr Nogikh <nogikh(a)google.com> usb: usbtest: disable dynamic ID support Baokun Li <libaokun(a)linux.alibaba.com> fuse: fix invalidate lock leak on open O_TRUNC DAX failure Baokun Li <libaokun(a)linux.alibaba.com> fuse: fix invalidate lock leak on setattr writeback failure Lucas De Marchi <ldemarchi(a)nvidia.com> xhci: dbgtty: Fix unregister on tty_alloc_driver() failure Lucas De Marchi <ldemarchi(a)nvidia.com> xhci: dbgtty: Fix unregister on tty_register_driver() failure Semih Baskan <strst.gs(a)gmail.com> usb: xhci: Handle USB3 port events when there is one roothub Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> accessibility: speakup: unregister tty ldisc on later init failures Griffin Kroah-Hartman <griffin(a)kroah.com> fpga: dfl: fme: add error handling Eric Dumazet <edumazet(a)google.com> ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() Laxman Acharya Padhya <acharyalaxman8848(a)gmail.com> Bluetooth: hci_event: validate LE Set CIG Parameters response Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_event: fix Set CIG Parameters error status handling Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: use correct CIS order in Set CIG Parameters event Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_conn: Fix not matching by CIS ID Chengfeng Ye <nicoyip.dev(a)gmail.com> Bluetooth: hci_sync: Fix accept list UAF during suspend Zijun Hu <zijun.hu(a)oss.qualcomm.com> Bluetooth: hci_sync: Use bt_dev_err() to log error message in hci_update_event_filter_sync() Raman Varabets <kernel-linux-20260610-80b7ab08(a)raman.v1.sg> HID: ft260: fix stack-use-after-return write in I2C read race Michael Zaidman <michael.zaidman(a)gmail.com> HID: ft260: validate i2c input report length Michael Zaidman <michael.zaidman(a)gmail.com> HID: ft260: missed NACK from busy device Michael Zaidman <michael.zaidman(a)gmail.com> HID: ft260: wake up device from power saving mode Michael Zaidman <michael.zaidman(a)gmail.com> HID: ft260: skip unexpected HID input reports Michael Zaidman <michael.zaidman(a)gmail.com> HID: ft260: improve i2c large reads performance Michael Zaidman <michael.zaidman(a)gmail.com> HID: ft260: improve i2c write performance Ibrahim Hashimov <security(a)auditcode.ai> HID: uclogic: fix use-after-free of inrange_timer on remove Jiangshan Yi <yijiangshan(a)kylinos.cn> HID: nintendo: stop device IO before hid_hw_stop on probe failure Ibrahim Hashimov <security(a)auditcode.ai> nvmet-tcp: bound SGL data length before allocating command buffers Weiwen Hu <huweiwen(a)linux.alibaba.com> nvme: rename CDR/MORE/DNR to NVME_STATUS_* Christopher Kodama <ckhordiasma(a)gmail.com> HID: magicmouse: re-enable multitouch after reset-resume Jose Villaseñor Montfort <pepemontfort(a)gmail.com> HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event() Andrei Fed <andfed.net(a)gmail.com> HID: magicmouse: fix battery reporting for Bluetooth Magic Trackpad USB-C Bryam Vargas <hexlabsecurity(a)proton.me> nfc: nci: add data_len bound checks to activation parameter extractors Ryusuke Konishi <konishi.ryusuke(a)gmail.com> nilfs2: reject invalid block index in GC ioctl Ryusuke Konishi <konishi.ryusuke(a)gmail.com> nilfs2: correct return value kernel-doc descriptions for ioctl functions Guanghui Yang <3497809730(a)qq.com> ext4: propagate errors from fast commit range replay Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: pm: fix memory leak from alloc-during-teardown race Christoph Hellwig <hch(a)lst.de> block: make bio_check_eod work for zero sized devices Jon Hunter <jonathanh(a)nvidia.com> ASoC: tegra: Fix Master Volume Control Sasha Levin <sashal(a)kernel.org> Revert "smb: client: use kvzalloc() for megabyte buffer in simple fallocate" Sasha Levin <sashal(a)kernel.org> Revert "mtd: maps: vmu-flash: fix fault in unaligned fixup" Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: switch two allocations to use kzalloc_objs() Kuniyuki Iwashima <kuniyu(a)google.com> smc: Use __sk_dst_get() and dst_dev_rcu() in smc_vlan_by_tcpsk(). Cristian Ciocaltea <cristian.ciocaltea(a)collabora.com> ASoC: nau8821: Cancel pending work before suspend Sasha Levin <sashal(a)kernel.org> Revert "PM: sleep: Use complete() in device_pm_sleep_init()" Michael Neuling <mikey(a)neuling.org> riscv: Fix register corruption from uninitialized cregs on error Jiayuan Chen <jiayuan.chen(a)linux.dev> bpf: Fix use-after-free in offloaded map/prog info fill Cristian Ciocaltea <cristian.ciocaltea(a)collabora.com> ASoC: nau8821: Cancel delayed work on component remove Kuniyuki Iwashima <kuniyu(a)google.com> smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). Kuniyuki Iwashima <kuniyu(a)google.com> smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set(). Oliver Upton <oliver.upton(a)linux.dev> KVM: arm64: Prevent access to vCPU events before init Kuniyuki Iwashima <kuniyu(a)google.com> smc: Fix use-after-free in __pnet_find_base_ndev(). Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> can: j1939: make j1939_sk_bind() fail if device is no longer registered Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> can: j1939: add missing calls in NETDEV_UNREGISTER notification handler Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> can: j1939: implement NETDEV_UNREGISTER notification handler Vladimir Riabchun <ferr.lambarginio(a)gmail.com> mISDN: hfcpci: Fix warning when deleting uninitialized timer Wentao Liang <vulab(a)iscas.ac.cn> media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode() Namjae Jeon <linkinjeon(a)kernel.org> exfat: fix double free in delayed_free Dylan Wolff <wolffd(a)comp.nus.edu.sg> jfs: Fix null-ptr-deref in jfs_ioc_trim Nick Child <nnac123(a)linux.ibm.com> ibmvnic: Use kernel helpers for hex dumps Vasiliy Kovalev <kovalev(a)altlinux.org> jfs: add check read-only before txBeginAnon() call Vasiliy Kovalev <kovalev(a)altlinux.org> jfs: add check read-only before truncation in jfs_truncate_nolock() Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> bpf: Remove tst_run from lwt_seg6local_prog_ops. Ben Skeggs <bskeggs(a)redhat.com> drm/nouveau/kms/nv50-: init hpd_irq_lock for PIOR DP Ziyang Huang <hzyitc(a)outlook.com> wifi: ath11k: Add missing hw_ops->get_ring_selector() for IPQ5018 Ralf Lici <ralf(a)mandelbit.com> Revert "usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal" Florian Westphal <fw(a)strlen.de> ipvs: reload ip header after head reallocation Vishnu Razdan <vrazdan(a)openai.com> io_uring/io-wq: fix worker accounting when canceling creation callbacks Eric Biggers <ebiggers(a)kernel.org> ext4: don't enable DAX on new encrypted files Jinu Kim <kimjw04271234(a)gmail.com> KVM: x86/mmu: Check write tracking in all address spaces Eric Dumazet <edumazet(a)google.com> inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP Peiyang He <peiyang_he(a)smail.nju.edu.cn> RDMA/rxe: Fix OOB in free_rd_atomic_resources() ------------- Diffstat: Documentation/filesystems/fscrypt.rst | 4 + Makefile | 4 +- arch/arm64/kvm/arm.c | 6 + arch/riscv/kernel/compat_signal.c | 2 + arch/riscv/kernel/ptrace.c | 4 +- arch/s390/kvm/vsie.c | 1 + arch/x86/kvm/mmu/page_track.c | 28 ++- block/blk-core.c | 2 +- drivers/accessibility/speakup/main.c | 1 + drivers/base/power/main.c | 6 +- drivers/crypto/atmel-tdes.c | 5 +- drivers/crypto/mxs-dcp.c | 2 +- drivers/crypto/qce/aead.c | 58 +---- drivers/crypto/qce/common.c | 55 +---- drivers/crypto/qce/common.h | 16 +- drivers/crypto/qce/regs-v5.h | 4 - drivers/crypto/qce/sha.c | 30 +-- drivers/crypto/qce/sha.h | 1 - drivers/crypto/qce/skcipher.c | 97 +------- drivers/fpga/dfl-fme-perf.c | 2 + drivers/gpu/drm/nouveau/dispnv50/disp.c | 4 + drivers/hid/hid-ft260.c | 157 ++++++++++--- drivers/hid/hid-input.c | 3 + drivers/hid/hid-magicmouse.c | 63 +++++- drivers/hid/hid-nintendo.c | 13 +- drivers/hid/hid-uclogic-core.c | 12 +- drivers/infiniband/sw/rxe/rxe_qp.c | 3 +- drivers/isdn/hardware/mISDN/hfcpci.c | 12 +- .../platform/samsung/exynos4-is/fimc-is-regs.c | 1 + drivers/mtd/maps/vmu-flash.c | 8 +- drivers/net/ethernet/ibm/ibmvnic.c | 30 ++- drivers/net/wireless/ath/ath11k/hw.c | 2 +- drivers/nvme/host/core.c | 18 +- drivers/nvme/host/fabrics.c | 8 +- drivers/nvme/host/fault_inject.c | 2 +- drivers/nvme/host/fc.c | 8 +- drivers/nvme/target/admin-cmd.c | 22 +- drivers/nvme/target/core.c | 46 ++-- drivers/nvme/target/discovery.c | 14 +- drivers/nvme/target/fabrics-cmd-auth.c | 16 +- drivers/nvme/target/fabrics-cmd.c | 36 +-- drivers/nvme/target/io-cmd-bdev.c | 12 +- drivers/nvme/target/nvmet.h | 2 +- drivers/nvme/target/passthru.c | 10 +- drivers/nvme/target/rdma.c | 10 +- drivers/nvme/target/tcp.c | 17 +- drivers/nvme/target/zns.c | 30 +-- drivers/target/target_core_fabric_configfs.c | 8 + drivers/usb/c67x00/c67x00-sched.c | 4 +- drivers/usb/core/devio.c | 2 +- drivers/usb/core/hub.c | 7 +- drivers/usb/gadget/function/f_tcm.c | 2 +- drivers/usb/host/xhci-dbgtty.c | 15 +- drivers/usb/host/xhci-ring.c | 2 +- drivers/usb/misc/usbtest.c | 1 + drivers/usb/phy/phy-fsl-usb.c | 1 - drivers/usb/serial/option.c | 20 +- drivers/usb/serial/spcp8x5.c | 13 -- fs/exfat/nls.c | 1 + fs/ext4/crypto.c | 40 ++-- fs/ext4/fast_commit.c | 10 +- fs/ext4/ialloc.c | 4 + fs/fuse/dir.c | 9 +- fs/fuse/file.c | 4 +- fs/jfs/inode.c | 2 +- fs/jfs/jfs_discard.c | 3 +- fs/jfs/jfs_extent.c | 10 + fs/nilfs2/ioctl.c | 251 ++++++++++----------- fs/smb/client/smb2ops.c | 4 +- include/linux/inetdevice.h | 5 + include/linux/nvme.h | 6 +- include/net/bluetooth/hci_core.h | 15 +- include/target/target_core_fabric.h | 2 + io_uring/io-wq.c | 9 +- kernel/bpf/offload.c | 10 +- mm/swapfile.c | 7 + net/bluetooth/hci_conn.c | 3 +- net/bluetooth/hci_event.c | 46 ++-- net/bluetooth/hci_sync.c | 48 +++- net/bridge/br_multicast.c | 4 +- net/can/j1939/j1939-priv.h | 1 + net/can/j1939/main.c | 5 + net/can/j1939/socket.c | 55 +++++ net/core/filter.c | 1 - net/ipv4/icmp.c | 14 +- net/ipv4/igmp.c | 14 +- net/ipv6/ah6.c | 29 ++- net/ipv6/icmp.c | 3 + net/ipv6/seg6_local.c | 7 + net/mptcp/pm_netlink.c | 3 + net/mptcp/pm_userspace.c | 10 +- net/mptcp/protocol.c | 5 + net/mptcp/protocol.h | 7 +- net/netfilter/ipvs/ip_vs_xmit.c | 6 +- net/nfc/nci/ntf.c | 26 ++- net/smc/smc_clc.c | 67 +++--- net/smc/smc_core.c | 27 +-- net/smc/smc_pnet.c | 43 ++-- net/tls/tls_device.c | 3 +- net/xfrm/espintcp.c | 9 +- net/xfrm/xfrm_user.c | 2 +- security/selinux/ss/conditional.c | 12 +- sound/soc/codecs/nau8821.c | 13 ++ sound/soc/tegra/tegra_pcm.c | 3 + sound/usb/card.c | 14 +- sound/usb/midi.c | 2 + 106 files changed, 1028 insertions(+), 808 deletions(-)

3 days, 19 hours

[PATCH 7.1 000/101] 7.1.11-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 7.1.11 release. There are 101 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 27 Aug 2026 13:25:02 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.1.11-rc1… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.1.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 7.1.11-rc1 Laxman Acharya Padhya <acharyalaxman8848(a)gmail.com> Bluetooth: hci_aml: validate firmware segment lengths Ali Ahmet Memis <ali(a)iusegentoo.com> Bluetooth: MGMT: reject HCI_CMD_SYNC params_len above 255 Ali Ahmet Memis <ali(a)iusegentoo.com> Bluetooth: ISO: zero the sockaddr before returning it in getname Ali Ahmet Memis <ali(a)iusegentoo.com> Bluetooth: ISO: do not force BT_LISTEN after a failed BIG sync Chengfeng Ye <nicoyip.dev(a)gmail.com> Bluetooth: hci_sync: Fix accept list UAF during suspend Laxman Acharya Padhya <acharyalaxman8848(a)gmail.com> Bluetooth: hci_event: validate LE Set CIG Parameters response Chengfeng Ye <nicoyip.dev(a)gmail.com> Bluetooth: hci_event: fix LE list UAF on reset Linus Torvalds <torvalds(a)linux-foundation.org> drm/xe: Don't hand out the flat CCS storage as usable VRAM Jose Villaseñor Montfort <pepemontfort(a)gmail.com> HID: input: read battery capacity from its actual report offset Michael Bommarito <michael.bommarito(a)gmail.com> HID: hyperv: validate initial device info bounds Ibrahim Hashimov <security(a)auditcode.ai> HID: uclogic: fix use-after-free of inrange_timer on remove Haoxiang Li <haoxiang_li2024(a)163.com> HID: sensor: custom: Fix use-after-free in enable_sensor Raman Varabets <kernel-linux-20260610-80b7ab08(a)raman.v1.sg> HID: ft260: fix stack-use-after-return write in I2C read race Jann Horn <jannh(a)google.com> HID: core: fix number/pointer type confusion on long items Jann Horn <jannh(a)google.com> HID: rapoo: fix missing hid_is_usb() check Jiangshan Yi <yijiangshan(a)kylinos.cn> HID: nintendo: stop device IO before hid_hw_stop on probe failure Jiangshan Yi <yijiangshan(a)kylinos.cn> HID: nintendo: register input device after capabilities are set Ibrahim Hashimov <security(a)auditcode.ai> HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler() Jann Horn <jannh(a)google.com> HID: huawei: fix missing hid_is_usb() check Jann Horn <jannh(a)google.com> HID: asus: fix missing hid_is_usb() check Peter Zijlstra <peterz(a)infradead.org> futex: Fix might_sleep() warning in futex_pivot_pending() Hyunwoo Kim <imv4bel(a)gmail.com> futex: Fix race on the initial mm->futex.phash.ref allocation Yao Kai <yaokai34(a)huawei.com> futex: Fix race in futex_pivot_pending() during private hash resize Thomas Gleixner <tglx(a)kernel.org> futex/pi: Plug private futex exec() race Thomas Gleixner <tglx(a)kernel.org> futex: Sanitize and document task_struct::futex::state transitions Kyle Zeng <kylebot(a)openai.com> futex/pi: Reject cross-mm private futex owners Anand Khoje <anand.a.khoje(a)oracle.com> net/ionic: avoid OOB TX partner lookup for hwstamp RXQ Baul Lee <baul.lee(a)xbow.com> HID: pidff: fix OOB write when hid->inputs is empty Baul Lee <baul.lee(a)xbow.com> HID: core: fix OOB read of field->usage in hid_set_field() Jose Villaseñor Montfort <pepemontfort(a)gmail.com> HID: magicmouse: do not keep a stale msc->input if no input is claimed Christopher Kodama <ckhordiasma(a)gmail.com> HID: magicmouse: re-enable multitouch after reset-resume Jose Villaseñor Montfort <pepemontfort(a)gmail.com> HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event() Andrei Fed <andfed.net(a)gmail.com> HID: magicmouse: fix battery reporting for Bluetooth Magic Trackpad USB-C Bryam Vargas <hexlabsecurity(a)proton.me> selinux: require a class's permission values to cover its permission count Christian Göttsche <cgzones(a)googlemail.com> selinux: more strict policy parsing Christian Göttsche <cgzones(a)googlemail.com> selinux: use u16 for security classes Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: pm: fix memory leak from alloc-during-teardown race Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: uniform announced addresses helpers Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: rename add_entry structure to add_addr Lijo Lazar <lijo.lazar(a)amd.com> drm/amdgpu: Allocate coredump ring buffers per ring Mikhail Gavrilov <mikhail.v.gavrilov(a)gmail.com> drm/amdgpu: fix recursive ww_mutex acquire in amdgpu_devcoredump_format Melbin K Mathew <mlbnkm1(a)gmail.com> fbdev: serialize mode sysfs access with lock_fb_info() Thomas Zimmermann <tzimmermann(a)suse.de> fbdev: Wrap user-invoked calls to fb_set_var() in helper Yifei Gao <gyf161023(a)gmail.com> nvmet: pci-epf: put CQ ref on create_cq mapping failure Shin'ichiro Kawasaki <shinichiro.kawasaki(a)wdc.com> nvmet: pci-epf: fix use-after-free in nvmet_pci_epf_exec_iod_work() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations Ibrahim Hashimov <security(a)auditcode.ai> nvmet-tcp: bound SGL data length before allocating command buffers Jiang HongHui <jiang_hh2019(a)163.com> nvmet-fc: fix invalid free in LS IOD error path Bryam Vargas <hexlabsecurity(a)proton.me> nvmet-auth: zero the AUTH_RECEIVE response buffer Griffin Kroah-Hartman <griffin(a)kroah.com> dmaengine: fsl-edma: Add error handling for devm_kasprintf Griffin Kroah-Hartman <griffin(a)kroah.com> mailbox: mchp-ipc-sbi: Add null check for devm_kasprintf() Luxiao Xu <rakukuip(a)gmail.com> ipv6: fix use-after-free in ip6_finish_output2() Yong Wang <edragain(a)163.com> ipv4: reject undersized MTUs in ip_do_fragment() Linmao Li <lilinmao(a)kylinos.cn> nfc: nci: free destination parameters when closing a connection Samuel Page <sam(a)bynar.io> nfc: nci: fix uninit-value in the RF discover/activated NTF handlers Samuel Page <sam(a)bynar.io> nfc: nci: fix out-of-bounds write in nci_target_auto_activated() Bryam Vargas <hexlabsecurity(a)proton.me> nfc: nci: add data_len bound checks to activation parameter extractors Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: st21nfca: validate ATR_REQ length against the received frame Xu Rao <raoxu(a)uniontech.com> nfc: pn533: purge fragmented skbs during cleanup Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: llcp: reject PDUs shorter than the LLCP header Muhammad Bilal <meatuni001(a)gmail.com> nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: llcp: bound the connect_sn TLV walk to the skb Pengpeng Hou <pengpeng(a)iscas.ac.cn> nfc: microread: validate target discovery payload lengths Bryam Vargas <hexlabsecurity(a)proton.me> nfc: fdp: bound the device-reported read length and fix an skb leak Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: digital: clamp SENSF_RES length to the destination buffer Maarten Lankhorst <dev(a)lankhorst.se> drm/xe: Fix DPT allocation paths. Ville Syrjälä <ville.syrjala(a)linux.intel.com> drm/i915: Introduce struct intel_fb_pin_params Ville Syrjälä <ville.syrjala(a)linux.intel.com> drm/i915: Track fence region ID in plane state Jani Nikula <jani.nikula(a)intel.com> drm/i915/pin: s/dev_priv/i915/ and drop struct drm_device usage Yun Zhou <yun.zhou(a)windriver.com> xfs: restore nofs context unconditionally in xfs_trans_roll Hongling Zeng <zenghongling(a)kylinos.cn> xfs: validate attr entry pointer before field access Jiazi Liu <jiazi.liu1984(a)gmail.com> ext4: fix incorrect function call when initializing s_resgid Eric Biggers <ebiggers(a)kernel.org> ext4: don't enable DAX on new encrypted files Guanghui Yang <3497809730(a)qq.com> ext4: propagate errors from fast commit range replay Jia Zhu <zhujia.zj(a)bytedance.com> ext4: avoid tail write_begin walk for uptodate folios Guanghui Yang <3497809730(a)qq.com> ext4: clear error before retrying inode xattr space fallback Ryusuke Konishi <konishi.ryusuke(a)gmail.com> nilfs2: reject invalid block index in GC ioctl Matthias Goergens <matthias.goergens(a)gmail.com> ext4: stop retrying saturated xattr cache entries Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> kcov: fix data corruption and race conditions on PREEMPT_RT Rik van Riel <riel(a)surriel.com> null_blk: fix UBSAN shift-out-of-bounds when zone_size is 0 or overflows Ian Bridges <icb(a)fastmail.org> ocfs2: fix missing metadata reservation for large xattrs Jens Axboe <axboe(a)kernel.dk> io_uring: defer eventfd signaling when queued from a wakeup handler Jens Axboe <axboe(a)kernel.dk> io_uring/uring_cmd: don't skip completion for a synchronous multishot cmd Ali Ahmet Memis <ali(a)iusegentoo.com> io_uring/rsrc: fix folio size overflow in io_vec_fill_bvec() Vishnu Razdan <vrazdan(a)openai.com> io_uring/io-wq: fix worker accounting when canceling creation callbacks Woraphat Khiaodaeng <worapat.kd2(a)gmail.com> io_uring/cmd: fix iovec leak when the async cmd is not recycled Takashi Iwai <tiwai(a)suse.de> ALSA: dummy: Check card index validity at probe Jens Axboe <axboe(a)kernel.dk> io_uring/futex: only mark private futex waits as inflight Jens Axboe <axboe(a)kernel.dk> io_uring/futex: don't mark futex wake requests as inflight Guixin Liu <kanie(a)linux.alibaba.com> nvmet: fix NULL pointer dereference in nvmet_execute_identify_nslist() Griffin Kroah-Hartman <griffin(a)kroah.com> rndis_host: add overflow check in rndis_rx_fixup() Geoffrey D. Bennett <g(a)b4.vu> ALSA: scarlett2: Use a private URB for the notification endpoint Geoffrey D. Bennett <g(a)b4.vu> ALSA: FCP: Use a private URB for the notification endpoint Peiyang He <peiyang_he(a)smail.nju.edu.cn> iommu/iommufd: Fix NULL pointer deref in iommufd_ioas_change_process when racing with iopt_map_file_pages Shameer Kolothum <skolothumtho(a)nvidia.com> iommu/tegra241-cmdqv: Fix CMD_SYNC use-after-free on teardown Ali Ahmet Memis <ali(a)iusegentoo.com> Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept Steffen Persvold <spersvold(a)gmail.com> PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems Darrick J. Wong <djwong(a)kernel.org> xfs: rtsummary scrub should treat rtbitmap corruption errors as an xref error Christoph Hellwig <hch(a)lst.de> xfs: add a xchk_ip_set_corrupt helper Darrick J. Wong <djwong(a)kernel.org> xfs: don't livelock in scrub on a circular unlinked list Darrick J. Wong <djwong(a)kernel.org> xfs: hoist per-bucket unlinked list check to helper ------------- Diffstat: Makefile | 4 +- drivers/block/null_blk/zoned.c | 10 +- drivers/bluetooth/hci_aml.c | 18 +- drivers/dma/fsl-edma-main.c | 2 + drivers/gpu/drm/amd/amdgpu/amdgpu_dev_coredump.c | 265 ++++++++++++--------- drivers/gpu/drm/amd/amdgpu/amdgpu_dev_coredump.h | 3 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 91 ++++--- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h | 2 +- drivers/gpu/drm/i915/display/intel_display_types.h | 5 +- drivers/gpu/drm/i915/display/intel_fb_pin.c | 107 +++++---- drivers/gpu/drm/i915/display/intel_fb_pin.h | 17 +- drivers/gpu/drm/i915/display/intel_fbc.c | 11 +- drivers/gpu/drm/i915/display/intel_fbdev.c | 20 +- drivers/gpu/drm/i915/display/intel_plane.c | 3 +- drivers/gpu/drm/i915/i915_initial_plane.c | 2 +- drivers/gpu/drm/xe/display/xe_fb_pin.c | 74 +++--- drivers/gpu/drm/xe/display/xe_initial_plane.c | 6 +- drivers/gpu/drm/xe/xe_vram.c | 23 +- drivers/hid/Kconfig | 1 + drivers/hid/hid-asus.c | 2 +- drivers/hid/hid-core.c | 11 +- drivers/hid/hid-ft260.c | 25 +- drivers/hid/hid-huawei.c | 5 +- drivers/hid/hid-hyperv.c | 27 ++- drivers/hid/hid-input.c | 20 +- drivers/hid/hid-magicmouse.c | 73 +++++- drivers/hid/hid-nintendo.c | 22 +- drivers/hid/hid-rapoo.c | 2 +- drivers/hid/hid-sensor-custom.c | 21 +- drivers/hid/hid-uclogic-core.c | 12 +- drivers/hid/usbhid/hid-pidff.c | 13 +- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 2 + drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h | 1 + drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c | 15 +- drivers/iommu/iommufd/ioas.c | 4 + drivers/mailbox/mailbox-mchp-ipc-sbi.c | 2 + drivers/net/ethernet/pensando/ionic/ionic_lif.c | 17 +- drivers/net/ethernet/pensando/ionic/ionic_txrx.c | 7 +- drivers/net/usb/rndis_host.c | 6 +- drivers/nfc/fdp/i2c.c | 27 +++ drivers/nfc/microread/microread.c | 31 ++- drivers/nfc/pn533/pn533.c | 1 + drivers/nfc/st21nfca/dep.c | 3 + drivers/nvme/target/admin-cmd.c | 2 +- drivers/nvme/target/fabrics-cmd-auth.c | 2 +- drivers/nvme/target/fc.c | 2 +- drivers/nvme/target/pci-epf.c | 10 +- drivers/nvme/target/tcp.c | 19 +- drivers/pci/controller/pci-host-generic.c | 11 +- drivers/pci/ecam.c | 13 + drivers/video/fbdev/core/fb_chrdev.c | 6 +- drivers/video/fbdev/core/fbcon.c | 2 - drivers/video/fbdev/core/fbmem.c | 13 + drivers/video/fbdev/core/fbsysfs.c | 48 +++- drivers/video/fbdev/ps3fb.c | 5 +- drivers/video/fbdev/sh_mobile_lcdcfb.c | 5 +- fs/exec.c | 8 +- fs/ext4/crypto.c | 40 ++-- fs/ext4/fast_commit.c | 16 +- fs/ext4/ialloc.c | 4 + fs/ext4/inode.c | 11 +- fs/ext4/super.c | 2 +- fs/ext4/xattr.c | 7 +- fs/nilfs2/ioctl.c | 20 +- fs/ocfs2/xattr.c | 18 +- fs/xfs/libxfs/xfs_attr_leaf.c | 14 ++ fs/xfs/scrub/agheader.c | 94 ++++++-- fs/xfs/scrub/agheader_repair.c | 17 +- fs/xfs/scrub/bmap.c | 8 +- fs/xfs/scrub/common.c | 10 +- fs/xfs/scrub/common.h | 2 + fs/xfs/scrub/dir.c | 2 +- fs/xfs/scrub/dirtree.c | 4 +- fs/xfs/scrub/metapath.c | 6 +- fs/xfs/scrub/nlinks.c | 12 +- fs/xfs/scrub/parent.c | 6 +- fs/xfs/scrub/rtbitmap.c | 12 +- fs/xfs/scrub/rtsummary.c | 12 +- fs/xfs/xfs_trans.c | 16 +- include/linux/fb.h | 2 + include/linux/futex.h | 2 + include/linux/hid.h | 2 + include/linux/io_uring_types.h | 8 + include/linux/pci-ecam.h | 3 + include/linux/sched.h | 8 + include/linux/wait.h | 1 + include/linux/wait_bit.h | 1 + io_uring/eventfd.c | 8 +- io_uring/eventfd.h | 2 +- io_uring/futex.c | 32 ++- io_uring/futex.h | 1 + io_uring/io-wq.c | 9 +- io_uring/io_uring.c | 2 +- io_uring/opdef.c | 2 +- io_uring/poll.c | 23 +- io_uring/rsrc.c | 2 +- io_uring/tw.c | 2 +- io_uring/uring_cmd.c | 8 +- io_uring/waitid.c | 2 +- kernel/futex/core.c | 126 ++++++---- kernel/futex/futex.h | 9 + kernel/futex/pi.c | 125 +++++++--- kernel/kcov.c | 90 +++---- kernel/sched/wait.c | 15 ++ kernel/sched/wait_bit.c | 14 +- lib/Kconfig.debug | 5 +- net/bluetooth/hci_event.c | 8 +- net/bluetooth/hci_sync.c | 46 +++- net/bluetooth/iso.c | 32 ++- net/bluetooth/mgmt.c | 8 + net/bluetooth/rfcomm/core.c | 24 +- net/ipv4/ip_output.c | 4 + net/ipv6/ip6_output.c | 2 + net/mptcp/options.c | 2 +- net/mptcp/pm.c | 68 +++--- net/mptcp/pm_kernel.c | 10 +- net/mptcp/pm_userspace.c | 8 +- net/mptcp/protocol.h | 21 +- net/mptcp/subflow.c | 4 +- net/nfc/digital_technology.c | 2 + net/nfc/llcp_commands.c | 18 +- net/nfc/llcp_core.c | 15 +- net/nfc/nci/ntf.c | 36 ++- net/nfc/nci/rsp.c | 1 + security/selinux/include/security.h | 1 + security/selinux/ss/avtab.c | 35 ++- security/selinux/ss/avtab.h | 13 + security/selinux/ss/conditional.c | 18 +- security/selinux/ss/constraint.h | 1 + security/selinux/ss/policydb.c | 248 +++++++++++++++---- security/selinux/ss/policydb.h | 31 ++- security/selinux/ss/services.c | 8 +- sound/drivers/dummy.c | 6 + sound/usb/fcp.c | 38 +-- sound/usb/mixer.c | 6 + sound/usb/mixer.h | 2 + sound/usb/mixer_scarlett2.c | 98 +++++--- 137 files changed, 1957 insertions(+), 853 deletions(-)

1 week, 1 day

Connect with Technology Decision-Makers

by Natalie Foster

Hi, Hope you are doing great! As I can see that you are one of the exhibitors at Integrated Systems Europe, would you like to get your hands on verified AV & Systems Integration Industry Contacts? We can help you connect with AV Professionals, System Integrators, AV Consultants, AV Designers, IT Specialists, Facilities Managers, Technology Decision-Makers, Corporate AV Teams, Education Institutions, Retailers, Hospitality Groups, and many more. Let me know if you are interested to see a sample, counts and pricing. please let me know your target audience and geography. Regards, Natalie Foster Sr. Marketing Manager To stop receiving future emails, reply with Omit.

1 week, 1 day

[PATCH 6.18 00/94] 6.18.47-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.18.47 release. There are 94 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 27 Aug 2026 13:25:02 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.47-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.18.47-rc1 Laxman Acharya Padhya <acharyalaxman8848(a)gmail.com> Bluetooth: hci_aml: validate firmware segment lengths Ali Ahmet Memis <ali(a)iusegentoo.com> Bluetooth: MGMT: reject HCI_CMD_SYNC params_len above 255 Ali Ahmet Memis <ali(a)iusegentoo.com> Bluetooth: ISO: zero the sockaddr before returning it in getname Ali Ahmet Memis <ali(a)iusegentoo.com> Bluetooth: ISO: do not force BT_LISTEN after a failed BIG sync Chengfeng Ye <nicoyip.dev(a)gmail.com> Bluetooth: hci_sync: Fix accept list UAF during suspend Laxman Acharya Padhya <acharyalaxman8848(a)gmail.com> Bluetooth: hci_event: validate LE Set CIG Parameters response Chengfeng Ye <nicoyip.dev(a)gmail.com> Bluetooth: hci_event: fix LE list UAF on reset Linus Torvalds <torvalds(a)linux-foundation.org> drm/xe: Don't hand out the flat CCS storage as usable VRAM Michael Bommarito <michael.bommarito(a)gmail.com> HID: hyperv: validate initial device info bounds Ibrahim Hashimov <security(a)auditcode.ai> HID: uclogic: fix use-after-free of inrange_timer on remove Haoxiang Li <haoxiang_li2024(a)163.com> HID: sensor: custom: Fix use-after-free in enable_sensor Jann Horn <jannh(a)google.com> HID: core: fix number/pointer type confusion on long items Jiangshan Yi <yijiangshan(a)kylinos.cn> HID: nintendo: stop device IO before hid_hw_stop on probe failure Jiangshan Yi <yijiangshan(a)kylinos.cn> HID: nintendo: register input device after capabilities are set Ibrahim Hashimov <security(a)auditcode.ai> HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler() Peter Zijlstra <peterz(a)infradead.org> futex: Fix might_sleep() warning in futex_pivot_pending() Hyunwoo Kim <imv4bel(a)gmail.com> futex: Fix race on the initial mm->futex.phash.ref allocation Thomas Gleixner <tglx(a)kernel.org> futex/pi: Plug private futex exec() race Thomas Gleixner <tglx(a)kernel.org> futex: Sanitize and document task_struct::futex::state transitions Kyle Zeng <kylebot(a)openai.com> futex/pi: Reject cross-mm private futex owners Donglin Lyu <DongLin_Lyu(a)outlook.com> Input: atkbd - skip deactivate for HONOR ZQC-P Cryolitia PukNgae <cryolitia.pukngae(a)linux.dev> Input: atkbd - skip deactivate for HONOR FMB-P's internal keyboard Xiang Mei (Microsoft) <xmei5(a)asu.edu> xfrm: fix sk_dst_cache double-free in xfrm_user_policy() Anand Khoje <anand.a.khoje(a)oracle.com> net/ionic: avoid OOB TX partner lookup for hwstamp RXQ Baul Lee <baul.lee(a)xbow.com> HID: pidff: fix OOB write when hid->inputs is empty Baul Lee <baul.lee(a)xbow.com> HID: core: fix OOB read of field->usage in hid_set_field() Lee Jones <lee(a)kernel.org> HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID Jose Villaseñor Montfort <pepemontfort(a)gmail.com> HID: magicmouse: do not keep a stale msc->input if no input is claimed Christopher Kodama <ckhordiasma(a)gmail.com> HID: magicmouse: re-enable multitouch after reset-resume Andrei Fed <andfed.net(a)gmail.com> HID: magicmouse: fix battery reporting for Bluetooth Magic Trackpad USB-C Dawid Wróbel <me(a)dawidwrobel.com> ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses Bryam Vargas <hexlabsecurity(a)proton.me> selinux: require a class's permission values to cover its permission count Christian Göttsche <cgzones(a)googlemail.com> selinux: more strict policy parsing Christian Göttsche <cgzones(a)googlemail.com> selinux: use u16 for security classes Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: pm: fix memory leak from alloc-during-teardown race Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: uniform announced addresses helpers Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: rename add_entry structure to add_addr Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: use for_each_subflow helper Yifei Gao <gyf161023(a)gmail.com> nvmet: pci-epf: put CQ ref on create_cq mapping failure Shin'ichiro Kawasaki <shinichiro.kawasaki(a)wdc.com> nvmet: pci-epf: fix use-after-free in nvmet_pci_epf_exec_iod_work() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations Ibrahim Hashimov <security(a)auditcode.ai> nvmet-tcp: bound SGL data length before allocating command buffers Jiang HongHui <jiang_hh2019(a)163.com> nvmet-fc: fix invalid free in LS IOD error path Bryam Vargas <hexlabsecurity(a)proton.me> nvmet-auth: zero the AUTH_RECEIVE response buffer Griffin Kroah-Hartman <griffin(a)kroah.com> dmaengine: fsl-edma: Add error handling for devm_kasprintf Griffin Kroah-Hartman <griffin(a)kroah.com> mailbox: mchp-ipc-sbi: Add null check for devm_kasprintf() Luxiao Xu <rakukuip(a)gmail.com> ipv6: fix use-after-free in ip6_finish_output2() Yong Wang <edragain(a)163.com> ipv4: reject undersized MTUs in ip_do_fragment() Maarten Lankhorst <dev(a)lankhorst.se> drm/xe: Fix DPT allocation paths. Linmao Li <lilinmao(a)kylinos.cn> nfc: nci: free destination parameters when closing a connection Samuel Page <sam(a)bynar.io> nfc: nci: fix uninit-value in the RF discover/activated NTF handlers Samuel Page <sam(a)bynar.io> nfc: nci: fix out-of-bounds write in nci_target_auto_activated() Bryam Vargas <hexlabsecurity(a)proton.me> nfc: nci: add data_len bound checks to activation parameter extractors Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: st21nfca: validate ATR_REQ length against the received frame Xu Rao <raoxu(a)uniontech.com> nfc: pn533: purge fragmented skbs during cleanup Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: llcp: reject PDUs shorter than the LLCP header Muhammad Bilal <meatuni001(a)gmail.com> nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: llcp: bound the connect_sn TLV walk to the skb Pengpeng Hou <pengpeng(a)iscas.ac.cn> nfc: microread: validate target discovery payload lengths Bryam Vargas <hexlabsecurity(a)proton.me> nfc: fdp: bound the device-reported read length and fix an skb leak Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: digital: clamp SENSF_RES length to the destination buffer Pavitra Jha <jhapavitra98(a)gmail.com> libceph: fix OOB read in decode_watchers() via missing bounds check Hongling Zeng <zenghongling(a)kylinos.cn> xfs: validate attr entry pointer before field access Jiazi Liu <jiazi.liu1984(a)gmail.com> ext4: fix incorrect function call when initializing s_resgid Eric Biggers <ebiggers(a)kernel.org> ext4: don't enable DAX on new encrypted files Guanghui Yang <3497809730(a)qq.com> ext4: propagate errors from fast commit range replay Jia Zhu <zhujia.zj(a)bytedance.com> ext4: avoid tail write_begin walk for uptodate folios Guanghui Yang <3497809730(a)qq.com> ext4: clear error before retrying inode xattr space fallback Ryusuke Konishi <konishi.ryusuke(a)gmail.com> nilfs2: reject invalid block index in GC ioctl Matthias Goergens <matthias.goergens(a)gmail.com> ext4: stop retrying saturated xattr cache entries Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> kcov: fix data corruption and race conditions on PREEMPT_RT Rik van Riel <riel(a)surriel.com> null_blk: fix UBSAN shift-out-of-bounds when zone_size is 0 or overflows Ian Bridges <icb(a)fastmail.org> ocfs2: fix missing metadata reservation for large xattrs Jens Axboe <axboe(a)kernel.dk> io_uring/uring_cmd: don't skip completion for a synchronous multishot cmd Ali Ahmet Memis <ali(a)iusegentoo.com> io_uring/rsrc: fix folio size overflow in io_vec_fill_bvec() Vishnu Razdan <vrazdan(a)openai.com> io_uring/io-wq: fix worker accounting when canceling creation callbacks Woraphat Khiaodaeng <worapat.kd2(a)gmail.com> io_uring/cmd: fix iovec leak when the async cmd is not recycled Takashi Iwai <tiwai(a)suse.de> ALSA: dummy: Check card index validity at probe Jens Axboe <axboe(a)kernel.dk> io_uring/futex: don't mark futex wake requests as inflight Guixin Liu <kanie(a)linux.alibaba.com> nvmet: fix NULL pointer dereference in nvmet_execute_identify_nslist() Griffin Kroah-Hartman <griffin(a)kroah.com> rndis_host: add overflow check in rndis_rx_fixup() Geoffrey D. Bennett <g(a)b4.vu> ALSA: scarlett2: Use a private URB for the notification endpoint Geoffrey D. Bennett <g(a)b4.vu> ALSA: FCP: Use a private URB for the notification endpoint Peiyang He <peiyang_he(a)smail.nju.edu.cn> iommu/iommufd: Fix NULL pointer deref in iommufd_ioas_change_process when racing with iopt_map_file_pages Shameer Kolothum <skolothumtho(a)nvidia.com> iommu/tegra241-cmdqv: Fix CMD_SYNC use-after-free on teardown Ali Ahmet Memis <ali(a)iusegentoo.com> Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept Steffen Persvold <spersvold(a)gmail.com> PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems Darrick J. Wong <djwong(a)kernel.org> xfs: don't livelock in scrub on a circular unlinked list Darrick J. Wong <djwong(a)kernel.org> xfs: hoist per-bucket unlinked list check to helper Darrick J. Wong <djwong(a)kernel.org> xfs: rtsummary scrub should treat rtbitmap corruption errors as an xref error Christoph Hellwig <hch(a)lst.de> xfs: add a xchk_ip_set_corrupt helper Luca Fresi <luca.fresi(a)bithiatec.com> serial: sc16is7xx: enable THRI before filling TX FIFO Hugo Villeneuve <hvilleneuve(a)dimonoff.com> serial: sc16is7xx: use guards for simple mutex locks Hugo Villeneuve <hvilleneuve(a)dimonoff.com> serial: sc16is7xx: rename EFR mutex with generic name ------------- Diffstat: Makefile | 4 +- drivers/block/null_blk/zoned.c | 10 +- drivers/bluetooth/hci_aml.c | 18 +- drivers/dma/fsl-edma-main.c | 2 + drivers/gpu/drm/xe/display/xe_fb_pin.c | 32 +-- drivers/gpu/drm/xe/xe_vram.c | 23 ++- drivers/hid/hid-core.c | 11 +- drivers/hid/hid-hyperv.c | 27 ++- drivers/hid/hid-input.c | 3 + drivers/hid/hid-magicmouse.c | 64 +++++- drivers/hid/hid-nintendo.c | 22 +- drivers/hid/hid-sensor-custom.c | 21 +- drivers/hid/hid-uclogic-core.c | 12 +- drivers/hid/usbhid/hid-pidff.c | 13 +- drivers/input/keyboard/atkbd.c | 23 ++- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 2 + drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h | 1 + drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c | 15 +- drivers/iommu/iommufd/ioas.c | 4 + drivers/mailbox/mailbox-mchp-ipc-sbi.c | 2 + drivers/net/ethernet/pensando/ionic/ionic_lif.c | 17 +- drivers/net/ethernet/pensando/ionic/ionic_txrx.c | 7 +- drivers/net/usb/rndis_host.c | 6 +- drivers/nfc/fdp/i2c.c | 27 +++ drivers/nfc/microread/microread.c | 31 ++- drivers/nfc/pn533/pn533.c | 1 + drivers/nfc/st21nfca/dep.c | 3 + drivers/nvme/target/admin-cmd.c | 2 +- drivers/nvme/target/fabrics-cmd-auth.c | 2 +- drivers/nvme/target/fc.c | 2 +- drivers/nvme/target/pci-epf.c | 10 +- drivers/nvme/target/tcp.c | 18 +- drivers/pci/controller/pci-host-generic.c | 11 +- drivers/pci/ecam.c | 13 ++ drivers/tty/serial/sc16is7xx.c | 40 ++-- fs/exec.c | 8 +- fs/ext4/crypto.c | 40 ++-- fs/ext4/fast_commit.c | 16 +- fs/ext4/ialloc.c | 4 + fs/ext4/inode.c | 11 +- fs/ext4/super.c | 2 +- fs/ext4/xattr.c | 7 +- fs/nilfs2/ioctl.c | 20 +- fs/ocfs2/xattr.c | 18 +- fs/xfs/libxfs/xfs_attr_leaf.c | 14 ++ fs/xfs/scrub/agheader.c | 94 ++++++--- fs/xfs/scrub/agheader_repair.c | 17 +- fs/xfs/scrub/bmap.c | 8 +- fs/xfs/scrub/common.c | 10 +- fs/xfs/scrub/common.h | 2 + fs/xfs/scrub/dir.c | 2 +- fs/xfs/scrub/dirtree.c | 4 +- fs/xfs/scrub/metapath.c | 6 +- fs/xfs/scrub/nlinks.c | 12 +- fs/xfs/scrub/parent.c | 6 +- fs/xfs/scrub/rtbitmap.c | 12 +- fs/xfs/scrub/rtsummary.c | 12 +- include/linux/futex.h | 2 + include/linux/pci-ecam.h | 3 + include/linux/sched.h | 8 + include/linux/wait.h | 1 + include/linux/wait_bit.h | 1 + io_uring/futex.c | 11 + io_uring/futex.h | 1 + io_uring/io-wq.c | 9 +- io_uring/opdef.c | 2 +- io_uring/rsrc.c | 2 +- io_uring/uring_cmd.c | 8 +- kernel/futex/core.c | 122 +++++++---- kernel/futex/futex.h | 9 + kernel/futex/pi.c | 125 +++++++++--- kernel/kcov.c | 90 ++++---- kernel/sched/wait.c | 15 ++ kernel/sched/wait_bit.c | 14 +- lib/Kconfig.debug | 5 +- net/bluetooth/hci_event.c | 8 +- net/bluetooth/hci_sync.c | 46 ++++- net/bluetooth/iso.c | 32 ++- net/bluetooth/mgmt.c | 8 + net/bluetooth/rfcomm/core.c | 24 ++- net/ceph/osd_client.c | 5 +- net/ipv4/ip_output.c | 4 + net/ipv6/ip6_output.c | 2 + net/mptcp/options.c | 2 +- net/mptcp/pm.c | 74 ++++--- net/mptcp/pm_kernel.c | 22 +- net/mptcp/pm_userspace.c | 10 +- net/mptcp/protocol.h | 25 +-- net/mptcp/subflow.c | 4 +- net/nfc/digital_technology.c | 2 + net/nfc/llcp_commands.c | 18 +- net/nfc/llcp_core.c | 15 +- net/nfc/nci/ntf.c | 36 +++- net/nfc/nci/rsp.c | 1 + net/xfrm/xfrm_state.c | 4 +- security/selinux/include/security.h | 1 + security/selinux/ss/avtab.c | 35 +++- security/selinux/ss/avtab.h | 13 ++ security/selinux/ss/conditional.c | 18 +- security/selinux/ss/constraint.h | 1 + security/selinux/ss/policydb.c | 248 +++++++++++++++++++---- security/selinux/ss/policydb.h | 31 ++- security/selinux/ss/services.c | 8 +- sound/drivers/dummy.c | 6 + sound/soc/codecs/lpass-tx-macro.c | 4 +- sound/usb/fcp.c | 38 ++-- sound/usb/mixer.c | 6 + sound/usb/mixer.h | 2 + sound/usb/mixer_scarlett2.c | 98 +++++---- 109 files changed, 1533 insertions(+), 570 deletions(-)

1 week, 2 days

[PATCH 7.2 00/82] 7.2.1-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 7.2.1 release. There are 82 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 27 Aug 2026 13:25:02 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.2.1-rc1.… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.2.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 7.2.1-rc1 Laxman Acharya Padhya <acharyalaxman8848(a)gmail.com> Bluetooth: hci_aml: validate firmware segment lengths Ali Ahmet Memis <ali(a)iusegentoo.com> Bluetooth: MGMT: reject HCI_CMD_SYNC params_len above 255 Ali Ahmet Memis <ali(a)iusegentoo.com> Bluetooth: ISO: zero the sockaddr before returning it in getname Ali Ahmet Memis <ali(a)iusegentoo.com> Bluetooth: ISO: do not force BT_LISTEN after a failed BIG sync Chengfeng Ye <nicoyip.dev(a)gmail.com> Bluetooth: hci_sync: Fix accept list UAF during suspend Laxman Acharya Padhya <acharyalaxman8848(a)gmail.com> Bluetooth: hci_event: validate LE Set CIG Parameters response Chengfeng Ye <nicoyip.dev(a)gmail.com> Bluetooth: hci_event: fix LE list UAF on reset Linus Torvalds <torvalds(a)linux-foundation.org> drm/xe: Don't hand out the flat CCS storage as usable VRAM Jose Villaseñor Montfort <pepemontfort(a)gmail.com> HID: input: read battery capacity from its actual report offset Michael Bommarito <michael.bommarito(a)gmail.com> HID: hyperv: validate initial device info bounds Ibrahim Hashimov <security(a)auditcode.ai> HID: uclogic: fix use-after-free of inrange_timer on remove Haoxiang Li <haoxiang_li2024(a)163.com> HID: sensor: custom: Fix use-after-free in enable_sensor Raman Varabets <kernel-linux-20260610-80b7ab08(a)raman.v1.sg> HID: ft260: fix stack-use-after-return write in I2C read race Jann Horn <jannh(a)google.com> HID: core: fix number/pointer type confusion on long items Jann Horn <jannh(a)google.com> HID: rapoo: fix missing hid_is_usb() check Jiangshan Yi <yijiangshan(a)kylinos.cn> HID: nintendo: stop device IO before hid_hw_stop on probe failure Jiangshan Yi <yijiangshan(a)kylinos.cn> HID: nintendo: register input device after capabilities are set Ibrahim Hashimov <security(a)auditcode.ai> HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler() Jann Horn <jannh(a)google.com> HID: huawei: fix missing hid_is_usb() check Jann Horn <jannh(a)google.com> HID: asus: fix missing hid_is_usb() check Anand Khoje <anand.a.khoje(a)oracle.com> net/ionic: avoid OOB TX partner lookup for hwstamp RXQ Baul Lee <baul.lee(a)xbow.com> HID: pidff: fix OOB write when hid->inputs is empty Baul Lee <baul.lee(a)xbow.com> HID: core: fix OOB read of field->usage in hid_set_field() Jose Villaseñor Montfort <pepemontfort(a)gmail.com> HID: magicmouse: do not keep a stale msc->input if no input is claimed Christopher Kodama <ckhordiasma(a)gmail.com> HID: magicmouse: re-enable multitouch after reset-resume Jose Villaseñor Montfort <pepemontfort(a)gmail.com> HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event() Andrei Fed <andfed.net(a)gmail.com> HID: magicmouse: fix battery reporting for Bluetooth Magic Trackpad USB-C Yifei Gao <gyf161023(a)gmail.com> nvmet: pci-epf: put CQ ref on create_cq mapping failure Shin'ichiro Kawasaki <shinichiro.kawasaki(a)wdc.com> nvmet: pci-epf: fix use-after-free in nvmet_pci_epf_exec_iod_work() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations Ibrahim Hashimov <security(a)auditcode.ai> nvmet-tcp: bound SGL data length before allocating command buffers Jiang HongHui <jiang_hh2019(a)163.com> nvmet-fc: fix invalid free in LS IOD error path Bryam Vargas <hexlabsecurity(a)proton.me> nvmet-auth: zero the AUTH_RECEIVE response buffer Griffin Kroah-Hartman <griffin(a)kroah.com> dmaengine: fsl-edma: Add error handling for devm_kasprintf Griffin Kroah-Hartman <griffin(a)kroah.com> mailbox: mchp-ipc-sbi: Add null check for devm_kasprintf() Luxiao Xu <rakukuip(a)gmail.com> ipv6: fix use-after-free in ip6_finish_output2() Yong Wang <edragain(a)163.com> ipv4: reject undersized MTUs in ip_do_fragment() Linmao Li <lilinmao(a)kylinos.cn> nfc: nci: free destination parameters when closing a connection Samuel Page <sam(a)bynar.io> nfc: nci: fix uninit-value in the RF discover/activated NTF handlers Samuel Page <sam(a)bynar.io> nfc: nci: fix out-of-bounds write in nci_target_auto_activated() Bryam Vargas <hexlabsecurity(a)proton.me> nfc: nci: add data_len bound checks to activation parameter extractors Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: st21nfca: validate ATR_REQ length against the received frame Xu Rao <raoxu(a)uniontech.com> nfc: pn533: purge fragmented skbs during cleanup Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: llcp: reject PDUs shorter than the LLCP header Muhammad Bilal <meatuni001(a)gmail.com> nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: llcp: bound the connect_sn TLV walk to the skb Pengpeng Hou <pengpeng(a)iscas.ac.cn> nfc: microread: validate target discovery payload lengths Bryam Vargas <hexlabsecurity(a)proton.me> nfc: fdp: bound the device-reported read length and fix an skb leak Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: digital: clamp SENSF_RES length to the destination buffer Yun Zhou <yun.zhou(a)windriver.com> xfs: restore nofs context unconditionally in xfs_trans_roll Hongling Zeng <zenghongling(a)kylinos.cn> xfs: validate attr entry pointer before field access Jiazi Liu <jiazi.liu1984(a)gmail.com> ext4: fix incorrect function call when initializing s_resgid Eric Biggers <ebiggers(a)kernel.org> ext4: don't enable DAX on new encrypted files Guanghui Yang <3497809730(a)qq.com> ext4: propagate errors from fast commit range replay Jia Zhu <zhujia.zj(a)bytedance.com> ext4: avoid tail write_begin walk for uptodate folios Guanghui Yang <3497809730(a)qq.com> ext4: clear error before retrying inode xattr space fallback Ryusuke Konishi <konishi.ryusuke(a)gmail.com> nilfs2: reject invalid block index in GC ioctl Matthias Goergens <matthias.goergens(a)gmail.com> ext4: stop retrying saturated xattr cache entries Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> kcov: fix data corruption and race conditions on PREEMPT_RT Rik van Riel <riel(a)surriel.com> null_blk: fix UBSAN shift-out-of-bounds when zone_size is 0 or overflows Ian Bridges <icb(a)fastmail.org> ocfs2: fix missing metadata reservation for large xattrs Jens Axboe <axboe(a)kernel.dk> io_uring: defer eventfd signaling when queued from a wakeup handler Jens Axboe <axboe(a)kernel.dk> io_uring/uring_cmd: don't skip completion for a synchronous multishot cmd Ali Ahmet Memis <ali(a)iusegentoo.com> io_uring/rsrc: fix folio size overflow in io_vec_fill_bvec() Vishnu Razdan <vrazdan(a)openai.com> io_uring/io-wq: fix worker accounting when canceling creation callbacks Woraphat Khiaodaeng <worapat.kd2(a)gmail.com> io_uring/cmd: fix iovec leak when the async cmd is not recycled Takashi Iwai <tiwai(a)suse.de> ALSA: dummy: Check card index validity at probe Jens Axboe <axboe(a)kernel.dk> io_uring/futex: only mark private futex waits as inflight Jens Axboe <axboe(a)kernel.dk> io_uring/futex: don't mark futex wake requests as inflight Hyunwoo Kim <imv4bel(a)gmail.com> futex: Fix race on the initial mm->futex.phash.ref allocation Felix Hoffmann <f3lix.dev(a)gmx.de> futex: Avoid private hash use-after-free on final put Thomas Gleixner <tglx(a)kernel.org> futex/pi: Plug private futex exec() race Thomas Gleixner <tglx(a)kernel.org> futex: Sanitize and document task_struct::futex::state transitions Kyle Zeng <kylebot(a)openai.com> futex/pi: Reject cross-mm private futex owners Guixin Liu <kanie(a)linux.alibaba.com> nvmet: fix NULL pointer dereference in nvmet_execute_identify_nslist() Griffin Kroah-Hartman <griffin(a)kroah.com> rndis_host: add overflow check in rndis_rx_fixup() Geoffrey D. Bennett <g(a)b4.vu> ALSA: scarlett2: Use a private URB for the notification endpoint Geoffrey D. Bennett <g(a)b4.vu> ALSA: FCP: Use a private URB for the notification endpoint Peiyang He <peiyang_he(a)smail.nju.edu.cn> iommu/iommufd: Fix NULL pointer deref in iommufd_ioas_change_process when racing with iopt_map_file_pages Shameer Kolothum <skolothumtho(a)nvidia.com> iommu/tegra241-cmdqv: Fix CMD_SYNC use-after-free on teardown Ali Ahmet Memis <ali(a)iusegentoo.com> Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept Steffen Persvold <spersvold(a)gmail.com> PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems ------------- Diffstat: Makefile | 4 +- drivers/block/null_blk/zoned.c | 10 +- drivers/bluetooth/hci_aml.c | 18 +++- drivers/dma/fsl-edma-main.c | 2 + drivers/gpu/drm/xe/xe_vram.c | 23 ++++- drivers/hid/Kconfig | 1 + drivers/hid/hid-asus.c | 2 +- drivers/hid/hid-core.c | 11 +- drivers/hid/hid-ft260.c | 25 ++++- drivers/hid/hid-huawei.c | 5 +- drivers/hid/hid-hyperv.c | 27 ++++- drivers/hid/hid-input.c | 20 +++- drivers/hid/hid-magicmouse.c | 73 +++++++++++-- drivers/hid/hid-nintendo.c | 22 ++-- drivers/hid/hid-rapoo.c | 2 +- drivers/hid/hid-sensor-custom.c | 21 ++-- drivers/hid/hid-uclogic-core.c | 12 ++- drivers/hid/usbhid/hid-pidff.c | 13 ++- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 2 + drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h | 1 + drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c | 15 ++- drivers/iommu/iommufd/ioas.c | 4 + drivers/mailbox/mailbox-mchp-ipc-sbi.c | 2 + drivers/net/ethernet/pensando/ionic/ionic_lif.c | 17 ++- drivers/net/ethernet/pensando/ionic/ionic_txrx.c | 7 +- drivers/net/usb/rndis_host.c | 6 +- drivers/nfc/fdp/i2c.c | 27 +++++ drivers/nfc/microread/microread.c | 31 +++++- drivers/nfc/pn533/pn533.c | 1 + drivers/nfc/st21nfca/dep.c | 3 + drivers/nvme/target/admin-cmd.c | 2 +- drivers/nvme/target/fabrics-cmd-auth.c | 2 +- drivers/nvme/target/fc.c | 2 +- drivers/nvme/target/pci-epf.c | 10 +- drivers/nvme/target/tcp.c | 19 +++- drivers/pci/controller/pci-host-generic.c | 11 +- drivers/pci/ecam.c | 13 +++ fs/exec.c | 7 +- fs/ext4/crypto.c | 40 ++++---- fs/ext4/fast_commit.c | 16 ++- fs/ext4/ialloc.c | 4 + fs/ext4/inode.c | 11 +- fs/ext4/super.c | 2 +- fs/ext4/xattr.c | 7 +- fs/nilfs2/ioctl.c | 20 +++- fs/ocfs2/xattr.c | 18 ++-- fs/xfs/libxfs/xfs_attr_leaf.c | 14 +++ fs/xfs/xfs_trans.c | 16 +-- include/linux/futex.h | 2 + include/linux/hid.h | 2 + include/linux/io_uring_types.h | 8 ++ include/linux/pci-ecam.h | 3 + include/linux/sched.h | 8 ++ io_uring/eventfd.c | 8 +- io_uring/eventfd.h | 2 +- io_uring/futex.c | 32 ++++-- io_uring/futex.h | 1 + io_uring/io-wq.c | 9 +- io_uring/io_uring.c | 2 +- io_uring/opdef.c | 2 +- io_uring/poll.c | 23 +++-- io_uring/rsrc.c | 2 +- io_uring/tw.c | 2 +- io_uring/uring_cmd.c | 8 +- io_uring/waitid.c | 2 +- kernel/futex/core.c | 96 +++++++++++------ kernel/futex/pi.c | 125 +++++++++++++++++------ kernel/kcov.c | 90 ++++++++-------- lib/Kconfig.debug | 5 +- net/bluetooth/hci_event.c | 8 +- net/bluetooth/hci_sync.c | 46 +++++++-- net/bluetooth/iso.c | 32 ++++-- net/bluetooth/mgmt.c | 8 ++ net/bluetooth/rfcomm/core.c | 24 ++++- net/ipv4/ip_output.c | 4 + net/ipv6/ip6_output.c | 2 + net/nfc/digital_technology.c | 2 + net/nfc/llcp_commands.c | 18 +++- net/nfc/llcp_core.c | 15 ++- net/nfc/nci/ntf.c | 36 +++++-- net/nfc/nci/rsp.c | 1 + sound/drivers/dummy.c | 6 ++ sound/usb/fcp.c | 38 ++++--- sound/usb/mixer.c | 6 ++ sound/usb/mixer.h | 2 + sound/usb/mixer_scarlett2.c | 98 +++++++++++------- 86 files changed, 1042 insertions(+), 357 deletions(-)

1 week, 2 days

[PATCH 6.1 00/79] 6.1.185-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.1.185 release. There are 79 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 27 Aug 2026 13:25:02 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.185-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.1.185-rc1 Chengfeng Ye <nicoyip.dev(a)gmail.com> Bluetooth: hci_event: fix LE list UAF on reset Michael Bommarito <michael.bommarito(a)gmail.com> HID: hyperv: validate initial device info bounds Haoxiang Li <haoxiang_li2024(a)163.com> HID: sensor: custom: Fix use-after-free in enable_sensor Jann Horn <jannh(a)google.com> HID: core: fix number/pointer type confusion on long items Ibrahim Hashimov <security(a)auditcode.ai> HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler() Sukrut Bellary <sukrut.bellary(a)linux.com> misc: fastrpc: Fix double free of 'buf' in error path Oliver Hartkopp <socketcan(a)hartkopp.net> can: isotp: fix timer drain order, wakeup handling and tx_gen ordering Oliver Hartkopp <socketcan(a)hartkopp.net> can: use skb hash instead of private variable in headroom Donglin Lyu <DongLin_Lyu(a)outlook.com> Input: atkbd - skip deactivate for HONOR ZQC-P Cryolitia PukNgae <cryolitia.pukngae(a)linux.dev> Input: atkbd - skip deactivate for HONOR FMB-P's internal keyboard Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Free all memory if cp_init() fails Xiang Mei (Microsoft) <xmei5(a)asu.edu> xfrm: fix sk_dst_cache double-free in xfrm_user_policy() Baul Lee <baul.lee(a)xbow.com> HID: core: fix OOB read of field->usage in hid_set_field() Lee Jones <lee(a)kernel.org> HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID Jose Villaseñor Montfort <pepemontfort(a)gmail.com> HID: magicmouse: do not keep a stale msc->input if no input is claimed Qing Luo <luoqing(a)kylinos.cn> mptcp: pm: fix data race in add_addr timer callback Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: free sk if last Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: always decrease sk refcount Dawid Wróbel <me(a)dawidwrobel.com> ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses Linmao Li <lilinmao(a)kylinos.cn> Input: byd - synchronize timer deletion before freeing private data Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations Jiang HongHui <jiang_hh2019(a)163.com> nvmet-fc: fix invalid free in LS IOD error path Bryam Vargas <hexlabsecurity(a)proton.me> nvmet-auth: zero the AUTH_RECEIVE response buffer Luxiao Xu <rakukuip(a)gmail.com> ipv6: fix use-after-free in ip6_finish_output2() Yong Wang <edragain(a)163.com> ipv4: reject undersized MTUs in ip_do_fragment() Pavitra Jha <jhapavitra98(a)gmail.com> libceph: fix OOB read in decode_watchers() via missing bounds check Eric Dumazet <edumazet(a)google.com> ndisc: ndisc_send_redirect() cleanup Linmao Li <lilinmao(a)kylinos.cn> nfc: nci: free destination parameters when closing a connection Samuel Page <sam(a)bynar.io> nfc: nci: fix uninit-value in the RF discover/activated NTF handlers Samuel Page <sam(a)bynar.io> nfc: nci: fix out-of-bounds write in nci_target_auto_activated() Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: st21nfca: validate ATR_REQ length against the received frame Xu Rao <raoxu(a)uniontech.com> nfc: pn533: purge fragmented skbs during cleanup Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: llcp: reject PDUs shorter than the LLCP header Muhammad Bilal <meatuni001(a)gmail.com> nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: llcp: bound the connect_sn TLV walk to the skb Pengpeng Hou <pengpeng(a)iscas.ac.cn> nfc: microread: validate target discovery payload lengths Bryam Vargas <hexlabsecurity(a)proton.me> nfc: fdp: bound the device-reported read length and fix an skb leak Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: digital: clamp SENSF_RES length to the destination buffer Joanne Koong <joannelkoong(a)gmail.com> iomap: adjust read range correctly for non-block-aligned positions Jakub Kicinski <kuba(a)kernel.org> tls: handle data disappearing from under the TLS ULP Sabrina Dubroca <sd(a)queasysnail.net> tls: fix lockless read of strp->msg_ready in ->poll Junjie Cao <junjie.cao(a)intel.com> gpio: ml-ioh: use raw_spinlock_t for the register lock Yang Wang <kevinyang.wang(a)amd.com> drm/amdgpu: check ASPM on the dGPU host link Ibrahim Hashimov <security(a)auditcode.ai> xfs: bounds-check buffer log item's dirty bitmap Christoph Hellwig <hch(a)lst.de> xfs: don't use a xfs_log_iovec for ri_buf in log recovery Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Implement a crw lock Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Selectively expand io_mutex Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Move cp cleanup out of not operational Junrui Luo <moonafterrain(a)outlook.com> drm/amdgpu: disallow multiple FENCE chunks in one submit Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Cancel existing workqueues Pei Xiao <xiaopei01(a)kylinos.cn> mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition Zhiling Zou <zhilinz(a)nebusec.ai> inet: frags: publish queues before arming timer Zihan Xi <zihanx(a)nebusec.ai> packet: synchronize pressure clearing with ring reconfiguration Eric Dumazet <edumazet(a)google.com> net/packet: convert po->pressure to an atomic flag Luca Fresi <luca.fresi(a)bithiatec.com> serial: sc16is7xx: enable THRI before filling TX FIFO Hugo Villeneuve <hvilleneuve(a)dimonoff.com> serial: sc16is7xx: use guards for simple mutex locks Hugo Villeneuve <hvilleneuve(a)dimonoff.com> serial: sc16is7xx: rename EFR mutex with generic name Lech Perczak <lech.perczak(a)camlingroup.com> serial: sc16is7xx: convert bitmask definitions to use BIT() macro Lech Perczak <lech.perczak(a)camlingroup.com> serial: sc16is7xx: fix copy-paste errors in EFR_SWFLOWx_BIT constants Qihang Tang <q.h.hack.winter(a)gmail.com> packet: use consistent hard_header_len in TX_RING send path Qihang Tang <q.h.hack.winter(a)gmail.com> packet: use consistent hard_header_len in non-ring send paths Aditya Chillara <aditya.chillara(a)oss.qualcomm.com> perf/core: Fix group leader use-after-free after sibling detach Yeoreum Yun <yeoreum.yun(a)arm.com> perf: Fix dangling cgroup pointer in cpuctx Peter Zijlstra <peterz(a)infradead.org> perf: Fix cgroup state vs ERROR Yeoreum Yun <yeoreum.yun(a)arm.com> perf/core: Fix child_total_time_enabled accounting bug at task exit Fan Wu <fanwu01(a)zju.edu.cn> serial: amba-pl011: synchronize DMA teardown Koichiro Den <den(a)valinux.co.jp> NTB: ntb_netdev: Preserve RX queue depth on allocation failure Ekansh Gupta <ekansh.gupta(a)oss.qualcomm.com> misc: fastrpc: Remove buffer from list prior to unmap operation Abel Vesa <abel.vesa(a)linaro.org> misc: fastrpc: Rework fastrpc_req_munmap Hongling Zeng <zenghongling(a)kylinos.cn> xfs: validate attr entry pointer before field access Guanghui Yang <3497809730(a)qq.com> ext4: clear error before retrying inode xattr space fallback Matthias Goergens <matthias.goergens(a)gmail.com> ext4: stop retrying saturated xattr cache entries Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> kcov: fix data corruption and race conditions on PREEMPT_RT Rik van Riel <riel(a)surriel.com> null_blk: fix UBSAN shift-out-of-bounds when zone_size is 0 or overflows Ian Bridges <icb(a)fastmail.org> ocfs2: fix missing metadata reservation for large xattrs Takashi Iwai <tiwai(a)suse.de> ALSA: dummy: Check card index validity at probe Griffin Kroah-Hartman <griffin(a)kroah.com> rndis_host: add overflow check in rndis_rx_fixup() Ali Ahmet Memis <ali(a)iusegentoo.com> Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept Steffen Persvold <spersvold(a)gmail.com> PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems ------------- Diffstat: Makefile | 4 +- drivers/block/null_blk/zoned.c | 10 +- drivers/gpio/gpio-ml-ioh.c | 36 ++-- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 4 + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 50 ++++- drivers/hid/hid-core.c | 11 +- drivers/hid/hid-hyperv.c | 27 ++- drivers/hid/hid-magicmouse.c | 26 +++ drivers/hid/hid-nintendo.c | 7 +- drivers/hid/hid-sensor-custom.c | 21 +- drivers/input/keyboard/atkbd.c | 23 ++- drivers/input/mouse/byd.c | 2 +- drivers/misc/fastrpc.c | 64 +++--- drivers/mmc/host/atmel-mci.c | 2 + drivers/net/can/dev/skb.c | 2 - drivers/net/ntb_netdev.c | 15 +- drivers/net/usb/rndis_host.c | 6 +- drivers/nfc/fdp/i2c.c | 27 +++ drivers/nfc/microread/microread.c | 31 ++- drivers/nfc/pn533/pn533.c | 1 + drivers/nfc/st21nfca/dep.c | 3 + drivers/nvme/target/fabrics-cmd-auth.c | 2 +- drivers/nvme/target/fc.c | 2 +- drivers/nvme/target/tcp.c | 5 +- drivers/pci/controller/pci-host-generic.c | 11 +- drivers/pci/ecam.c | 13 ++ drivers/s390/cio/vfio_ccw_chp.c | 26 ++- drivers/s390/cio/vfio_ccw_cp.c | 30 ++- drivers/s390/cio/vfio_ccw_drv.c | 26 ++- drivers/s390/cio/vfio_ccw_fsm.c | 8 +- drivers/s390/cio/vfio_ccw_ops.c | 27 +++ drivers/s390/cio/vfio_ccw_private.h | 9 +- drivers/tty/serial/amba-pl011.c | 8 +- drivers/tty/serial/sc16is7xx.c | 222 ++++++++++---------- fs/ext4/xattr.c | 7 +- fs/iomap/buffered-io.c | 19 +- fs/ocfs2/xattr.c | 18 +- fs/xfs/libxfs/xfs_attr_leaf.c | 14 ++ fs/xfs/libxfs/xfs_log_recover.h | 4 +- fs/xfs/xfs_attr_item.c | 24 +-- fs/xfs/xfs_bmap_item.c | 18 +- fs/xfs/xfs_buf_item.c | 8 +- fs/xfs/xfs_buf_item.h | 2 +- fs/xfs/xfs_buf_item_recover.c | 91 +++++--- fs/xfs/xfs_dquot_item_recover.c | 20 +- fs/xfs/xfs_extfree_item.c | 43 ++-- fs/xfs/xfs_icreate_item.c | 2 +- fs/xfs/xfs_inode_item.c | 6 +- fs/xfs/xfs_inode_item.h | 4 +- fs/xfs/xfs_inode_item_recover.c | 26 +-- fs/xfs/xfs_log_recover.c | 16 +- fs/xfs/xfs_refcount_item.c | 16 +- fs/xfs/xfs_rmap_item.c | 16 +- fs/xfs/xfs_trans.h | 1 - include/linux/can/core.h | 1 + include/linux/can/skb.h | 2 - include/linux/netdevice.h | 6 +- include/linux/pci-ecam.h | 3 + include/linux/sched.h | 8 + include/net/tls.h | 3 +- kernel/events/core.c | 121 +++++------ kernel/kcov.c | 90 ++++---- lib/Kconfig.debug | 5 +- net/bluetooth/hci_event.c | 2 + net/bluetooth/rfcomm/core.c | 24 ++- net/can/af_can.c | 14 +- net/can/bcm.c | 2 - net/can/isotp.c | 320 +++++++++++++++++++++-------- net/can/j1939/socket.c | 1 - net/can/j1939/transport.c | 2 - net/can/raw.c | 7 +- net/ceph/osd_client.c | 5 +- net/ipv4/inet_fragment.c | 6 +- net/ipv4/ip_output.c | 4 + net/ipv6/ip6_output.c | 2 + net/ipv6/ndisc.c | 8 +- net/mptcp/pm_netlink.c | 36 ++-- net/nfc/digital_technology.c | 2 + net/nfc/llcp_commands.c | 18 +- net/nfc/llcp_core.c | 15 +- net/nfc/nci/ntf.c | 10 +- net/nfc/nci/rsp.c | 1 + net/packet/af_packet.c | 79 ++++--- net/packet/internal.h | 2 +- net/tls/tls.h | 4 +- net/tls/tls_strp.c | 17 +- net/tls/tls_sw.c | 3 +- net/xfrm/xfrm_state.c | 4 +- sound/drivers/dummy.c | 6 + sound/soc/codecs/lpass-tx-macro.c | 4 +- 90 files changed, 1283 insertions(+), 670 deletions(-)

1 week, 2 days

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

Lkft-triage