Lkft-triage

lkft-triage@lists.linaro.org

19 participants
34241 discussions

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.18.46 release. There are 217 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat, 22 Aug 2026 14:51:11 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.46-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.18.46-rc1 Takashi Sakamoto <o-takashi(a)sakamocchi.jp> firewire: ohci: initialize page array to use alloc_pages_bulk() correctly Thomas Zimmermann <tzimmermann(a)suse.de> drm/vmwgfx: Set surface-framebuffer GEM objects Gao Xiang <xiang(a)kernel.org> erofs: fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms Jasper Wise <jaspwise(a)amazon.co.uk> spi: virtio: mark device ready before registering the controller Shixiong Ou <oushixiong(a)kylinos.cn> drm/log: Fix infinite loop when scale is too large for display Thomas Zimmermann <tzimmermann(a)suse.de> drm/client: Remove drm_client_framebuffer_delete() Thomas Zimmermann <tzimmermann(a)suse.de> drm/client: Deprecate struct drm_client_buffer.gem Thomas Zimmermann <tzimmermann(a)suse.de> drm/client: Inline drm_client_buffer_addfb() and _rmfb() Thomas Zimmermann <tzimmermann(a)suse.de> drm/client: Move dumb-buffer handling to drm_client_framebuffer_create() Thomas Zimmermann <tzimmermann(a)suse.de> drm/client: Remove pitch from struct drm_client_buffer Shixiong Ou <oushixiong(a)kylinos.cn> drm/log: Fix out-of-bounds read on empty message length Linmao Li <lilinmao(a)kylinos.cn> drm/xe/oa: Fix sync entry leak on OA config emit failure Aleksandr Nogikh <nogikh(a)google.com> firewire: ohci: fix NULL pointer dereference in ar_context_release Takashi Sakamoto <o-takashi(a)sakamocchi.jp> firewire: ohci: split page allocation from dma mapping Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: cls_bpf: reject dev-bound programs bound to a different device Lizhi Hou <lizhi.hou(a)amd.com> accel/amdxdna: Skip unmapped range in aie2_populate_range() Siddharth Vadapalli <s-vadapalli(a)ti.com> net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG Andrey Golovko <andrey.golovko(a)gmail.com> regmap: sdw-mbq: don't call an unset readable_reg callback Uwe Kleine-König <ukleinek(a)kernel.org> m68k: Define NR_CPUS to 1 Zhang Changzhong <zhangchangzhong(a)huawei.com> net/sched: cls_u32: skip hash tables in u32_bind_class() Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain Eric Dumazet <edumazet(a)google.com> af_packet: Don't send zero-byte data in tpacket_snd(). Charles Keepax <ckeepax(a)opensource.cirrus.com> regmap: sdw-mbq: Fix swap of timeout and retry times Rosen Penev <rosenp(a)gmail.com> ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers Chuck Lever <chuck.lever(a)oracle.com> net/tls: Fail tls_sw_splice_read() after a failed async decrypt Jiawen Wu <jiawenwu(a)trustnetic.com> net: ngbe: fix NULL pointer dereference in non-MSI-X interrupt enabling Wei Fang <wei.fang(a)nxp.com> net: tap: fix wrong transport_header when sending VLAN-tagged frame Wei Fang <wei.fang(a)nxp.com> net: packet: fix wrong transport_header when sending VLAN-tagged frame Oleksij Rempel <o.rempel(a)pengutronix.de> net: phy: realtek: fix EEE advertisement write on the internal PHY MMD path Jiayuan Chen <jiayuan.chen(a)linux.dev> tcp: fix icsk_ack.ato bitfield overflow Jonas Köppeler <j.koeppeler(a)tu-berlin.de> veth: fix queue index used to wake the peer txq in veth_poll Eric Dumazet <edumazet(a)google.com> macvlan: inherit needed_headroom and needed_tailroom from lowerdev Eric Dumazet <edumazet(a)google.com> ipvlan: inherit needed_headroom and needed_tailroom from phy_dev Jakub Kicinski <kuba(a)kernel.org> eth: bnxt: keep the aRFS rmap updated when TPH is enabled Jakub Kicinski <kuba(a)kernel.org> eth: bnxt: cancel IRQ notifier before freeing affinity mask Florian Westphal <fw(a)strlen.de> netfilter: ipset: let destroy callbacks adjust ext mem size Florian Westphal <fw(a)strlen.de> netfilter: ipset: fix list type element drift bug Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> netfilter: flowtable: publish GC-visible tuple last Alexey Velichayshiy <a.velichayshiy(a)ispras.ru> netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path Xiang Mei (Microsoft) <xmei5(a)asu.edu> netfilter: ipset: fix refcount race between list:set GC and swap Shenghao Ding <shenghao-ding(a)ti.com> ASoC: tas2781: fix clang build error for goto bypassing cleanup variable Junjie Cao <junjie.cao(a)intel.com> gpio: ml-ioh: share the register lock across channels Kyle Zeng <kylebot(a)openai.com> perf: Reject exited events as group leaders Pu Lehui <pulehui(a)huawei.com> riscv: ftrace: Fix ftrace_modify_call failure on kprobed functions Ralf Lici <ralf(a)mandelbit.com> ovpn: finish crypto callback cleanup before peer release Ralf Lici <ralf(a)mandelbit.com> ovpn: fix NULL dereference when killing missing key Vladislav Dronov <vdronov(a)redhat.com> crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() Herbert Xu <herbert(a)gondor.apana.org.au> crypto: ccm - Set rfc4309 maxauthsize from child Jon Hunter <jonathanh(a)nvidia.com> arm64: tegra: Add EL2 virtual timer interrupt for Tegra194 Koichiro Den <den(a)valinux.co.jp> NTB: ntb_netdev: Preserve RX queue depth on allocation failure Koichiro Den <den(a)valinux.co.jp> net: ntb_netdev: Introduce per-queue context Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: SOF: ipc4-topology: Refresh copier IPC payload before widget setup Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: fix pptable use-after-free Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: adjust the visibility of pp_table sysfs node Zhiling Zou <zhilinz(a)nebusec.ai> mm/page_table_check: skip special zero mappings Vincent Donnefort <vdonnefort(a)google.com> ring-buffer: Prevent resizing of persistent ring buffer Vincent Donnefort <vdonnefort(a)google.com> ring-buffer: Store bpage pointers into subbuf_ids Steven Rostedt <rostedt(a)goodmis.org> ring-buffer: Add helper functions for allocations Tejun Heo <tj(a)kernel.org> sched_ext: Take cgroup_lock() first in scx_cgroup_lock() Tejun Heo <tj(a)kernel.org> sched_ext: Reorganize enable/disable path for multi-scheduler support Tejun Heo <tj(a)kernel.org> sched_ext: Update p->scx.disallow warning in scx_init_task() Yao Kai <yaokai34(a)huawei.com> futex: Fix race in futex_pivot_pending() during private hash resize Tu Nguyen <tu.nguyen.xg(a)renesas.com> can: rcar_canfd: change the initializing flow for clocks and resets Geert Uytterhoeven <geert+renesas(a)glider.be> can: rcar_canfd: Extract rcar_canfd_global_{,de}init() Biju Das <biju.das.jz(a)bp.renesas.com> can: rcar_canfd: Use devm_clk_get_optional() for RAM clk Geert Uytterhoeven <geert+renesas(a)glider.be> can: rcar_canfd: Invert global vs. channel teardown Geert Uytterhoeven <geert+renesas(a)glider.be> can: rcar_canfd: Invert reset assert order Christian Brauner <brauner(a)kernel.org> binfmt_misc: don't leak the user namespace when the mount fails Damien Le Moal <dlemoal(a)kernel.org> ata: libata-scsi: terminate deferred commands on time out Mark Brown <broonie(a)kernel.org> ASoC: tas2562: Validate values for volume writes Weiming Shi <bestswngs(a)gmail.com> KVM: x86: Cancel delayed I/O APIC EOI handling before destroying vCPUs Usama Arif <usama.arif(a)linux.dev> userfaultfd: wait on source PMD during UFFDIO_MOVE Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> mm: replace pmd_to_swp_entry() with softleaf_from_pmd() Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> fs/proc/task_mmu: refactor pagemap_pmd_range() Guanghui Yang <3497809730(a)qq.com> btrfs: zoned: fix missing chunk metadata reservation Filipe Manana <fdmanana(a)suse.com> btrfs: remove fs_info argument from btrfs_zoned_activate_one_bg() Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: validate minimum PDU size for transform requests ChenXiaoSong <chenxiaosong(a)kylinos.cn> smb/server: fix minimum SMB2 PDU size ChenXiaoSong <chenxiaosong(a)kylinos.cn> smb/server: fix minimum SMB1 PDU size Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: rename smb2_get_msg to smb_get_msg David Howells <dhowells(a)redhat.com> ksmbd: Fix to handle removal of rfc1002 header from smb_hdr ChenXiaoSong <chenxiaosong(a)kylinos.cn> smb/server: rename include guard in smb_common.h ZhangGuoDong <zhangguodong(a)kylinos.cn> smb: move get_rfc1002_len() to common/smbglob.h Aldo Ariel Panzardo <qwe.aldo(a)gmail.com> net/sched: serialize qdisc_rtab_list against concurrent get/put Pavitra Jha <jhapavitra98(a)gmail.com> libceph: fix two unsafe bare decodes in decode_lockers() Xiang Mei <xmei5(a)asu.edu> libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> libceph: Amend checking to fix `make W=1` build breakage Max Kellermann <max.kellermann(a)ionos.com> ceph: fix hanging __ceph_get_caps() with stale mds_wanted Max Kellermann <max.kellermann(a)ionos.com> ceph: avoid fs reclaim while using current->journal_info Christoph Hellwig <hch(a)lst.de> xfs: check v5 superblock features early Darrick J. Wong <djwong(a)kernel.org> xfs: check xfarray iteration errors when committing unlinked inode lists Darrick J. Wong <djwong(a)kernel.org> xfs: don't ignore runtime errors in xrep_iunlink_reload_next Long Li <leo.lilong(a)huawei.com> xfs: don't swallow dquot recovery verification errors Lin Jiapeng <ljp1205831794(a)gmail.com> xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN Darrick J. Wong <djwong(a)kernel.org> xfs: avoid UAF on sc->tempip in xrep_tempfile_create Darrick J. Wong <djwong(a)kernel.org> xfs: don't return EFSCORRUPTED when scrubbing corrupt parent pointers Darrick J. Wong <djwong(a)kernel.org> xfs: fix another iunlink infinite loop bug in online fsck Darrick J. Wong <djwong(a)kernel.org> xfs: fix allocated inodes that show up in the unlinked list Darrick J. Wong <djwong(a)kernel.org> xfs: don't walk off the end of a null sc->sa.agi_bp in AGI repair Darrick J. Wong <djwong(a)kernel.org> xfs: don't zap the attr fork on repair when there are queued pptr updates Long Li <leo.lilong(a)huawei.com> xfs: fix ilock leak on error in xfs_dq_get_next_id Darrick J. Wong <djwong(a)kernel.org> xfs: load next_agino from the correct xfarray in xrep_iunlink_relink_prev Darrick J. Wong <djwong(a)kernel.org> xfs: nlink scrub must take IOLOCK before determining ILOCK state Darrick J. Wong <djwong(a)kernel.org> xfs: pass runtime errors from xrep_iunlink_mark_ondisk_rec up to callers Darrick J. Wong <djwong(a)kernel.org> xfs: set the prev pointer when reinserting an inode on the unlinked list Darrick J. Wong <djwong(a)kernel.org> xfs: don't double-lock when deleting a self-referential directory Darrick J. Wong <djwong(a)kernel.org> xfs: only check mergeability of bnobt records Darrick J. Wong <djwong(a)kernel.org> xfs: zero i_nlink before repair puts inode on unlinked list Darrick J. Wong <djwong(a)kernel.org> xfs: fix transaction block reservation in xrep_rtbitmap Darrick J. Wong <djwong(a)kernel.org> xfs: check cowextsize in xrep_inode_cowextsize Qiang Ma <maqianga(a)uniontech.com> xfs: clear zapped attr fork state when bmap repair finds no attr fork Darrick J. Wong <djwong(a)kernel.org> xfs: mark nonzero sb_gquotino as corrupt on metadir filesystems Ibrahim Hashimov <security(a)auditcode.ai> xfs: bounds-check buffer log item's dirty bitmap Xiang Mei <xmei5(a)asu.edu> xfs: fix off-by-one in rtrefcount btree root level validation Guanghui Yang <3497809730(a)qq.com> xfs: propagate errors from xfs_rtginode_load Junrui Luo <moonafterrain(a)outlook.com> drm/amdgpu: disallow multiple FENCE chunks in one submit David Rosca <david.rosca(a)amd.com> drm/amdgpu: Fix UVD decode image min size calculation David Rosca <david.rosca(a)amd.com> drm/amdgpu: Fix UVD dpb min size calculation for H264 David Rosca <david.rosca(a)amd.com> drm/amdgpu: Fix UVD min buffer sizes David Rosca <david.rosca(a)amd.com> drm/amdgpu: Implement insert_end for VCE 3 David Rosca <david.rosca(a)amd.com> drm/amdgpu: Reject UVD message with dimensions above 4096 Candice Li <candice.li(a)amd.com> drm/amdgpu: validate GEM_CREATE domain combinations Yang Wang <kevinyang.wang(a)amd.com> drm/amdgpu: check ASPM on the dGPU host link Yang Wang <kevinyang.wang(a)amd.com> drm/amdgpu: fix nbif 6.3.1 l1 low power not functional David Rosca <david.rosca(a)amd.com> drm/amdgpu: Reject UVD message with invalid number of h265 refs Nathan Lucas <nlucasgit(a)gmail.com> drm/amd/display: fix BT.2020 YCbCr output CSC matrices for DCE Nathan Lucas <nlucasgit(a)gmail.com> drm/amd/display: fix BT.2020 YCbCr limited output CSC matrix Samuel Pitoiset <samuel.pitoiset(a)gmail.com> drm/amd/display: Fix NULL pointer dereference in amdgpu_dm_crtc_set_vblank() Harald Freudenberger <freude(a)linux.ibm.com> s390/zcrypt: Fix CPRB memory allocation in zcrypt misc code Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Implement a crw lock Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Calculate idal length based on idaw type Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Selectively expand io_mutex Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Move cp cleanup out of not operational Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Fix out of bounds check on CCW array Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Ensure first IDAW remains constant Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Ensure index for read/write regions are within range Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Cancel existing workqueues Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Limit the number of channel program segments Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Free all memory if cp_init() fails Jakub Kicinski <kuba(a)kernel.org> eth: bnxt: make sure we populate the qcfg defaults on old FW/HW Jakub Kicinski <kuba(a)kernel.org> eth: bnxt: always set the queue mgmt ops Guangshuo Li <lgs201920130244(a)gmail.com> drm/radeon: fix autosuspend cleanup during teardown Raag Jadav <raag.jadav(a)intel.com> drm/xe: Fix xe_device_probe() failure Matthew Brost <matthew.brost(a)intel.com> drm/xe: Order ring writes before ring tail updates Dmitry Osipenko <dmitry.osipenko(a)collabora.com> pmdomain: mediatek: Fix mt8183 hang on boot Binbin Zhou <zhoubinbin(a)loongson.cn> mmc: loongson2: Fix sg iteration in data reorder functions John Harrison <John.Harrison(a)Igalia.com> drm/connector/hdmi: Fix out of bounds memory read Pei Xiao <xiaopei01(a)kylinos.cn> mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition AngeloGioacchino Del Regno <angelogioacchino.delregno(a)collabora.com> pmdomains: mediatek: Avoid setting RTFF's CLK_DIS before NRESTORE Haibo Chen <haibo.chen(a)nxp.com> mmc: sdhci: make tuning_err a signed int Guangshuo Li <lgs201920130244(a)gmail.com> pmdomain: mediatek: fix remaining %pOF after of_node_put() Myeonghun Pak <mhun512(a)gmail.com> mmc: sdhci: unmap the bounce buffer before device release Zhan Xusheng <zhanxusheng1024(a)gmail.com> mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit Kefu Chai <k.chai(a)proxmox.com> libceph: tolerate addrvecs with multiple entries of the same type Yiming Zhu <zhuyiming(a)kuaishou.com> ceph: fix MDS random selection readiness predicate Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Avoid using invalid osd indices from primary_temp Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: sur40 - fix V4L error path cleanup Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: sur40 - fix input device registration ordering Ali Ahmet Memis <ali(a)iusegentoo.com> openrisc: signal: do not restore privileged SR bits on sigreturn Josh Poimboeuf <jpoimboe(a)kernel.org> ftrace: Fix off-by-one fentry site disable in ftrace_free_mem() Leon Hwang <leon.hwang(a)linux.dev> ftrace: Protect direct_functions in ftrace_find_rec_direct Pavitra Jha <jhapavitra98(a)gmail.com> libceph: fix multiple unsafe decodes in decode_locker() Praveen Talari <praveen.talari(a)oss.qualcomm.com> pmdomain: arm: Fix -EINVAL from scmi_pd_set_perf_state() on state 0 Junjie Cao <junjie.cao(a)intel.com> gpio: ml-ioh: use raw_spinlock_t for the register lock Jordan Rhee <jordanrhee(a)google.com> gve: fix zero-length skb frag with header-split Rui Qi <qirui.001(a)bytedance.com> selftests/ftrace: Convert ELF entry point to file offset in uprobe test Cengiz Can <cengiz.can(a)canonical.com> gpio: sloppy-logic-analyzer: fix use-after-free via debugfs trigger on unbind Jordan Rhee <jordanrhee(a)google.com> gve: fix NULL dereference due to missing ptp adjfine Thorsten Blum <thorsten.blum(a)linux.dev> crypto: qce - fix error path in devm_qce_register_algs Thorsten Blum <thorsten.blum(a)linux.dev> crypto: starfive - use scatterlist length before DMA mapping Jianing Li <m13940358460(a)163.com> Input: hynitron_cstxxx - validate touch count and finger IDs Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: synaptics-rmi4 - block s_input when F54 queue is busy Bryam Vargas <hexlabsecurity(a)proton.me> Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: synaptics-rmi4 - zero report size on F54 work error George Wilson <gcwilson(a)linux.ibm.com> powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak George Wilson <gcwilson(a)linux.ibm.com> powerpc/pseries: lparcfg - fix kbuf[] underflow Linmao Li <lilinmao(a)kylinos.cn> Input: byd - synchronize timer deletion before freeing private data Pengpeng Hou <pengpeng(a)iscas.ac.cn> Input: iforce - validate input packet lengths Zhefu Zhang <a723356(a)gmail.com> Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard Linmao Li <lilinmao(a)kylinos.cn> Input: psxpad-spi - set driver data before use Richard Davies <richard(a)arachsys.com> Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: synaptics-rmi4 - fix F55 transmitter electrode count typo George Wilson <gcwilson(a)linux.ibm.com> powerpc/pseries: pci - logic bug HyeongJun An <sammiee5311(a)gmail.com> Input: cs40l50-vibra - validate custom data from user space Kyohei Kadota <lufia(a)lufia.org> Input: xpad - add support for ZENAIM LEVERLESS Bard Liao <yung-chuan.liao(a)linux.intel.com> ASoC: SOF: topology: Use acpi mach from the machine driver Asad Kamal <asad.kamal(a)amd.com> drm/amdgpu: fix aperture iounmap skipped on device removal Jesse Zhang <Jesse.Zhang(a)amd.com> drm/amdgpu: fix JPEG v4.0.5 queue reset failure in DPG mode Jesse Zhang <Jesse.Zhang(a)amd.com> drm/amdgpu: fix JPEG v5.0.0 queue reset failure in DPG mode Qiang Yu <Qiang.Yu(a)amd.com> drm/amdgpu: read TRUNCATE_COORD_MODE on gfx12 Candice Li <candice.li(a)amd.com> drm/amdgpu: reject oversized IBs with per-ring packet limits Osama Abdelkader <osama.abdelkader(a)gmail.com> drm/panthor: skip zero-sized firmware sections Mingyu Wang <25181214217(a)stu.xidian.edu.cn> fbdev: core: Fix pointer desynchronization in fb_io_read() Dawid Wróbel <me(a)dawidwrobel.com> ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: cs35l41: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: cs35l45: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: cs4265: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: SOF: ipc4-pcm: Continue the pipeline trigger in case of IPC timeout Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked() Hidayath Khan <hidayath(a)linux.ibm.com> s390/qeth: validate user buffer length in SNMP and ARP query ioctls Wyatt Feng <bronzed_45_vested(a)icloud.com> mptcp: fastopen: only mark MPTFO subflows with SYN data Qing Luo <luoqing(a)kylinos.cn> mptcp: pm: fix data race in add_addr timer callback Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: options: reset DSS fields in case of unexpected size Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: avoid combining some incoming suboptions Gang Yan <yangang(a)kylinos.cn> selftests: mptcp: join: mark tests with data corruption as failed Paolo Abeni <pabeni(a)redhat.com> mptcp: reclaim forward-allocated memory on RX path errors Bryam Vargas <hexlabsecurity(a)proton.me> selinux: reject a permission value exceeding the class permission count Bryam Vargas <hexlabsecurity(a)proton.me> selinux: reject an unclaimed class value in security_get_classes() Bryam Vargas <hexlabsecurity(a)proton.me> selinux: do not cancel a policy conversion that never started Bryam Vargas <hexlabsecurity(a)proton.me> selinux: reject a class permission count below its inherited common Bryam Vargas <hexlabsecurity(a)proton.me> selinux: require every boolean value to be defined Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> ipvs: separate destination availability state Liyuan Pang <pangliyuan1(a)huawei.com> ubi: fastmap: fix ubi->fm memory leak Cheng Ming Lin <chengminglin(a)mxic.com.tw> mtd: ubi: skip programming unused bits in ubi headers Chao Shi <coshi036(a)gmail.com> block: stop the timeout timer when releasing a never added disk Michael Diesen <michael.diesen(a)posteo.de> ALSA: hda/realtek: Add quirk for HP Dragonfly Folio G3 2-in-1 (103c:8a05) ------------- Diffstat: Makefile | 4 +- arch/arm64/boot/dts/nvidia/tegra194.dtsi | 2 + arch/m68k/Kconfig.cpu | 4 + arch/openrisc/include/asm/processor.h | 2 + arch/openrisc/kernel/signal.c | 5 +- arch/powerpc/platforms/pseries/lparcfg.c | 2 +- arch/powerpc/platforms/pseries/papr-phy-attest.c | 12 +- arch/powerpc/platforms/pseries/pci.c | 2 +- arch/riscv/kernel/ftrace.c | 5 +- arch/x86/kvm/x86.c | 6 + block/genhd.c | 12 +- crypto/ccm.c | 2 +- drivers/accel/amdxdna/aie2_ctx.c | 16 ++ drivers/ata/libata-eh.c | 29 +- drivers/ata/libata-scsi.c | 115 ++++++-- drivers/ata/libata.h | 3 +- drivers/base/regmap/regmap-sdw-mbq.c | 4 +- drivers/crypto/qce/core.c | 2 +- drivers/crypto/starfive/jh7110-aes.c | 2 +- drivers/crypto/tegra/tegra-se-aes.c | 22 +- drivers/firewire/ohci.c | 83 ++++-- drivers/gpio/gpio-ml-ioh.c | 71 ++--- drivers/gpio/gpio-sloppy-logic-analyzer.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 31 ++- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 50 +++- drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 21 ++ drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 10 +- drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 85 ++---- drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | 5 + drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_5.c | 21 +- drivers/gpu/drm/amd/amdgpu/jpeg_v5_0_0.c | 21 +- drivers/gpu/drm/amd/amdgpu/nbif_v6_3_1.c | 42 ++- drivers/gpu/drm/amd/amdgpu/vce_v3_0.c | 26 +- .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c | 2 +- .../gpu/drm/amd/display/dc/core/dc_hw_sequencer.c | 31 ++- drivers/gpu/drm/amd/display/dc/dce/dce_transform.c | 7 +- .../drm/amd/display/dc/dce110/dce110_opp_csc_v.c | 7 +- drivers/gpu/drm/amd/pm/amdgpu_dpm.c | 24 +- drivers/gpu/drm/amd/pm/amdgpu_pm.c | 18 +- drivers/gpu/drm/amd/pm/inc/amdgpu_dpm.h | 3 +- drivers/gpu/drm/amd/pm/powerplay/amd_powerplay.c | 5 +- drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 2 +- drivers/gpu/drm/clients/drm_log.c | 13 +- drivers/gpu/drm/display/drm_hdmi_state_helper.c | 3 +- drivers/gpu/drm/drm_client.c | 181 ++++++------- drivers/gpu/drm/drm_fbdev_dma.c | 6 +- drivers/gpu/drm/drm_fbdev_shmem.c | 4 +- drivers/gpu/drm/drm_fbdev_ttm.c | 8 +- drivers/gpu/drm/panthor/panthor_fw.c | 3 + drivers/gpu/drm/radeon/radeon_kms.c | 1 + drivers/gpu/drm/vmwgfx/vmwgfx_kms.c | 3 + drivers/gpu/drm/xe/xe_device.c | 6 +- drivers/gpu/drm/xe/xe_lrc.c | 7 + drivers/gpu/drm/xe/xe_oa.c | 4 + drivers/input/joystick/iforce/iforce-packets.c | 11 +- drivers/input/joystick/iforce/iforce-usb.c | 3 + drivers/input/joystick/psxpad-spi.c | 1 + drivers/input/joystick/xpad.c | 2 + drivers/input/keyboard/atkbd.c | 8 + drivers/input/misc/cs40l50-vibra.c | 10 +- drivers/input/mouse/byd.c | 2 +- drivers/input/mouse/focaltech.c | 2 +- drivers/input/rmi4/rmi_f54.c | 43 ++- drivers/input/rmi4/rmi_f55.c | 4 +- drivers/input/touchscreen/hynitron_cstxxx.c | 13 +- drivers/input/touchscreen/sur40.c | 23 +- drivers/mmc/host/atmel-mci.c | 2 + drivers/mmc/host/loongson2-mmc.c | 8 +- drivers/mmc/host/omap_hsmmc.c | 2 +- drivers/mmc/host/sdhci.c | 16 ++ drivers/mmc/host/sdhci.h | 2 +- drivers/mtd/ubi/attach.c | 4 +- drivers/mtd/ubi/fastmap-wl.c | 8 +- drivers/mtd/ubi/io.c | 10 + drivers/mtd/ubi/ubi.h | 12 + drivers/net/can/rcar/rcar_canfd.c | 181 ++++++++----- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 30 ++- drivers/net/ethernet/google/gve/gve_ptp.c | 6 + drivers/net/ethernet/google/gve/gve_rx_dqo.c | 5 + drivers/net/ethernet/ti/am65-cpsw-nuss.c | 2 + drivers/net/ethernet/wangxun/ngbe/ngbe_main.c | 4 +- drivers/net/ipvlan/ipvlan_main.c | 4 + drivers/net/macvlan.c | 4 + drivers/net/ntb_netdev.c | 294 ++++++++++++++------- drivers/net/ovpn/crypto.c | 16 +- drivers/net/ovpn/io.c | 10 +- drivers/net/phy/realtek/realtek_main.c | 2 +- drivers/net/tap.c | 3 +- drivers/net/veth.c | 2 +- drivers/pmdomain/arm/scmi_perf_domain.c | 2 +- drivers/pmdomain/mediatek/mt8183-pm-domains.h | 7 +- drivers/pmdomain/mediatek/mtk-pm-domains.c | 30 +-- drivers/s390/cio/vfio_ccw_async.c | 16 ++ drivers/s390/cio/vfio_ccw_chp.c | 31 ++- drivers/s390/cio/vfio_ccw_cp.c | 74 ++++-- drivers/s390/cio/vfio_ccw_cp.h | 10 + drivers/s390/cio/vfio_ccw_drv.c | 21 +- drivers/s390/cio/vfio_ccw_fsm.c | 8 +- drivers/s390/cio/vfio_ccw_ops.c | 39 ++- drivers/s390/cio/vfio_ccw_private.h | 10 +- drivers/s390/crypto/zcrypt_ccamisc.c | 20 +- drivers/s390/crypto/zcrypt_ep11misc.c | 16 +- drivers/s390/net/qeth_core_main.c | 3 + drivers/s390/net/qeth_l3_main.c | 5 + drivers/spi/spi-virtio.c | 2 + drivers/video/fbdev/core/fb_io_fops.c | 8 + fs/binfmt_misc.c | 32 ++- fs/btrfs/block-group.c | 36 +-- fs/btrfs/zoned.c | 5 +- fs/btrfs/zoned.h | 6 +- fs/ceph/caps.c | 17 +- fs/ceph/file.c | 9 +- fs/ceph/mds_client.c | 11 + fs/ceph/mds_client.h | 1 + fs/ceph/mdsmap.c | 2 +- fs/erofs/Kconfig | 3 +- fs/proc/task_mmu.c | 148 ++++++----- fs/smb/client/cifsglob.h | 6 - fs/smb/client/cifssmb.c | 6 +- fs/smb/client/connect.c | 2 +- fs/smb/client/smb1transport.c | 8 +- fs/smb/common/cifsglob.h | 5 + fs/smb/server/auth.c | 4 +- fs/smb/server/connection.c | 23 +- fs/smb/server/oplock.c | 8 +- fs/smb/server/server.c | 2 +- fs/smb/server/smb2pdu.c | 70 ++--- fs/smb/server/smb2pdu.h | 9 - fs/smb/server/smb_common.c | 26 +- fs/smb/server/smb_common.h | 14 +- fs/xfs/libxfs/xfs_exchmaps.c | 10 + fs/xfs/libxfs/xfs_rtrefcount_btree.c | 4 +- fs/xfs/libxfs/xfs_sb.c | 4 +- fs/xfs/scrub/agheader.c | 2 +- fs/xfs/scrub/agheader_repair.c | 152 +++++++++-- fs/xfs/scrub/alloc.c | 5 +- fs/xfs/scrub/attr_repair.c | 3 +- fs/xfs/scrub/bmap.c | 5 + fs/xfs/scrub/dirtree_repair.c | 22 +- fs/xfs/scrub/inode_repair.c | 2 +- fs/xfs/scrub/nlinks.c | 13 +- fs/xfs/scrub/nlinks_repair.c | 7 +- fs/xfs/scrub/parent.c | 2 +- fs/xfs/scrub/rtbitmap_repair.c | 46 ++-- fs/xfs/scrub/tempfile.c | 1 + fs/xfs/scrub/trace.h | 2 + fs/xfs/xfs_buf_item_recover.c | 57 ++-- fs/xfs/xfs_dquot.c | 3 +- fs/xfs/xfs_dquot_item_recover.c | 2 +- fs/xfs/xfs_rtalloc.c | 2 +- include/drm/drm_client.h | 16 +- include/linux/libata.h | 2 + include/linux/swapops.h | 4 +- include/net/ip_vs.h | 7 + include/uapi/linux/ip_vs.h | 6 - kernel/events/core.c | 8 +- kernel/futex/core.c | 4 +- kernel/sched/ext.c | 97 ++++--- kernel/trace/ftrace.c | 9 +- kernel/trace/ring_buffer.c | 118 +++++---- mm/hmm.c | 2 +- mm/huge_memory.c | 22 +- mm/khugepaged.c | 2 +- mm/madvise.c | 2 +- mm/memory.c | 4 +- mm/mempolicy.c | 2 +- mm/migrate.c | 2 +- mm/page_table_check.c | 20 +- mm/page_vma_mapped.c | 2 +- mm/pagewalk.c | 2 +- mm/pgtable-generic.c | 2 +- net/ceph/cls_lock_client.c | 21 +- net/ceph/decode.c | 18 +- net/ceph/osdmap.c | 9 +- net/ipv4/tcp_input.c | 6 +- net/ipv4/tcp_timer.c | 4 +- net/mptcp/fastopen.c | 7 +- net/mptcp/options.c | 67 ++++- net/mptcp/pm.c | 6 +- net/mptcp/protocol.c | 6 + net/mptcp/protocol.h | 1 + net/netfilter/ipset/ip_set_bitmap_gen.h | 2 +- net/netfilter/ipset/ip_set_core.c | 19 +- net/netfilter/ipset/ip_set_list_set.c | 10 +- net/netfilter/ipvs/ip_vs_conn.c | 4 +- net/netfilter/ipvs/ip_vs_core.c | 6 +- net/netfilter/ipvs/ip_vs_ctl.c | 4 +- net/netfilter/ipvs/ip_vs_dh.c | 4 +- net/netfilter/ipvs/ip_vs_lblc.c | 2 +- net/netfilter/ipvs/ip_vs_lblcr.c | 8 +- net/netfilter/nf_flow_table_core.c | 7 +- net/netfilter/nf_tables_offload.c | 2 +- net/packet/af_packet.c | 7 +- net/sched/act_api.c | 10 +- net/sched/cls_bpf.c | 18 +- net/sched/cls_u32.c | 3 + net/sched/sch_api.c | 24 +- net/tls/tls_sw.c | 5 + security/selinux/ss/policydb.c | 34 +++ security/selinux/ss/services.c | 28 +- sound/hda/codecs/realtek/alc269.c | 1 + sound/soc/codecs/cs35l41-lib.c | 2 +- sound/soc/codecs/cs35l45-tables.c | 32 +-- sound/soc/codecs/cs4265.c | 4 +- sound/soc/codecs/lpass-wsa-macro.c | 8 +- sound/soc/codecs/tas2562.c | 9 +- sound/soc/codecs/tas2781-i2c.c | 18 +- sound/soc/intel/common/sof-function-topology-lib.c | 7 +- sound/soc/sof/ipc4-pcm.c | 25 +- sound/soc/sof/ipc4-topology.c | 33 +++ sound/soc/sof/sof-audio.c | 9 +- sound/soc/xilinx/xlnx_formatter_pcm.c | 10 +- .../ftrace/test.d/dynevent/add_remove_uprobe.tc | 27 +- tools/testing/selftests/net/mptcp/mptcp_join.sh | 4 +- 214 files changed, 2504 insertions(+), 1265 deletions(-)

2 weeks

[PATCH 7.1 000/228] 7.1.10-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 7.1.10 release. There are 228 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat, 22 Aug 2026 14:51:11 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.1.10-rc1… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.1.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 7.1.10-rc1 Gao Xiang <xiang(a)kernel.org> erofs: fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms Jasper Wise <jaspwise(a)amazon.co.uk> spi: virtio: mark device ready before registering the controller Shixiong Ou <oushixiong(a)kylinos.cn> drm/log: Fix infinite loop when scale is too large for display Shixiong Ou <oushixiong(a)kylinos.cn> drm/log: Fix out-of-bounds read on empty message length Shixiong Ou <oushixiong(a)kylinos.cn> drm/log: Fix division by zero when scale module parameter is 0 Vinay Belgaumkar <vinay.belgaumkar(a)intel.com> drm/xe: Fix a bug in pc_adjust_freq_bounds() Nareshkumar Gollakoti <naresh.kumar.g(a)intel.com> drm/xe: Set GT rp min frequency as 1.2GHz default for BMG/CRI Linmao Li <lilinmao(a)kylinos.cn> drm/xe/oa: Check managed mutex initialization errors Linmao Li <lilinmao(a)kylinos.cn> drm/xe/oa: Fix sync entry leak on OA config emit failure Daniele Ceraolo Spurio <daniele.ceraolospurio(a)intel.com> drm/xe/pxp: add termination on resume Aleksandr Nogikh <nogikh(a)google.com> firewire: ohci: fix NULL pointer dereference in ar_context_release Eric Dumazet <edumazet(a)google.com> l2tp: fix tunnel and session refcount leak on seq_file release Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: cls_bpf: reject dev-bound programs bound to a different device Lizhi Hou <lizhi.hou(a)amd.com> accel/amdxdna: Skip unmapped range in aie2_populate_range() Siddharth Vadapalli <s-vadapalli(a)ti.com> net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG Andrey Golovko <andrey.golovko(a)gmail.com> regmap: sdw-mbq: don't call an unset readable_reg callback Uwe Kleine-König <ukleinek(a)kernel.org> m68k: Define NR_CPUS to 1 Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> pid: reject allocations through dead ancestor pid namespaces Zhang Changzhong <zhangchangzhong(a)huawei.com> net/sched: cls_u32: skip hash tables in u32_bind_class() Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain Eric Dumazet <edumazet(a)google.com> af_packet: Don't send zero-byte data in tpacket_snd(). Charles Keepax <ckeepax(a)opensource.cirrus.com> regmap: sdw-mbq: Fix swap of timeout and retry times Rosen Penev <rosenp(a)gmail.com> ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers Chuck Lever <chuck.lever(a)oracle.com> net/tls: Fail tls_sw_splice_read() after a failed async decrypt Jiawen Wu <jiawenwu(a)trustnetic.com> net: ngbe: fix NULL pointer dereference in non-MSI-X interrupt enabling Wei Fang <wei.fang(a)nxp.com> net: tap: fix wrong transport_header when sending VLAN-tagged frame Wei Fang <wei.fang(a)nxp.com> net: packet: fix wrong transport_header when sending VLAN-tagged frame Oleksij Rempel <o.rempel(a)pengutronix.de> net: phy: realtek: fix EEE advertisement write on the internal PHY MMD path Jiayuan Chen <jiayuan.chen(a)linux.dev> tcp: fix icsk_ack.ato bitfield overflow Jonas Köppeler <j.koeppeler(a)tu-berlin.de> veth: fix queue index used to wake the peer txq in veth_poll Eric Dumazet <edumazet(a)google.com> macvlan: inherit needed_headroom and needed_tailroom from lowerdev Eric Dumazet <edumazet(a)google.com> ipvlan: inherit needed_headroom and needed_tailroom from phy_dev Jakub Kicinski <kuba(a)kernel.org> eth: bnxt: avoid deadlock when canceling IRQ affinity notifier Jakub Kicinski <kuba(a)kernel.org> eth: bnxt: decrease indent in bnxt_request_irq() Jakub Kicinski <kuba(a)kernel.org> eth: bnxt: keep the aRFS rmap updated when TPH is enabled Jakub Kicinski <kuba(a)kernel.org> eth: bnxt: cancel IRQ notifier before freeing affinity mask Florian Westphal <fw(a)strlen.de> netfilter: ipset: let destroy callbacks adjust ext mem size Florian Westphal <fw(a)strlen.de> netfilter: ipset: fix list type element drift bug Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> netfilter: flowtable: publish GC-visible tuple last Alexey Velichayshiy <a.velichayshiy(a)ispras.ru> netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path Julian Anastasov <ja(a)ssi.bg> ipvs: revalidate ihl to prevent out-of-bounds access Xiang Mei (Microsoft) <xmei5(a)asu.edu> netfilter: ipset: fix refcount race between list:set GC and swap Karl Mehltretter <kmehltretter(a)gmail.com> tick: Include ktime.h and jiffies.h in linux/tick.h Shenghao Ding <shenghao-ding(a)ti.com> ASoC: tas2781: fix clang build error for goto bypassing cleanup variable Junjie Cao <junjie.cao(a)intel.com> gpio: ml-ioh: share the register lock across channels Niels Pressel <npressel(a)ethz.ch> rseq: Prevent hard lockup on granted time slice extension Ralf Lici <ralf(a)mandelbit.com> ovpn: defer key slot crypto freeing to workqueue Ralf Lici <ralf(a)mandelbit.com> ovpn: run deferred work on a module-owned workqueue Michael Neuling <mikey(a)neuling.org> riscv: lib: Fix ZBB strnlen reading past count boundary Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Fix mixer regression on SteelSeries Arctis Nova 5 Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> sctp: validate cookie AUTH state before use Kyle Zeng <kylebot(a)openai.com> perf: Reject exited events as group leaders Hongjie Fang <hongjiefang(a)asrmicro.com> scsi: core: pair EH runtime PM get and put Pu Lehui <pulehui(a)huawei.com> riscv: ftrace: Fix ftrace_modify_call failure on kprobed functions Ralf Lici <ralf(a)mandelbit.com> ovpn: finish crypto callback cleanup before peer release Ralf Lici <ralf(a)mandelbit.com> ovpn: fix NULL dereference when killing missing key Kuniyuki Iwashima <kuniyu(a)google.com> af_unix: Unlink scc_entry in unix_del_edge(). Robby Cai <robby.cai(a)nxp.com> regulator: fp9931: Fix VPOS/VNEG voltage selector table Christophe Leroy (CS GROUP) <chleroy(a)kernel.org> gpiolib: Check gc->get_direction() before calling gpiod_get_direction() Florian Westphal <fw(a)strlen.de> rhashtable: fix false-positive lockdep splat on rhltable destruction Vladislav Dronov <vdronov(a)redhat.com> crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() Herbert Xu <herbert(a)gondor.apana.org.au> crypto: ccm - Set rfc4309 maxauthsize from child Jon Hunter <jonathanh(a)nvidia.com> arm64: tegra: Add EL2 virtual timer interrupt for Tegra194 Yixun Lan <dlan(a)kernel.org> clk: spacemit: k3: set hdma clock as critical Yixun Lan <dlan(a)kernel.org> clk: spacemit: k3: fix USB2 bus clock Mostafa Saleh <smostafa(a)google.com> optee: ffa: Add NULL check in optee_ffa_lend_protmem Krzysztof Kozlowski <krzysztof.kozlowski(a)oss.qualcomm.com> clk: qcom: dispcc-eliza: Fix disp_cc_mdss_mdp_clk_src RCG stall on Eliza EVK Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: SOF: ipc4-topology: Refresh copier IPC payload before widget setup Jakub Kicinski <kuba(a)kernel.org> net: expect instance lock in netdev_queue_get_dma_dev() Jakub Kicinski <kuba(a)kernel.org> net: rename netdev_ops_assert_locked() William Palacek <William.Palacek(a)amd.com> drm/amdkfd: Add bounds check for CRAT subtype length AngeloGioacchino Del Regno <angelogioacchino.delregno(a)collabora.com> drm/mediatek: mtk_dsi: Enable HS clock only at pre-enable Abhishek Rajput <abhiraj21put(a)gmail.com> drm/mediatek: Convert legacy DRM logging to drm_* helpers in mtk_dsi.c Mark Brown <broonie(a)kernel.org> ASoC: tas2562: Validate values for volume writes Max Kellermann <max.kellermann(a)ionos.com> ceph: fix hanging __ceph_get_caps() with stale mds_wanted Max Kellermann <max.kellermann(a)ionos.com> ceph: avoid fs reclaim while using current->journal_info Clay King <clayking(a)amd.com> drm/amd/display: Fix warnings Gaghik Khachatrian <gaghik.khachatrian(a)amd.com> drm/amd/display: Fix type mismatches in DML and normalize loop bounds Christoph Hellwig <hch(a)lst.de> xfs: check v5 superblock features early Darrick J. Wong <djwong(a)kernel.org> xfs: check xfarray iteration errors when committing unlinked inode lists Darrick J. Wong <djwong(a)kernel.org> xfs: don't ignore runtime errors in xrep_iunlink_reload_next Long Li <leo.lilong(a)huawei.com> xfs: don't swallow dquot recovery verification errors Lin Jiapeng <ljp1205831794(a)gmail.com> xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN Darrick J. Wong <djwong(a)kernel.org> xfs: avoid UAF on sc->tempip in xrep_tempfile_create Darrick J. Wong <djwong(a)kernel.org> xfs: don't return EFSCORRUPTED when scrubbing corrupt parent pointers Darrick J. Wong <djwong(a)kernel.org> xfs: fix another iunlink infinite loop bug in online fsck Darrick J. Wong <djwong(a)kernel.org> xfs: fix allocated inodes that show up in the unlinked list Darrick J. Wong <djwong(a)kernel.org> xfs: don't walk off the end of a null sc->sa.agi_bp in AGI repair Darrick J. Wong <djwong(a)kernel.org> xfs: don't zap the attr fork on repair when there are queued pptr updates Long Li <leo.lilong(a)huawei.com> xfs: fix ilock leak on error in xfs_dq_get_next_id Darrick J. Wong <djwong(a)kernel.org> xfs: load next_agino from the correct xfarray in xrep_iunlink_relink_prev Darrick J. Wong <djwong(a)kernel.org> xfs: nlink scrub must take IOLOCK before determining ILOCK state Darrick J. Wong <djwong(a)kernel.org> xfs: pass runtime errors from xrep_iunlink_mark_ondisk_rec up to callers Darrick J. Wong <djwong(a)kernel.org> xfs: set the prev pointer when reinserting an inode on the unlinked list Darrick J. Wong <djwong(a)kernel.org> xfs: don't double-lock when deleting a self-referential directory Darrick J. Wong <djwong(a)kernel.org> xfs: only check mergeability of bnobt records Darrick J. Wong <djwong(a)kernel.org> xfs: zero i_nlink before repair puts inode on unlinked list Darrick J. Wong <djwong(a)kernel.org> xfs: fix transaction block reservation in xrep_rtbitmap Darrick J. Wong <djwong(a)kernel.org> xfs: check cowextsize in xrep_inode_cowextsize Qiang Ma <maqianga(a)uniontech.com> xfs: clear zapped attr fork state when bmap repair finds no attr fork Darrick J. Wong <djwong(a)kernel.org> xfs: mark nonzero sb_gquotino as corrupt on metadir filesystems Ibrahim Hashimov <security(a)auditcode.ai> xfs: bounds-check buffer log item's dirty bitmap Xiang Mei <xmei5(a)asu.edu> xfs: fix off-by-one in rtrefcount btree root level validation Guanghui Yang <3497809730(a)qq.com> xfs: propagate errors from xfs_rtginode_load Junrui Luo <moonafterrain(a)outlook.com> drm/amdgpu: disallow multiple FENCE chunks in one submit David Rosca <david.rosca(a)amd.com> drm/amdgpu: Fix UVD decode image min size calculation David Rosca <david.rosca(a)amd.com> drm/amdgpu: Fix UVD dpb min size calculation for H264 David Rosca <david.rosca(a)amd.com> drm/amdgpu: Fix UVD min buffer sizes David Rosca <david.rosca(a)amd.com> drm/amdgpu: Implement insert_end for VCE 3 David Rosca <david.rosca(a)amd.com> drm/amdgpu: Reject UVD message with dimensions above 4096 Candice Li <candice.li(a)amd.com> drm/amdgpu: validate GEM_CREATE domain combinations Yang Wang <kevinyang.wang(a)amd.com> drm/amdgpu: check ASPM on the dGPU host link Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu: fix missing check in vm_flush() Yang Wang <kevinyang.wang(a)amd.com> drm/amdgpu: fix nbif 6.3.1 l1 low power not functional Lijo Lazar <lijo.lazar(a)amd.com> drm/amdgpu: Prefer default discovery offset David Rosca <david.rosca(a)amd.com> drm/amdgpu: Reject UVD message with invalid number of h265 refs Nathan Lucas <nlucasgit(a)gmail.com> drm/amd/display: fix BT.2020 YCbCr output CSC matrices for DCE Nathan Lucas <nlucasgit(a)gmail.com> drm/amd/display: fix BT.2020 YCbCr limited output CSC matrix Samuel Pitoiset <samuel.pitoiset(a)gmail.com> drm/amd/display: Fix NULL pointer dereference in amdgpu_dm_crtc_set_vblank() Harald Freudenberger <freude(a)linux.ibm.com> s390/zcrypt: Pad trailing CCA or EP11 message with zeros Harald Freudenberger <freude(a)linux.ibm.com> s390/zcrypt: Improve EP11 CPRB domain handling with ASN.1 parsing Harald Freudenberger <freude(a)linux.ibm.com> s390/zcrypt: Improve EP11 CPRB length and overflow checks Harald Freudenberger <freude(a)linux.ibm.com> s390/zcrypt: Improve CCA CPRB length and overflow checks Harald Freudenberger <freude(a)linux.ibm.com> s390/zcrypt: Fix CPRB memory allocation in zcrypt misc code Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Implement a crw lock Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Calculate idal length based on idaw type Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Selectively expand io_mutex Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Move cp cleanup out of not operational Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Fix out of bounds check on CCW array Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Ensure first IDAW remains constant Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Ensure index for read/write regions are within range Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Cancel existing workqueues Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Limit the number of channel program segments Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Free all memory if cp_init() fails Guangshuo Li <lgs201920130244(a)gmail.com> drm/radeon: fix autosuspend cleanup during teardown Jia Yao <jia.yao(a)intel.com> drm/xe/guc_ads: use uncached mapping for UM queue BO Jia Yao <jia.yao(a)intel.com> drm/xe/guc_ads: allocate UM queues in VRAM on dGFX Jia Yao <jia.yao(a)intel.com> drm/xe/guc_ads: allocate UM queues in a separate BO Raag Jadav <raag.jadav(a)intel.com> drm/xe: Fix xe_device_probe() failure Matthew Brost <matthew.brost(a)intel.com> drm/xe: Order ring writes before ring tail updates Rui Qi <qirui.001(a)bytedance.com> riscv: hwprobe: Register unaligned probes before usermode Dmitry Osipenko <dmitry.osipenko(a)collabora.com> pmdomain: mediatek: Fix mt8183 hang on boot Binbin Zhou <zhoubinbin(a)loongson.cn> mmc: loongson2: Fix sg iteration in data reorder functions John Harrison <John.Harrison(a)Igalia.com> drm/connector/hdmi: Fix out of bounds memory read Pei Xiao <xiaopei01(a)kylinos.cn> mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition AngeloGioacchino Del Regno <angelogioacchino.delregno(a)collabora.com> pmdomains: mediatek: Avoid setting RTFF's CLK_DIS before NRESTORE Haibo Chen <haibo.chen(a)nxp.com> mmc: sdhci: make tuning_err a signed int Guangshuo Li <lgs201920130244(a)gmail.com> pmdomain: mediatek: fix remaining %pOF after of_node_put() Myeonghun Pak <mhun512(a)gmail.com> mmc: sdhci: unmap the bounce buffer before device release Zhan Xusheng <zhanxusheng1024(a)gmail.com> mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit Kefu Chai <k.chai(a)proxmox.com> libceph: tolerate addrvecs with multiple entries of the same type Pavitra Jha <jhapavitra98(a)gmail.com> libceph: fix OOB read in decode_watchers() via missing bounds check Yiming Zhu <zhuyiming(a)kuaishou.com> ceph: fix MDS random selection readiness predicate Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Avoid using invalid osd indices from primary_temp Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: sur40 - fix V4L error path cleanup Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: sur40 - fix input device registration ordering Ali Ahmet Memis <ali(a)iusegentoo.com> openrisc: signal: do not restore privileged SR bits on sigreturn Josh Poimboeuf <jpoimboe(a)kernel.org> ftrace: Fix off-by-one fentry site disable in ftrace_free_mem() Leon Hwang <leon.hwang(a)linux.dev> ftrace: Protect direct_functions in update_ftrace_direct_mod Leon Hwang <leon.hwang(a)linux.dev> ftrace: Protect direct_functions in update_ftrace_direct_del Leon Hwang <leon.hwang(a)linux.dev> ftrace: Protect direct_functions in ftrace_find_rec_direct Karl Mehltretter <kmehltretter(a)gmail.com> pmdomain: mediatek: mfg: initialize prev_o in mtk_mfg_attach_dev() Pavitra Jha <jhapavitra98(a)gmail.com> libceph: fix multiple unsafe decodes in decode_locker() Praveen Talari <praveen.talari(a)oss.qualcomm.com> pmdomain: arm: Fix -EINVAL from scmi_pd_set_perf_state() on state 0 Abel Vesa <abel.vesa(a)oss.qualcomm.com> pmdomain: qcom: rpmhpd: Add missing MXC and MMCX power domains for Eliza Junjie Cao <junjie.cao(a)intel.com> gpio: ml-ioh: use raw_spinlock_t for the register lock Jordan Rhee <jordanrhee(a)google.com> gve: fix zero-length skb frag with header-split Rui Qi <qirui.001(a)bytedance.com> selftests/ftrace: Convert ELF entry point to file offset in uprobe test Cengiz Can <cengiz.can(a)canonical.com> gpio: sloppy-logic-analyzer: fix use-after-free via debugfs trigger on unbind Jordan Rhee <jordanrhee(a)google.com> gve: fix NULL dereference due to missing ptp adjfine Thorsten Blum <thorsten.blum(a)linux.dev> crypto: qce - fix error path in devm_qce_register_algs Thorsten Blum <thorsten.blum(a)linux.dev> crypto: starfive - use scatterlist length before DMA mapping Jianing Li <m13940358460(a)163.com> Input: hynitron_cstxxx - validate touch count and finger IDs Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: synaptics-rmi4 - block s_input when F54 queue is busy Bryam Vargas <hexlabsecurity(a)proton.me> Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: synaptics-rmi4 - zero report size on F54 work error George Wilson <gcwilson(a)linux.ibm.com> powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak George Wilson <gcwilson(a)linux.ibm.com> powerpc/pseries: lparcfg - fix kbuf[] underflow Linmao Li <lilinmao(a)kylinos.cn> Input: byd - synchronize timer deletion before freeing private data Pengpeng Hou <pengpeng(a)iscas.ac.cn> Input: iforce - validate input packet lengths Donglin Lyu <DongLin_Lyu(a)outlook.com> Input: atkbd - skip deactivate for HONOR ZQC-P Zhefu Zhang <a723356(a)gmail.com> Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard Linmao Li <lilinmao(a)kylinos.cn> Input: psxpad-spi - set driver data before use Richard Davies <richard(a)arachsys.com> Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: synaptics-rmi4 - fix F55 transmitter electrode count typo George Wilson <gcwilson(a)linux.ibm.com> powerpc/pseries: pci - logic bug HyeongJun An <sammiee5311(a)gmail.com> Input: cs40l50-vibra - validate custom data from user space Kyohei Kadota <lufia(a)lufia.org> Input: xpad - add support for ZENAIM LEVERLESS Bard Liao <yung-chuan.liao(a)linux.intel.com> ASoC: SOF: topology: Use acpi mach from the machine driver Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/gmc12.1: fix MMHUB0 check in pasid tlb flush Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu/gmc12.1: implement tlb inv semaphore Asad Kamal <asad.kamal(a)amd.com> drm/amdgpu: fix aperture iounmap skipped on device removal Jesse Zhang <Jesse.Zhang(a)amd.com> drm/amdgpu: fix JPEG v4.0.5 queue reset failure in DPG mode Jesse Zhang <Jesse.Zhang(a)amd.com> drm/amdgpu: fix JPEG v5.0.0 queue reset failure in DPG mode Jesse Zhang <Jesse.Zhang(a)amd.com> drm/amdgpu: fix JPEG v5.3.0 queue reset failure in DPG mode Lijo Lazar <lijo.lazar(a)amd.com> drm/amdgpu: Use virtual alloc during coredump Wang Jiang <jiangwang(a)kylinos.cn> drm/radeon: restore hardware polling in fence_is_signaled to fix performance regression Travis K. Bangs <tbangs89(a)gmail.com> drm/amd: Disable DP audio spread spectrum for Cyan Skillfish Jesse Zhang <Jesse.Zhang(a)amd.com> drm/amdgpu/userq: serialize queue map against GPU reset Qiang Yu <Qiang.Yu(a)amd.com> drm/amdgpu: read TRUNCATE_COORD_MODE on gfx12 Candice Li <candice.li(a)amd.com> drm/amdgpu: reject oversized IBs with per-ring packet limits Osama Abdelkader <osama.abdelkader(a)gmail.com> drm/panthor: skip zero-sized firmware sections Mingyu Wang <25181214217(a)stu.xidian.edu.cn> fbdev: core: Fix pointer desynchronization in fb_io_read() Melbin K Mathew <mlbnkm1(a)gmail.com> fbdev: clear fb_info->mode before deleting a videomode Melbin K Mathew <mlbnkm1(a)gmail.com> fbdev: bound mode sysfs output to the sysfs buffer Dawid Wróbel <me(a)dawidwrobel.com> ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: cs35l41: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: cs35l45: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: cs4265: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: SOF: ipc4-pcm: Continue the pipeline trigger in case of IPC timeout Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked() Christian A. Ehrhardt <lk(a)c--e.de> drm/shmem_helper: Check VMA boundaries for PMD mappings Dawid Wróbel <me(a)dawidwrobel.com> ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses Ramin Moussavi <ramin.moussavi(a)yacoub.de> microblaze: restore the page alignment of swapper_pg_dir Hidayath Khan <hidayath(a)linux.ibm.com> s390/qeth: validate user buffer length in SNMP and ARP query ioctls Wyatt Feng <bronzed_45_vested(a)icloud.com> mptcp: fastopen: only mark MPTFO subflows with SYN data Qing Luo <luoqing(a)kylinos.cn> mptcp: pm: fix data race in add_addr timer callback Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: options: reset DSS fields in case of unexpected size Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: avoid combining some incoming suboptions Gang Yan <yangang(a)kylinos.cn> selftests: mptcp: join: mark tests with data corruption as failed Paolo Abeni <pabeni(a)redhat.com> mptcp: reclaim forward-allocated memory on RX path errors Bryam Vargas <hexlabsecurity(a)proton.me> selinux: reject a permission value exceeding the class permission count Bryam Vargas <hexlabsecurity(a)proton.me> selinux: reject an unclaimed class value in security_get_classes() Bryam Vargas <hexlabsecurity(a)proton.me> selinux: do not cancel a policy conversion that never started Bryam Vargas <hexlabsecurity(a)proton.me> selinux: reject a class permission count below its inherited common Bryam Vargas <hexlabsecurity(a)proton.me> selinux: require every boolean value to be defined Chao Shi <coshi036(a)gmail.com> block: stop the timeout timer when releasing a never added disk ------------- Diffstat: Makefile | 4 +- arch/arm64/boot/dts/nvidia/tegra194.dtsi | 2 + arch/m68k/Kconfig.cpu | 4 + arch/microblaze/kernel/head.S | 2 + arch/openrisc/include/asm/processor.h | 2 + arch/openrisc/kernel/signal.c | 5 +- arch/powerpc/platforms/pseries/lparcfg.c | 2 +- arch/powerpc/platforms/pseries/papr-phy-attest.c | 12 +- arch/powerpc/platforms/pseries/pci.c | 2 +- arch/riscv/kernel/ftrace.c | 5 +- arch/riscv/kernel/unaligned_access_speed.c | 8 +- arch/riscv/lib/strnlen.S | 10 +- block/genhd.c | 12 +- crypto/ccm.c | 2 +- drivers/accel/amdxdna/aie2_ctx.c | 16 + drivers/base/regmap/regmap-sdw-mbq.c | 4 +- drivers/clk/qcom/dispcc-eliza.c | 2 +- drivers/clk/spacemit/ccu-k3.c | 4 +- drivers/crypto/qce/core.c | 2 +- drivers/crypto/starfive/jh7110-aes.c | 2 +- drivers/crypto/tegra/tegra-se-aes.c | 22 +- drivers/firewire/ohci.c | 4 +- drivers/gpio/gpio-ml-ioh.c | 71 +-- drivers/gpio/gpio-sloppy-logic-analyzer.c | 2 +- drivers/gpio/gpiolib.c | 3 +- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 31 +- drivers/gpu/drm/amd/amdgpu/amdgpu_dev_coredump.c | 10 +- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 50 +- drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 13 + drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 21 + drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 10 +- drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c | 5 + drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 85 +--- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 3 +- drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | 5 + drivers/gpu/drm/amd/amdgpu/gmc_v12_1.c | 48 +- drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_5.c | 21 +- drivers/gpu/drm/amd/amdgpu/jpeg_v5_0_0.c | 21 +- drivers/gpu/drm/amd/amdgpu/jpeg_v5_3_0.c | 21 +- drivers/gpu/drm/amd/amdgpu/nbif_v6_3_1.c | 42 +- drivers/gpu/drm/amd/amdgpu/vce_v3_0.c | 26 +- drivers/gpu/drm/amd/amdkfd/kfd_crat.c | 9 + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 5 + .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c | 2 +- .../amd/display/dc/clk_mgr/dce100/dce_clk_mgr.c | 6 +- .../amd/display/dc/clk_mgr/dce100/dce_clk_mgr.h | 2 +- .../amd/display/dc/clk_mgr/dcn20/dcn20_clk_mgr.c | 8 +- .../dc/clk_mgr/dcn30/dcn30_clk_mgr_smu_msg.c | 4 +- .../dc/clk_mgr/dcn30/dcn30_clk_mgr_smu_msg.h | 2 +- .../amd/display/dc/clk_mgr/dcn32/dcn32_clk_mgr.c | 2 +- .../amd/display/dc/clk_mgr/dcn401/dcn401_clk_mgr.c | 2 +- .../amd/display/dc/clk_mgr/dcn401/dcn401_clk_mgr.h | 4 +- .../dc/clk_mgr/dcn401/dcn401_clk_mgr_smu_msg.c | 4 +- .../dc/clk_mgr/dcn401/dcn401_clk_mgr_smu_msg.h | 2 +- .../amd/display/dc/clk_mgr/dcn42/dcn42_clk_mgr.c | 2 +- drivers/gpu/drm/amd/display/dc/core/dc.c | 4 +- .../gpu/drm/amd/display/dc/core/dc_hw_sequencer.c | 31 +- .../gpu/drm/amd/display/dc/core/dc_link_exports.c | 2 +- drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 18 +- drivers/gpu/drm/amd/display/dc/core/dc_vm_helper.c | 4 +- drivers/gpu/drm/amd/display/dc/dc.h | 68 +-- drivers/gpu/drm/amd/display/dc/dc_dsc.h | 2 +- drivers/gpu/drm/amd/display/dc/dc_stream.h | 4 +- drivers/gpu/drm/amd/display/dc/dc_types.h | 2 +- drivers/gpu/drm/amd/display/dc/dce/dce_transform.c | 7 +- .../drm/amd/display/dc/dce110/dce110_opp_csc_v.c | 7 +- .../drm/amd/display/dc/dcn21/dcn21_link_encoder.c | 2 +- .../amd/display/dc/dio/dcn10/dcn10_link_encoder.c | 2 +- .../gpu/drm/amd/display/dc/dml/calcs/dcn_calcs.c | 9 +- .../gpu/drm/amd/display/dc/dml/dcn20/dcn20_fpu.c | 38 +- .../amd/display/dc/dml/dcn20/display_mode_vba_20.c | 36 +- .../display/dc/dml/dcn20/display_mode_vba_20v2.c | 36 +- .../amd/display/dc/dml/dcn21/display_mode_vba_21.c | 64 +-- .../gpu/drm/amd/display/dc/dml/dcn30/dcn30_fpu.c | 14 +- .../amd/display/dc/dml/dcn30/display_mode_vba_30.c | 425 +++++++++-------- .../gpu/drm/amd/display/dc/dml/dcn301/dcn301_fpu.c | 5 +- .../gpu/drm/amd/display/dc/dml/dcn302/dcn302_fpu.c | 2 +- .../gpu/drm/amd/display/dc/dml/dcn303/dcn303_fpu.c | 2 +- .../gpu/drm/amd/display/dc/dml/dcn31/dcn31_fpu.c | 15 +- .../amd/display/dc/dml/dcn31/display_mode_vba_31.c | 527 +++++++++++---------- .../gpu/drm/amd/display/dc/dml/dcn314/dcn314_fpu.c | 5 +- .../display/dc/dml/dcn314/display_mode_vba_314.c | 527 +++++++++++---------- .../gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c | 77 +-- .../amd/display/dc/dml/dcn32/display_mode_vba_32.c | 21 +- .../dc/dml/dcn32/display_mode_vba_util_32.c | 10 +- .../dc/dml/dcn32/display_mode_vba_util_32.h | 8 +- .../gpu/drm/amd/display/dc/dml/dcn321/dcn321_fpu.c | 46 +- .../gpu/drm/amd/display/dc/dml/dcn35/dcn35_fpu.c | 5 +- .../gpu/drm/amd/display/dc/dml/dcn351/dcn351_fpu.c | 5 +- .../gpu/drm/amd/display/dc/dml/display_mode_vba.c | 4 +- .../gpu/drm/amd/display/dc/dml/display_mode_vba.h | 12 +- .../drm/amd/display/dc/dpp/dcn10/dcn10_dpp_cm.c | 2 +- .../gpu/drm/amd/display/dc/dpp/dcn30/dcn30_dpp.c | 2 +- .../drm/amd/display/dc/dpp/dcn30/dcn30_dpp_cm.c | 4 +- drivers/gpu/drm/amd/display/dc/dsc/dc_dsc.c | 2 +- .../gpu/drm/amd/display/dc/dsc/dcn20/dcn20_dsc.c | 8 +- .../gpu/drm/amd/display/dc/dsc/dcn35/dcn35_dsc.c | 8 +- .../gpu/drm/amd/display/dc/dsc/dcn401/dcn401_dsc.c | 10 +- .../drm/amd/display/dc/hubp/dcn401/dcn401_hubp.c | 4 +- .../drm/amd/display/dc/hubp/dcn401/dcn401_hubp.h | 2 +- .../drm/amd/display/dc/hwss/dcn10/dcn10_hwseq.c | 6 +- .../drm/amd/display/dc/hwss/dcn314/dcn314_hwseq.c | 2 +- .../drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c | 2 +- .../drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c | 2 +- drivers/gpu/drm/amd/display/dc/inc/bw_fixed.h | 2 +- drivers/gpu/drm/amd/display/dc/inc/hw/hubp.h | 2 +- drivers/gpu/drm/amd/display/dc/inc/hw/opp.h | 4 +- .../drm/amd/display/dc/inc/hw/timing_generator.h | 8 +- drivers/gpu/drm/amd/display/dc/inc/link_service.h | 2 +- drivers/gpu/drm/amd/display/dc/inc/reg_helper.h | 72 +-- .../gpu/drm/amd/display/dc/link/link_detection.c | 2 +- .../gpu/drm/amd/display/dc/link/link_detection.h | 2 +- .../dc/link/protocols/link_edp_panel_control.c | 8 +- .../gpu/drm/amd/display/dc/mpc/dcn10/dcn10_mpc.c | 2 +- .../gpu/drm/amd/display/dc/mpc/dcn30/dcn30_mpc.c | 6 +- .../gpu/drm/amd/display/dc/opp/dcn20/dcn20_opp.c | 2 +- .../gpu/drm/amd/display/dc/opp/dcn20/dcn20_opp.h | 2 +- .../gpu/drm/amd/display/dc/optc/dcn32/dcn32_optc.c | 2 +- drivers/gpu/drm/amd/display/include/fixed31_32.h | 6 +- .../gpu/drm/amd/display/modules/hdcp/hdcp_log.c | 2 +- drivers/gpu/drm/clients/drm_log.c | 12 + drivers/gpu/drm/display/drm_hdmi_state_helper.c | 3 +- drivers/gpu/drm/drm_gem_shmem_helper.c | 6 +- drivers/gpu/drm/mediatek/mtk_dsi.c | 32 +- drivers/gpu/drm/panthor/panthor_fw.c | 3 + drivers/gpu/drm/radeon/radeon_fence.c | 7 + drivers/gpu/drm/radeon/radeon_kms.c | 1 + drivers/gpu/drm/xe/xe_bo.h | 14 + drivers/gpu/drm/xe/xe_device.c | 6 +- drivers/gpu/drm/xe/xe_guc_ads.c | 93 ++-- drivers/gpu/drm/xe/xe_guc_ads_types.h | 5 + drivers/gpu/drm/xe/xe_guc_pc.c | 43 +- drivers/gpu/drm/xe/xe_lrc.c | 7 + drivers/gpu/drm/xe/xe_oa.c | 13 +- drivers/gpu/drm/xe/xe_pxp.c | 162 +++++-- drivers/gpu/drm/xe/xe_pxp_types.h | 27 +- drivers/input/joystick/iforce/iforce-packets.c | 11 +- drivers/input/joystick/iforce/iforce-usb.c | 3 + drivers/input/joystick/psxpad-spi.c | 1 + drivers/input/joystick/xpad.c | 2 + drivers/input/keyboard/atkbd.c | 20 +- drivers/input/misc/cs40l50-vibra.c | 10 +- drivers/input/mouse/byd.c | 2 +- drivers/input/mouse/focaltech.c | 2 +- drivers/input/rmi4/rmi_f54.c | 43 +- drivers/input/rmi4/rmi_f55.c | 4 +- drivers/input/touchscreen/hynitron_cstxxx.c | 13 +- drivers/input/touchscreen/sur40.c | 23 +- drivers/mmc/host/atmel-mci.c | 2 + drivers/mmc/host/loongson2-mmc.c | 8 +- drivers/mmc/host/omap_hsmmc.c | 2 +- drivers/mmc/host/sdhci.c | 16 + drivers/mmc/host/sdhci.h | 2 +- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 131 +++-- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 3 + drivers/net/ethernet/google/gve/gve_ptp.c | 6 + drivers/net/ethernet/google/gve/gve_rx_dqo.c | 5 + drivers/net/ethernet/ti/am65-cpsw-nuss.c | 2 + drivers/net/ethernet/wangxun/ngbe/ngbe_main.c | 4 +- drivers/net/ipvlan/ipvlan_main.c | 4 + drivers/net/macvlan.c | 4 + drivers/net/ovpn/crypto.c | 26 +- drivers/net/ovpn/crypto.h | 4 +- drivers/net/ovpn/crypto_aead.c | 19 +- drivers/net/ovpn/crypto_aead.h | 1 - drivers/net/ovpn/io.c | 10 +- drivers/net/ovpn/main.c | 19 +- drivers/net/ovpn/ovpnpriv.h | 4 + drivers/net/ovpn/peer.c | 8 +- drivers/net/ovpn/tcp.c | 9 +- drivers/net/phy/realtek/realtek_main.c | 2 +- drivers/net/tap.c | 3 +- drivers/net/veth.c | 2 +- drivers/pmdomain/arm/scmi_perf_domain.c | 2 +- drivers/pmdomain/mediatek/mt8183-pm-domains.h | 7 +- drivers/pmdomain/mediatek/mtk-mfg-pmdomain.c | 2 +- drivers/pmdomain/mediatek/mtk-pm-domains.c | 30 +- drivers/pmdomain/qcom/rpmhpd.c | 4 + drivers/regulator/fp9931.c | 54 +-- drivers/s390/cio/vfio_ccw_async.c | 16 + drivers/s390/cio/vfio_ccw_chp.c | 31 +- drivers/s390/cio/vfio_ccw_cp.c | 74 ++- drivers/s390/cio/vfio_ccw_cp.h | 10 + drivers/s390/cio/vfio_ccw_drv.c | 21 +- drivers/s390/cio/vfio_ccw_fsm.c | 8 +- drivers/s390/cio/vfio_ccw_ops.c | 39 +- drivers/s390/cio/vfio_ccw_private.h | 10 +- drivers/s390/crypto/zcrypt_ccamisc.c | 20 +- drivers/s390/crypto/zcrypt_ep11misc.c | 16 +- drivers/s390/crypto/zcrypt_msgtype6.c | 364 +++++++++----- drivers/s390/net/qeth_core_main.c | 3 + drivers/s390/net/qeth_l3_main.c | 5 + drivers/scsi/scsi_error.c | 6 +- drivers/spi/spi-virtio.c | 2 + drivers/tee/optee/ffa_abi.c | 3 + drivers/ufs/core/ufshcd.c | 4 +- drivers/video/fbdev/core/fb_io_fops.c | 8 + drivers/video/fbdev/core/fbmem.c | 5 +- drivers/video/fbdev/core/fbsysfs.c | 15 +- fs/ceph/caps.c | 17 +- fs/ceph/file.c | 9 +- fs/ceph/mds_client.c | 11 + fs/ceph/mds_client.h | 1 + fs/ceph/mdsmap.c | 2 +- fs/erofs/Kconfig | 3 +- fs/xfs/libxfs/xfs_exchmaps.c | 10 + fs/xfs/libxfs/xfs_rtrefcount_btree.c | 4 +- fs/xfs/libxfs/xfs_sb.c | 4 +- fs/xfs/scrub/agheader.c | 2 +- fs/xfs/scrub/agheader_repair.c | 152 ++++-- fs/xfs/scrub/alloc.c | 5 +- fs/xfs/scrub/attr_repair.c | 3 +- fs/xfs/scrub/bmap.c | 5 + fs/xfs/scrub/dirtree_repair.c | 22 +- fs/xfs/scrub/inode_repair.c | 2 +- fs/xfs/scrub/nlinks.c | 13 +- fs/xfs/scrub/nlinks_repair.c | 7 +- fs/xfs/scrub/parent.c | 2 +- fs/xfs/scrub/rtbitmap_repair.c | 46 +- fs/xfs/scrub/tempfile.c | 1 + fs/xfs/scrub/trace.h | 2 + fs/xfs/xfs_buf_item_recover.c | 57 ++- fs/xfs/xfs_dquot.c | 3 +- fs/xfs/xfs_dquot_item_recover.c | 2 +- fs/xfs/xfs_rtalloc.c | 2 +- include/linux/rseq_entry.h | 1 + include/linux/tick.h | 2 + include/net/ip_vs.h | 2 +- include/net/netdev_lock.h | 6 +- include/net/sctp/auth.h | 3 + include/scsi/scsi_host.h | 6 +- kernel/events/core.c | 8 +- kernel/pid.c | 6 +- kernel/trace/ftrace.c | 33 +- lib/rhashtable.c | 2 +- net/ceph/cls_lock_client.c | 13 +- net/ceph/decode.c | 18 +- net/ceph/osd_client.c | 5 +- net/ceph/osdmap.c | 5 +- net/core/dev.c | 26 +- net/core/dev_addr_lists.c | 2 +- net/core/link_watch.c | 2 +- net/core/lock_debug.c | 2 +- net/core/netdev_queues.c | 2 +- net/ethtool/netlink.c | 4 +- net/ipv4/tcp_input.c | 6 +- net/ipv4/tcp_timer.c | 4 +- net/ipv6/addrconf.c | 2 +- net/l2tp/l2tp_debugfs.c | 4 + net/l2tp/l2tp_ppp.c | 56 ++- net/mptcp/fastopen.c | 7 +- net/mptcp/options.c | 67 ++- net/mptcp/pm.c | 6 +- net/mptcp/protocol.c | 6 + net/mptcp/protocol.h | 1 + net/netfilter/ipset/ip_set_bitmap_gen.h | 2 +- net/netfilter/ipset/ip_set_core.c | 19 +- net/netfilter/ipset/ip_set_list_set.c | 10 +- net/netfilter/ipvs/ip_vs_core.c | 11 +- net/netfilter/ipvs/ip_vs_xmit.c | 3 +- net/netfilter/nf_flow_table_core.c | 7 +- net/netfilter/nf_tables_offload.c | 2 +- net/packet/af_packet.c | 7 +- net/sched/act_api.c | 10 +- net/sched/cls_bpf.c | 18 +- net/sched/cls_u32.c | 3 + net/sctp/auth.c | 75 +++ net/sctp/sm_make_chunk.c | 3 + net/tls/tls_sw.c | 5 + net/unix/garbage.c | 1 + net/xdp/xsk_buff_pool.c | 2 +- security/selinux/ss/policydb.c | 34 ++ security/selinux/ss/services.c | 28 +- sound/soc/codecs/cs35l41-lib.c | 2 +- sound/soc/codecs/cs35l45-tables.c | 32 +- sound/soc/codecs/cs4265.c | 4 +- sound/soc/codecs/lpass-tx-macro.c | 4 +- sound/soc/codecs/lpass-wsa-macro.c | 8 +- sound/soc/codecs/tas2562.c | 9 +- sound/soc/codecs/tas2781-i2c.c | 18 +- sound/soc/intel/common/sof-function-topology-lib.c | 7 +- sound/soc/sof/ipc4-pcm.c | 25 +- sound/soc/sof/ipc4-topology.c | 33 ++ sound/soc/sof/sof-audio.c | 9 +- sound/soc/xilinx/xlnx_formatter_pcm.c | 10 +- sound/usb/quirks.c | 2 + .../ftrace/test.d/dynevent/add_remove_uprobe.tc | 27 +- tools/testing/selftests/net/mptcp/mptcp_join.sh | 4 +- 288 files changed, 3633 insertions(+), 2012 deletions(-)

2 weeks

[PATCH 6.6 000/166] 6.6.153-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.6.153 release. There are 166 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat, 22 Aug 2026 14:51:11 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.153-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.6.153-rc1 Paolo Abeni <pabeni(a)redhat.com> net: harmonize tstats and dstats Christian Brauner <brauner(a)kernel.org> binfmt_misc: use exe_file_deny_write_access() for the interpreter clone Baul Lee <baul.lee(a)xbow.com> net/x25: fix use-after-free of the socket by its timers Gao Xiang <xiang(a)kernel.org> erofs: fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: cls_bpf: reject dev-bound programs bound to a different device Siddharth Vadapalli <s-vadapalli(a)ti.com> net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG Uwe Kleine-König <ukleinek(a)kernel.org> m68k: Define NR_CPUS to 1 Christoph Hellwig <hch(a)lst.de> m68k: use the coherent DMA code for coldfire without data cache Christoph Hellwig <hch(a)lst.de> dma-direct: add a CONFIG_ARCH_HAS_DMA_ALLOC symbol Zhang Changzhong <zhangchangzhong(a)huawei.com> net/sched: cls_u32: skip hash tables in u32_bind_class() Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain Victor Nogueira <victor(a)mojatatu.com> net: sched: Add initial TC error skb drop reasons Victor Nogueira <victor(a)mojatatu.com> net: sched: Move drop_reason to struct tc_skb_cb Yan Zhai <yan(a)cloudflare.com> packet: add a generic drop reason for receive Jamal Hadi Salim <jhs(a)mojatatu.com> net, sched: Fix SKB_NOT_DROPPED_YET splat under debug config Daniel Borkmann <daniel(a)iogearbox.net> net, sched: Add tcf_set_drop_reason for {__,}tcf_classify Daniel Borkmann <daniel(a)iogearbox.net> net, sched: Make tc-related drop reason more flexible Eric Dumazet <edumazet(a)google.com> af_packet: Don't send zero-byte data in tpacket_snd(). Rosen Penev <rosenp(a)gmail.com> ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers Chuck Lever <cel(a)kernel.org> net/tls: Fail tls_sw_splice_read() after a failed async decrypt Wei Fang <wei.fang(a)nxp.com> net: packet: fix wrong transport_header when sending VLAN-tagged frame Eric Dumazet <edumazet(a)google.com> macvlan: inherit needed_headroom and needed_tailroom from lowerdev Eric Dumazet <edumazet(a)google.com> ipvlan: inherit needed_headroom and needed_tailroom from phy_dev Florian Westphal <fw(a)strlen.de> netfilter: ipset: let destroy callbacks adjust ext mem size Florian Westphal <fw(a)strlen.de> netfilter: ipset: fix list type element drift bug Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> netfilter: flowtable: publish GC-visible tuple last Alexey Velichayshiy <a.velichayshiy(a)ispras.ru> netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path Xiang Mei (Microsoft) <xmei5(a)asu.edu> netfilter: ipset: fix refcount race between list:set GC and swap Herbert Xu <herbert(a)gondor.apana.org.au> crypto: ccm - Set rfc4309 maxauthsize from child Jon Hunter <jonathanh(a)nvidia.com> arm64: tegra: Add EL2 virtual timer interrupt for Tegra194 Lorenzo Stoakes (ARM) <ljs(a)kernel.org> mm/huge_memory: fix huge_zero_pfn race Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> tls: rx: restore msg_iter before TLS 1.3 optimistic retry Sabrina Dubroca <sd(a)queasysnail.net> selftests: tls: add rekey tests Paolo Bonzini <pbonzini(a)redhat.com> KVM: SVM: Serialize accesses to the owner and mirror list with separate lock Lorenzo Stoakes (ARM) <ljs(a)kernel.org> mm/ptdump: always stabilise against page table freeing using init_mm Lorenzo Stoakes (ARM) <ljs(a)kernel.org> mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> mm/pagewalk: split walk_page_range_novma() into kernel/user parts Pierre-Eric Pelloux-Prayer <pierre-eric.pelloux-prayer(a)amd.com> drm/amdgpu: move debug_vm handling to amdgpu_cs_parser_fini Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: fix pptable use-after-free Yang Wang <kevinyang.wang(a)amd.com> drm/amd/pm: fix torn gpu metrics reads Tu Nguyen <tu.nguyen.xg(a)renesas.com> can: rcar_canfd: change the initializing flow for clocks and resets Jonas Gorski <jonas.gorski(a)bisdn.de> i2c: iproc: reset bus after timeout if START_BUSY is stuck Wolfram Sang <wsa+renesas(a)sang-engineering.com> i2c: bcm-iproc: remove printout on handled timeouts Eric Dumazet <edumazet(a)google.com> vxlan: use pskb_network_may_pull() for transmit path header pulls Guillaume Nault <gnault(a)redhat.com> vxlan: Handle stats using NETDEV_PCPU_STAT_DSTATS. Guillaume Nault <gnault(a)redhat.com> vrf: Make pcpu_dstats update functions available to other modules. Jeremy Kerr <jk(a)codeconstruct.com.au> net: core,vrf: Change pcpu_dstat fields to u64_stats_t Breno Leitao <leitao(a)debian.org> vxlan: Do not alloc tstats manually Dawid Osuchowski <dawid.osuchowski(a)linux.intel.com> ice: fix VF interrupts cleanup Christian Brauner <brauner(a)kernel.org> binfmt_misc: restore write access when removing an entry Amir Goldstein <amir73il(a)gmail.com> fs: don't block write during exec on pre-content watched files Matt Fleming <mfleming(a)cloudflare.com> veth: convert frag_list skbs before running XDP Chengfeng Ye <nicoyip.dev(a)gmail.com> net: pktgen: fix proc entry use-after-free Peter Seiderer <ps.report(a)gmx.net> net: pktgen: fix code style (WARNING: Block comments) Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: reject repeated SMB2 NEGOTIATE requests Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: conn lock to serialize smb2 negotiate David Carlier <devnexen(a)gmail.com> igc: remove napi_synchronize() in igc_down() Mark Brown <broonie(a)kernel.org> ASoC: tas2562: Validate values for volume writes Chengfeng Ye <nicoyip.dev(a)gmail.com> Bluetooth: hci_sync: Fix advertising data UAFs Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: eir: Fix possible crashes on eir_create_adv_data Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_core: Fix not handling hdev->le_num_of_adv_sets=1 Gustavo A. R. Silva <gustavoars(a)kernel.org> Bluetooth: hci_conn, hci_sync: Use __counted_by() to avoid -Wfamnae warnings Kees Cook <keescook(a)chromium.org> overflow: Change DEFINE_FLEX to take __counted_by member Maciej Fijalkowski <maciej.fijalkowski(a)intel.com> ice: make ice_vsi_cfg_rxq() static Przemek Kitszel <przemyslaw.kitszel(a)intel.com> ice: make use of DEFINE_FLEX() in ice_switch.c Kefeng Wang <wangkefeng.wang(a)huawei.com> mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE Guanghui Yang <3497809730(a)qq.com> btrfs: zoned: fix missing chunk metadata reservation Filipe Manana <fdmanana(a)suse.com> btrfs: remove fs_info argument from btrfs_zoned_activate_one_bg() Naohiro Aota <naohiro.aota(a)wdc.com> btrfs: add space_info argument to btrfs_chunk_alloc() David Sterba <dsterba(a)suse.com> btrfs: add debug build only WARN Yuxiang Yang <yangyx22(a)mails.tsinghua.edu.cn> tcp: challenge ACK for non-exact RST in SYN-RECEIVED Ilpo Järvinen <ij(a)kernel.org> tcp: fast path functions later Ilpo Järvinen <ij(a)kernel.org> tcp: Pass flags to __tcp_send_ack Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: validate minimum PDU size for transform requests ChenXiaoSong <chenxiaosong(a)kylinos.cn> smb/server: fix minimum SMB2 PDU size ChenXiaoSong <chenxiaosong(a)kylinos.cn> smb/server: fix minimum SMB1 PDU size Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: rename smb2_get_msg to smb_get_msg ChenXiaoSong <chenxiaosong(a)kylinos.cn> smb/server: rename include guard in smb_common.h ZhangGuoDong <zhangguodong(a)kylinos.cn> smb: move get_rfc1002_len() to common/smbglob.h ZhangGuoDong <zhangguodong(a)kylinos.cn> smb: move smb_version_values to common/smbglob.h Christian Brauner <brauner(a)kernel.org> super: fix emergency thaw deadlock on frozen block devices Aldo Ariel Panzardo <qwe.aldo(a)gmail.com> net/sched: serialize qdisc_rtab_list against concurrent get/put Shiming Cheng <shiming.cheng(a)mediatek.com> net: gro: fix double aggregation of flush-marked skbs Felix Fietkau <nbd(a)nbd.name> net: move skb_gro_receive_list from udp to core Pavitra Jha <jhapavitra98(a)gmail.com> libceph: fix two unsafe bare decodes in decode_lockers() Mike Rapoport (Microsoft) <rppt(a)kernel.org> userfaultfd: prevent registration of special VMAs Mike Rapoport (Microsoft) <rppt(a)kernel.org> userfaultfd: move vma_can_userfault out of line Chunyan Zhang <zhangchunyan(a)iscas.ac.cn> mm: userfaultfd: add pgtable_supports_uffd_wp() Zhang Yi <yi.zhang(a)huawei.com> iomap: fix out-of-bounds bitmap_set() with zero-length range Matthew Wilcox (Oracle) <willy(a)infradead.org> iomap: hold state_lock over call to ifs_set_range_uptodate() Chancel Liu <chancel.liu(a)nxp.com> ASoC: fsl_sai: Fix spurious BCLK on resume by clearing BYP Xiang Mei <xmei5(a)asu.edu> libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> libceph: Amend checking to fix `make W=1` build breakage Matthew Wilcox (Oracle) <willy(a)infradead.org> ceph: Use a folio in ceph_page_mkwrite() Max Kellermann <max.kellermann(a)ionos.com> ceph: fix hanging __ceph_get_caps() with stale mds_wanted Matthew Wilcox (Oracle) <willy(a)infradead.org> ceph: Remove ceph_writepage() Max Kellermann <max.kellermann(a)ionos.com> ceph: avoid fs reclaim while using current->journal_info Sabrina Dubroca <sd(a)queasysnail.net> selftests: tls: add test with a partially invalid iov Palmer Dabbelt <palmer(a)rivosinc.com> RISC-V: Provide pgtable_l5_enabled on rv32 Christoph Hellwig <hch(a)lst.de> xfs: check v5 superblock features early Long Li <leo.lilong(a)huawei.com> xfs: don't swallow dquot recovery verification errors Long Li <leo.lilong(a)huawei.com> xfs: fix ilock leak on error in xfs_dq_get_next_id Darrick J. Wong <djwong(a)kernel.org> xfs: only check mergeability of bnobt records Junrui Luo <moonafterrain(a)outlook.com> drm/amdgpu: disallow multiple FENCE chunks in one submit David Rosca <david.rosca(a)amd.com> drm/amdgpu: Fix UVD decode image min size calculation David Rosca <david.rosca(a)amd.com> drm/amdgpu: Fix UVD dpb min size calculation for H264 David Rosca <david.rosca(a)amd.com> drm/amdgpu: Fix UVD min buffer sizes David Rosca <david.rosca(a)amd.com> drm/amdgpu: Implement insert_end for VCE 3 David Rosca <david.rosca(a)amd.com> drm/amdgpu: Reject UVD message with dimensions above 4096 Candice Li <candice.li(a)amd.com> drm/amdgpu: validate GEM_CREATE domain combinations David Rosca <david.rosca(a)amd.com> drm/amdgpu: Reject UVD message with invalid number of h265 refs Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Selectively expand io_mutex Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Move cp cleanup out of not operational Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Fix out of bounds check on CCW array Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Ensure index for read/write regions are within range Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Cancel existing workqueues Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Limit the number of channel program segments Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Free all memory if cp_init() fails Guangshuo Li <lgs201920130244(a)gmail.com> drm/radeon: fix autosuspend cleanup during teardown Pei Xiao <xiaopei01(a)kylinos.cn> mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition Haibo Chen <haibo.chen(a)nxp.com> mmc: sdhci: make tuning_err a signed int Myeonghun Pak <mhun512(a)gmail.com> mmc: sdhci: unmap the bounce buffer before device release Zhan Xusheng <zhanxusheng1024(a)gmail.com> mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit Kefu Chai <k.chai(a)proxmox.com> libceph: tolerate addrvecs with multiple entries of the same type Yiming Zhu <zhuyiming(a)kuaishou.com> ceph: fix MDS random selection readiness predicate Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> libceph: Avoid using invalid osd indices from primary_temp Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: sur40 - fix V4L error path cleanup Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: sur40 - fix input device registration ordering Ali Ahmet Memis <ali(a)iusegentoo.com> openrisc: signal: do not restore privileged SR bits on sigreturn Josh Poimboeuf <jpoimboe(a)kernel.org> ftrace: Fix off-by-one fentry site disable in ftrace_free_mem() Leon Hwang <leon.hwang(a)linux.dev> ftrace: Protect direct_functions in ftrace_find_rec_direct Pavitra Jha <jhapavitra98(a)gmail.com> libceph: fix multiple unsafe decodes in decode_locker() Thorsten Blum <thorsten.blum(a)linux.dev> crypto: qce - fix error path in devm_qce_register_algs Jianing Li <m13940358460(a)163.com> Input: hynitron_cstxxx - validate touch count and finger IDs Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: synaptics-rmi4 - block s_input when F54 queue is busy Bryam Vargas <hexlabsecurity(a)proton.me> Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: synaptics-rmi4 - zero report size on F54 work error George Wilson <gcwilson(a)linux.ibm.com> powerpc/pseries: lparcfg - fix kbuf[] underflow Pengpeng Hou <pengpeng(a)iscas.ac.cn> Input: iforce - validate input packet lengths Zhefu Zhang <a723356(a)gmail.com> Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard Linmao Li <lilinmao(a)kylinos.cn> Input: psxpad-spi - set driver data before use Richard Davies <richard(a)arachsys.com> Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: synaptics-rmi4 - fix F55 transmitter electrode count typo George Wilson <gcwilson(a)linux.ibm.com> powerpc/pseries: pci - logic bug Kyohei Kadota <lufia(a)lufia.org> Input: xpad - add support for ZENAIM LEVERLESS Asad Kamal <asad.kamal(a)amd.com> drm/amdgpu: fix aperture iounmap skipped on device removal Mingyu Wang <25181214217(a)stu.xidian.edu.cn> fbdev: core: Fix pointer desynchronization in fb_io_read() Dawid Wróbel <me(a)dawidwrobel.com> ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: cs35l41: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: cs35l45: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: cs4265: sort the register default table Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked() Hidayath Khan <hidayath(a)linux.ibm.com> s390/qeth: validate user buffer length in SNMP and ARP query ioctls Wyatt Feng <bronzed_45_vested(a)icloud.com> mptcp: fastopen: only mark MPTFO subflows with SYN data Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: options: reset DSS fields in case of unexpected size Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: avoid combining some incoming suboptions Gang Yan <yangang(a)kylinos.cn> selftests: mptcp: join: mark tests with data corruption as failed Bryam Vargas <hexlabsecurity(a)proton.me> selinux: reject an unclaimed class value in security_get_classes() Bryam Vargas <hexlabsecurity(a)proton.me> selinux: do not cancel a policy conversion that never started Bryam Vargas <hexlabsecurity(a)proton.me> selinux: reject a class permission count below its inherited common Bryam Vargas <hexlabsecurity(a)proton.me> selinux: require every boolean value to be defined Erni Sri Satya Vennela <ernis(a)linux.microsoft.com> net: mana: Fix EQ leak in mana_remove on NULL port Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> ipvs: separate destination availability state Chao Yu <chao(a)kernel.org> f2fs: fix UAF issue in f2fs_merge_page_bio() Chao Shi <coshi036(a)gmail.com> block: stop the timeout timer when releasing a never added disk ------------- Diffstat: Makefile | 4 +- arch/arm/Kconfig | 1 + arch/arm64/boot/dts/nvidia/tegra194.dtsi | 2 + arch/m68k/Kconfig | 7 +- arch/m68k/Kconfig.cpu | 16 + arch/m68k/kernel/Makefile | 2 +- arch/m68k/kernel/dma.c | 2 +- arch/openrisc/include/asm/processor.h | 2 + arch/openrisc/kernel/dma.c | 4 +- arch/openrisc/kernel/signal.c | 5 +- arch/parisc/Kconfig | 1 + arch/powerpc/platforms/pseries/lparcfg.c | 2 +- arch/powerpc/platforms/pseries/pci.c | 2 +- arch/riscv/include/asm/pgtable-32.h | 3 + arch/riscv/include/asm/pgtable.h | 1 - arch/riscv/mm/init.c | 2 + arch/riscv/mm/pageattr.c | 8 +- arch/x86/kvm/svm/sev.c | 34 +- arch/x86/kvm/svm/svm.h | 1 + block/genhd.c | 12 +- crypto/ccm.c | 2 +- drivers/crypto/qce/core.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 34 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 21 + drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 10 +- drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 85 +--- drivers/gpu/drm/amd/amdgpu/vce_v3_0.c | 26 +- drivers/gpu/drm/amd/pm/amdgpu_dpm.c | 27 +- drivers/gpu/drm/amd/pm/amdgpu_pm.c | 16 +- drivers/gpu/drm/amd/pm/inc/amdgpu_dpm.h | 6 +- drivers/gpu/drm/radeon/radeon_kms.c | 1 + drivers/i2c/busses/i2c-bcm-iproc.c | 11 +- drivers/input/joystick/iforce/iforce-packets.c | 11 +- drivers/input/joystick/iforce/iforce-usb.c | 3 + drivers/input/joystick/psxpad-spi.c | 1 + drivers/input/joystick/xpad.c | 2 + drivers/input/keyboard/atkbd.c | 8 + drivers/input/mouse/focaltech.c | 2 +- drivers/input/rmi4/rmi_f54.c | 43 +- drivers/input/rmi4/rmi_f55.c | 4 +- drivers/input/touchscreen/hynitron_cstxxx.c | 13 +- drivers/input/touchscreen/sur40.c | 23 +- drivers/mmc/host/atmel-mci.c | 2 + drivers/mmc/host/omap_hsmmc.c | 2 +- drivers/mmc/host/sdhci.c | 16 + drivers/mmc/host/sdhci.h | 2 +- drivers/net/can/rcar/rcar_canfd.c | 28 +- drivers/net/ethernet/intel/ice/ice_base.c | 58 ++- drivers/net/ethernet/intel/ice/ice_base.h | 3 +- drivers/net/ethernet/intel/ice/ice_lib.c | 56 --- drivers/net/ethernet/intel/ice/ice_lib.h | 4 - drivers/net/ethernet/intel/ice/ice_switch.c | 63 +-- drivers/net/ethernet/intel/ice/ice_vf_lib.c | 27 + .../net/ethernet/intel/ice/ice_vf_lib_private.h | 1 + drivers/net/ethernet/intel/ice/ice_virtchnl.c | 21 + drivers/net/ethernet/intel/ice/ice_xsk.c | 2 +- drivers/net/ethernet/intel/igc/igc_main.c | 1 - drivers/net/ethernet/microsoft/mana/mana_en.c | 4 +- drivers/net/ethernet/ti/am65-cpsw-nuss.c | 2 + drivers/net/ipvlan/ipvlan_main.c | 4 + drivers/net/macvlan.c | 4 + drivers/net/veth.c | 4 +- drivers/net/vrf.c | 49 +- drivers/net/vxlan/vxlan_core.c | 45 +- drivers/net/vxlan/vxlan_mdb.c | 4 +- drivers/s390/cio/vfio_ccw_async.c | 16 + drivers/s390/cio/vfio_ccw_chp.c | 17 +- drivers/s390/cio/vfio_ccw_cp.c | 53 +- drivers/s390/cio/vfio_ccw_cp.h | 8 + drivers/s390/cio/vfio_ccw_drv.c | 15 +- drivers/s390/cio/vfio_ccw_fsm.c | 8 +- drivers/s390/cio/vfio_ccw_ops.c | 35 +- drivers/s390/cio/vfio_ccw_private.h | 6 +- drivers/s390/net/qeth_core_main.c | 3 + drivers/s390/net/qeth_l3_main.c | 5 + drivers/video/fbdev/core/fb_io_fops.c | 8 + fs/binfmt_elf.c | 4 +- fs/binfmt_elf_fdpic.c | 4 +- fs/binfmt_misc.c | 14 +- fs/btrfs/block-group.c | 61 ++- fs/btrfs/block-group.h | 3 +- fs/btrfs/extent-tree.c | 6 +- fs/btrfs/messages.h | 7 + fs/btrfs/space-info.c | 2 +- fs/btrfs/transaction.c | 5 +- fs/btrfs/zoned.c | 5 +- fs/btrfs/zoned.h | 6 +- fs/ceph/addr.c | 54 +- fs/ceph/caps.c | 17 +- fs/ceph/file.c | 9 +- fs/ceph/mds_client.c | 11 + fs/ceph/mds_client.h | 2 + fs/ceph/mdsmap.c | 2 +- fs/erofs/Kconfig | 3 +- fs/exec.c | 6 +- fs/f2fs/data.c | 2 +- fs/iomap/buffered-io.c | 42 +- fs/smb/client/cifsglob.h | 27 - fs/smb/client/cifssmb.c | 6 +- fs/smb/client/connect.c | 2 +- fs/smb/client/transport.c | 8 +- fs/smb/common/cifsglob.h | 36 ++ fs/smb/server/auth.c | 4 +- fs/smb/server/connection.c | 23 +- fs/smb/server/connection.h | 5 + fs/smb/server/oplock.c | 8 +- fs/smb/server/smb2misc.c | 2 +- fs/smb/server/smb2ops.c | 32 +- fs/smb/server/smb2pdu.c | 88 ++-- fs/smb/server/smb2pdu.h | 9 - fs/smb/server/smb_common.c | 43 +- fs/smb/server/smb_common.h | 43 +- fs/super.c | 22 +- fs/userfaultfd.c | 20 +- fs/xfs/libxfs/xfs_sb.c | 4 +- fs/xfs/scrub/alloc.c | 5 +- fs/xfs/xfs_dquot.c | 3 +- fs/xfs/xfs_dquot_item_recover.c | 2 +- include/asm-generic/pgtable_uffd.h | 17 + include/linux/fs.h | 12 + include/linux/mm_inline.h | 7 +- include/linux/mmap_lock.h | 4 + include/linux/netdevice.h | 52 +- include/linux/overflow.h | 52 ++ include/linux/pagewalk.h | 7 +- include/linux/userfaultfd_k.h | 19 +- include/net/bluetooth/hci.h | 8 +- include/net/bluetooth/hci_core.h | 1 + include/net/dropreason-core.h | 21 + include/net/gro.h | 1 + include/net/ip_vs.h | 7 + include/net/pkt_cls.h | 16 + include/net/pkt_sched.h | 3 +- include/net/sch_generic.h | 2 - include/net/tcp.h | 58 +-- include/uapi/linux/ip_vs.h | 6 - kernel/dma/Kconfig | 9 + kernel/dma/direct.c | 12 +- kernel/fork.c | 12 +- kernel/trace/ftrace.c | 9 +- lib/overflow_kunit.c | 19 + mm/huge_memory.c | 49 +- mm/internal.h | 7 + mm/migrate_device.c | 5 +- mm/pagewalk.c | 82 ++- mm/ptdump.c | 10 +- mm/userfaultfd.c | 26 + mm/vmalloc.c | 49 +- net/bluetooth/eir.c | 7 +- net/bluetooth/eir.h | 2 +- net/bluetooth/hci_core.c | 9 + net/bluetooth/hci_event.c | 3 +- net/bluetooth/hci_sync.c | 237 +++++---- net/ceph/cls_lock_client.c | 21 +- net/ceph/decode.c | 18 +- net/ceph/osdmap.c | 9 +- net/core/dev.c | 29 +- net/core/gro.c | 31 ++ net/core/pktgen.c | 43 +- net/ipv4/bpf_tcp_ca.c | 2 +- net/ipv4/tcp_dctcp.h | 2 +- net/ipv4/tcp_input.c | 56 ++- net/ipv4/tcp_minisocks.c | 12 +- net/ipv4/tcp_output.c | 6 +- net/ipv4/udp_offload.c | 29 -- net/mptcp/fastopen.c | 7 +- net/mptcp/options.c | 67 ++- net/mptcp/protocol.h | 1 + net/netfilter/ipset/ip_set_bitmap_gen.h | 2 +- net/netfilter/ipset/ip_set_core.c | 19 +- net/netfilter/ipset/ip_set_list_set.c | 10 +- net/netfilter/ipvs/ip_vs_conn.c | 4 +- net/netfilter/ipvs/ip_vs_core.c | 6 +- net/netfilter/ipvs/ip_vs_ctl.c | 4 +- net/netfilter/ipvs/ip_vs_dh.c | 4 +- net/netfilter/ipvs/ip_vs_lblc.c | 2 +- net/netfilter/ipvs/ip_vs_lblcr.c | 8 +- net/netfilter/nf_flow_table_core.c | 7 +- net/netfilter/nf_tables_offload.c | 2 +- net/packet/af_packet.c | 27 +- net/sched/act_api.c | 13 +- net/sched/cls_api.c | 32 +- net/sched/cls_bpf.c | 18 +- net/sched/cls_u32.c | 3 + net/sched/sch_api.c | 24 +- net/tls/tls_sw.c | 7 + net/x25/af_x25.c | 4 +- net/x25/x25_timer.c | 25 +- security/selinux/ss/policydb.c | 31 ++ security/selinux/ss/services.c | 28 +- sound/soc/codecs/cs35l41-lib.c | 2 +- sound/soc/codecs/cs35l45-tables.c | 32 +- sound/soc/codecs/cs4265.c | 4 +- sound/soc/codecs/lpass-wsa-macro.c | 8 +- sound/soc/codecs/tas2562.c | 9 +- sound/soc/fsl/fsl_sai.c | 29 +- sound/soc/sof/sof-audio.c | 9 +- sound/soc/xilinx/xlnx_formatter_pcm.c | 10 +- tools/testing/selftests/net/mptcp/mptcp_join.sh | 4 +- tools/testing/selftests/net/tls.c | 549 +++++++++++++++++++++ 200 files changed, 2659 insertions(+), 1145 deletions(-)

2 weeks, 1 day

Payment Notification - SWIFT Copy Attached

by Accounting Dept

PDF SWIFT_PAYMENT_MT103_01.pdf 672 KB ▼   ↑ 1 attachment (672 KB)   ▼ Payment Notification Good day, Payment has been processed for the outstanding invoices. The SWIFT copy is attached for your reference. Please click here to view. Thank you, Accounts Department

2 weeks, 2 days

Payment Notification - SWIFT Copy Attached

by Virtru Notifications

admin(a)ugasaf.org

2 weeks, 2 days

AV & Systems Integration Industry Contacts

by Shana Eudy

Integrated Systems Europe (ISE) Hi, Hope you are doing great! As I can see that you are one of the exhibitors at Integrated Systems Europe (ISE), would you like to get your hands on verified AV & Systems Integration Industry Contacts? We can help you connect with AV Professionals, System Integrators, AV Consultants, AV Designers, IT Specialists, Facilities Managers, Technology Decision-Makers, Corporate AV Teams, Education Institutions, Retailers, Hospitality Groups, and other professionals involved in professional audiovisual solutions across Europe, USA or globally. Let me know if you are interested to see a sample, counts and pricing. If yes, let me know your target audience and geography. Regards, Shana Eudy Sr. Marketing Manager To stop receiving future emails, reply with Omit.

2 weeks, 2 days

[PATCH 7.1 000/271] 7.1.9-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 7.1.9 release. There are 271 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 19 Aug 2026 13:23:44 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.1.9-rc1.… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.1.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 7.1.9-rc1 Xu Rao <raoxu(a)uniontech.com> thunderbolt: Fix bandwidth group reservation indexing Bryam Vargas <hexlabsecurity(a)proton.me> thunderbolt: Bound the DROM dual link port number before indexing sw->ports Qing Ming <a0yami(a)mailbox.org> sctp: clear new_transport when removing a peer Yuxiang Yang <yangyx22(a)mails.tsinghua.edu.cn> sctp: fix use-after-free of cached ASCONF chunk Baul Lee <baul.lee(a)xbow.com> sctp: keep chunk->transport in step with the list it is queued on Xu Rao <raoxu(a)uniontech.com> scsi: scsi_debug: Negate wrapped memcmp() result Chengfeng Ye <nicoyip.dev(a)gmail.com> bpf, sockmap: Fix sk_redir use-after-free in send verdict Eric Biggers <ebiggers(a)kernel.org> fsverity: Fix silent truncation in bpf_get_fsverity_digest() Eric Biggers <ebiggers(a)kernel.org> fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions Hugh Dickins <hughd(a)google.com> mm/filemap: __filemap_add_folio() restore index before retrying Mimi Zohar <zohar(a)linux.ibm.com> ima: Instantiate file_truncate and path_truncate hooks Tejun Heo <tj(a)kernel.org> sched_ext: Take cgroup_lock() first in scx_cgroup_lock() Tejun Heo <tj(a)kernel.org> sched/psi: Create the psimon kthread outside of cgroup_mutex Tejun Heo <tj(a)kernel.org> sched/psi: Shut down rtpoll_timer in psi_cgroup_free() Zhan Xusheng <zhanxusheng(a)xiaomi.com> fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() Andrey Albershteyn <aalbersh(a)kernel.org> fs,fsverity: remove check for fsverity being enabled in setattr_prepare() Zhiling Zou <zhilinz(a)nebusec.ai> ip6_tunnel: clear skb2->cb[] in ip6ip6_err() Yuejie Shi <syjcnss(a)gmail.com> ipv6: fix Route Information option length validation Lorenzo Stoakes (ARM) <ljs(a)kernel.org> mm/ptdump: always stabilise against page table freeing using init_mm Zhiling Zou <zhilinz(a)nebusec.ai> mm/page_table_check: skip special zero mappings Tengda Wu <wutengda(a)huaweicloud.com> ring-buffer: Use current_context for safe per-CPU buffer swap Vincent Donnefort <vdonnefort(a)google.com> ring-buffer: Initialise reader page order in rb_allocate_cpu_buffer() Ahmad Byagowi <ahmadexp(a)gmail.com> ptp: ocp: Fix board ID over-read Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Revert "thermal: hwmon: Register a hwmon device for each thermal zone" Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Revert "thermal/drivers/hwmon: Cleanup coding style a bit" Vincent Donnefort <vdonnefort(a)google.com> ring-buffer: Prevent resizing of persistent ring buffer Steven Rostedt <rostedt(a)goodmis.org> eventfs: Use children field for rcu head and add memory barriers Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> eventfs: Fix use-after-free in eventfs_remove_rec() Sean Christopherson <seanjc(a)google.com> KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page Paolo Bonzini <pbonzini(a)redhat.com> KVM: SVM: Serialize accesses to the owner and mirror list with separate lock Frank Sorenson <sorenson(a)redhat.com> smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> smb: client: Fix use-after-free in cifs_try_adding_channels() Jun Yang <junvyyang(a)tencent.com> tipc: read le->link under the node lock in tipc_node_link_down() chanyoung <ppoo1220(a)gmail.com> tls: don't leave a full plaintext sk_msg ring unpushed Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> tls: rx: restore msg_iter before TLS 1.3 optimistic retry Jun Yang <junvyyang(a)tencent.com> vhost: reset the vring metadata cache on vring reconfiguration Sun Jian <sun.jian.kdev(a)gmail.com> veth: fix skb length accounting after XDP frag adjustment Weiming Shi <bestswngs(a)gmail.com> vsock/virtio: avoid refilling the RX queue after teardown Weiming Shi <bestswngs(a)gmail.com> vsock/virtio: read virtqueues under worker locks Baul Lee <baul.lee(a)xbow.com> vxlan: do not arm the ageing timer on a device that is down Zhiling Zou <zhilinz(a)nebusec.ai> xdp: reject clones that overrun skb_shared_info tailroom Breno Leitao <leitao(a)debian.org> x86/mce: Set up the polling timer before CMCI discovery Rik van Riel <riel(a)surriel.com> x86/CPU: Add a tlbi= cmdline switch Lorenzo Stoakes (ARM) <ljs(a)kernel.org> arm64: remove redundant concurrent ptdump UAF mitigation Hidayath Khan <hidayath(a)linux.ibm.com> dibs: initialise dibs->lock in dibs_dev_alloc() Asad Kamal <asad.kamal(a)amd.com> Revert "drm/amdgpu: fix aperture mapping leak" Christian Brauner <brauner(a)kernel.org> binfmt_misc: don't warn when the mount is completed from another user namespace Christian Brauner <brauner(a)kernel.org> ovl: don't warn when the mount is completed from another user namespace Hyunjung Ko <hj351016(a)gmail.com> net/sched: act_gact, act_police: range check the fallback control action Hyunjung Ko <hj351016(a)gmail.com> net/sched: act_ct: fix sk_buff leak when the header checks reject a packet Yangyu Chen <cyy(a)cyyself.name> net: atlantic: free RX pages of consumed but not refilled buffers Yangyu Chen <cyy(a)cyyself.name> net: atlantic: free stranded TX buffers on ring deinit Zihan Xi <zihanx(a)nebusec.ai> netfilter: nf_conntrack: defer invalid log until after unlock Zhiling Zou <zhilinz(a)nebusec.ai> netfilter: bridge: release template ct on non-IP path Koichiro Den <den(a)valinux.co.jp> NTB: ntb_netdev: Preserve RX queue depth on allocation failure Pavel Begunkov <asml.silence(a)gmail.com> net: devmem: prevent net-iov / page mixing Baul Lee <baul.lee(a)xbow.com> net/x25: fix use-after-free of the socket by its timers Alexandra Winter <wintera(a)linux.ibm.com> net/dibs: Correct freeing of dmb_clientid_arr Kyle Zeng <kylebot(a)openai.com> ipv6: prevent in6_dev_get() from resurrecting inet6_dev Daming Li <d4n.for.sec(a)gmail.com> net: smc: fix splice entry lifetime imbalance in smc_rx_splice Ahmed Naseef <naseefkm(a)gmail.com> net: phy: mediatek: fix TX blink masks using the RX bits Lorenzo Stoakes (ARM) <ljs(a)kernel.org> mm/huge_memory: fix huge_zero_pfn race Matt Fleming <mfleming(a)cloudflare.com> mm/huge_memory: initialise workingset state before folio split Hui Su <sh_def(a)163.com> tracing: Fix NULL pointer dereference in module event cache removal Vincent Donnefort <vdonnefort(a)google.com> ring-buffer: Prevent subbuf order change when resizing is disabled Rik van Riel <riel(a)surriel.com> fbdev: bitblit: bound-check glyph index in bit_cursor() Michael Wu <michael(a)allwinnertech.com> tracing: Fix race between update_event_fields and, event_define_fields Aditya Chillara <aditya.chillara(a)oss.qualcomm.com> perf/core: Fix group leader use-after-free after sibling detach Maíra Canal <mcanal(a)igalia.com> drm/v3d: Serialize the scheduler timeout handlers Baul Lee <baul.lee(a)xbow.com> ALSA: us144mkii: re-anchor capture URBs on resubmission Xu Rao <raoxu(a)uniontech.com> ALSA: hda/tas2781: fix ACPI reference handling Baul Lee <baul.lee(a)xbow.com> ALSA: FCP: fix OOB write in fcp_meter_ctl_get() Baul Lee <baul.lee(a)xbow.com> ALSA: usx2y: bound the hwdep mmap fault offset Takashi Iwai <tiwai(a)suse.de> ALSA: usb: Fix UAF at delayed release of MIDI2 EPs SJ Park <sj(a)kernel.org> mm/damon: adjust isolated pages stat for DAMOS_MIGRATE_{HOT,COLD} SJ Park <sj(a)kernel.org> samples/damon/mtier: error out for zero quota goal target values liyouhong <liyouhong(a)kylinos.cn> mm/damon/ops-common: putback folios on invalid migrate nid SJ Park <sj(a)kernel.org> mm/damon/lru_sort: error out for >10000 active_mem_bp Hui Su <sh_def(a)163.com> ring-buffer: Fix crash passing ERR_PTR to kthread_stop() Eddie Lin <eddie.lin(a)oss.qualcomm.com> misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free Junrui Luo <moonafterrain(a)outlook.com> misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke Ekansh Gupta <ekansh.gupta(a)oss.qualcomm.com> misc: fastrpc: Remove buffer from list prior to unmap operation Anandu Krishnan E <anandu.e(a)oss.qualcomm.com> misc: fastrpc: fix channel ctx ref leak when session alloc fails Ekansh Gupta <ekansh.gupta(a)oss.qualcomm.com> misc: fastrpc: Fix initial memory allocation for Audio PD memory pool Mariano Baragiola <mbaragiola(a)linux.com> staging: rtl8723bs: validate monitor transmit frame lengths Panagiotis Petrakopoulos <npetrakopoulos2003(a)gmail.com> staging: rtl8723bs: fix missing shared-key auth challenge length check Muhammad Bilal <meatuni001(a)gmail.com> staging: rtl8723bs: fix OOB read in WMM_param_handler() Muhammad Bilal <meatuni001(a)gmail.com> staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() Fan Wu <fanwu01(a)zju.edu.cn> serial: amba-pl011: synchronize DMA teardown Fan Wu <fanwu01(a)zju.edu.cn> serial: amba-pl011: cancel RS485 hrtimers after freeing IRQ Fan Wu <fanwu01(a)zju.edu.cn> serial: amba-pl011: fix indefinite RS485 post-send delay Ryan Wilbur <rwilbur633(a)gmail.com> serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx Cunhao Lu <1579567540(a)qq.com> serial: 8250_dma: Clear stale RX state on shutdown Luca Fresi <luca.fresi(a)bithiatec.com> serial: sc16is7xx: enable THRI before filling TX FIFO Jan Sebastian Götte <linux(a)jaseg.de> serial: qcom-geni: fix TX DMA buffer flush Alice Ryhl <aliceryhl(a)google.com> rust_binder: do not query current thread for all ioctls Mathieu Dubois-Briand <mathieu.dubois-briand(a)bootlin.com> nvmem: layouts: Add fixed-layout driver Aelin Reidel <aelin(a)mainlining.org> nvmem: apple-spmi-nvmem: wrap regmap calls to satisfy CFI Alexander Usyskin <alexander.usyskin(a)intel.com> mei: pull kvfree out of spinlock Chengfeng Ye <nicoyip.dev(a)gmail.com> ipv4: fix use-after-free in fib_nhc_update_mtu() Zihan Xi <zihanx(a)nebusec.ai> ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops Michal Luczaj <mhal(a)rbox.co> selftests/bpf: Adapt sockmap update error handling Michal Luczaj <mhal(a)rbox.co> selftests/bpf: Ensure UDP sockets are bound Nils Helmig <nils.helmig(a)web.de> Bluetooth: btusb: Add TP-Link UB600 for Realtek 8761BUV Alexej Sidorenko <alexej(a)sidorenko.cz> Bluetooth: btrtl: fix RTL8761B/BU broken LE extended scan Maciej Fijalkowski <maciej.fijalkowski(a)intel.com> selftests/xsk: account reclaimed invalid Tx descriptors Maciej Fijalkowski <maciej.fijalkowski(a)intel.com> selftests/xsk: fix too-many-frags multi-buffer Tx test Keno Fischer <keno(a)juliacomputing.com> futex: Prevent robust futex exit race some more Alex Deucher <alexander.deucher(a)amd.com> Revert "drm/amd/display: Fix backlight max_brightness to match exported range" Baul Lee <baul.lee(a)xbow.com> net: bridge: mrp: fix uninitialised bytes on the wire Chengfeng Ye <nicoyip.dev(a)gmail.com> netfilter: ebt_nflog: pin the NFLOG backend Philipp David <pd-lkml(a)3b.pm> igc: fix netdev not re-attached after resume if interface is down Zihan Xi <zihanx(a)nebusec.ai> mac802154: fix netdev use-after-free in beacon worker Zhiling Zou <zhilinz(a)nebusec.ai> inet: frags: publish queues before arming timer Qihang Tang <q.h.hack.winter(a)gmail.com> net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header Sergey V. Frolov <Sergey.V.Frolov(a)kaspersky.com> net: octeontx2-pf: Fix UB in shift operation Zijie Huang <milkory(a)outlook.com> net/sched: reject overly deep qdisc hierarchies Zhiling Zou <zhilinz(a)nebusec.ai> net: openvswitch: reallocate update replies for mismatched IDs Sun Jian <sun.jian.kdev(a)gmail.com> net: fix skb length accounting after generic XDP frag adjustment Zihan Xi <zihanx(a)nebusec.ai> packet: synchronize pressure clearing with ring reconfiguration Doruk Tan Ozturk <doruk(a)0sec.ai> net/packet: reset the MAC header on the packet-socket transmit path Qihang Tang <q.h.hack.winter(a)gmail.com> packet: use consistent hard_header_len in TX_RING send path Qihang Tang <q.h.hack.winter(a)gmail.com> packet: use consistent hard_header_len in non-ring send paths Kyle Zeng <kylebot(a)openai.com> ipvs: clear IPv4 options after rebasing tunnel ICMP errors Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> ipvs: separate destination availability state Julian Anastasov <ja(a)ssi.bg> ipvs: properly update the overload flag on dest edit Julian Anastasov <ja(a)ssi.bg> ipvs: add totalconns for dest Zhiling Zou <zhilinz(a)nebusec.ai> ipvs: stop estimator after disabled calc phase Lincoln Wallace <locnnil0(a)gmail.com> ima: fix out-of-bounds read in xattr_verify() Lorenzo Stoakes (ARM) <ljs(a)kernel.org> mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: evdev - fix information leak in evdev_pass_values() Andy Lutomirski <luto(a)kernel.org> mm: fix incorrect flush address in direct page table reclaim Joshua Rogers <linux(a)joshua.hu> vt: stabilize tty reference in kbd_keycode with tty_port_tty_get Joshua Rogers <linux(a)joshua.hu> vt: add permission check for KDSKBMETA ioctl Laurent Vivier <lvivier(a)redhat.com> usbnet: cap max_mtu for drivers without bind callback Doruk Tan Ozturk <doruk(a)0sec.ai> net: usb: ipheth: fix carrier_work UAF on disconnect Yi Cong <yicong(a)kylinos.cn> net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup() Sonali Pradhan <sonalipradhan(a)google.com> usb: gadget: f_ncm: Use unsigned int for ndp_index Pawel Laszczak <pawell(a)cadence.com> usb: cdnsp: fix incorrect endian conversions for APB timeout register Xu Rao <raoxu(a)uniontech.com> thunderbolt: icm: Preserve USB4 proxy data-valid bit Lachlan Hodges <lachlan.hodges(a)morsemicro.com> usb: xhci: use BIT_ULL for CRCR bits to fix incorrect 64bit mask Aleksandr Nogikh <nogikh(a)google.com> usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() Jiangshan Yi <yijiangshan(a)kylinos.cn> usb: misc: usbio: check ibuf_len against rxbuf_len in bulk msg Ishaan Dandekar <ishaan.dandekar(a)gmail.com> usb: quirks: Add ShanWan gamepad to quirk list Nikhil Solanke <nikhilsolanke5(a)gmail.com> usb: core: Add quirk for 255-bytes initial config read Baul Lee <baul.lee(a)xbow.com> ALSA: usb-audio: fix OOB write on Type II inbound URBs Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: evdev - sanitize event type index when fetching event masks Dongli Zhang <dongli.zhang(a)oracle.com> net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Fix sticky mixer regressions on M-Audio Fast Track Ultra Ali Ahmet Memis <ali(a)iusegentoo.com> hwmon: (corsair-psu) serialize debugfs access against hwmon Guenter Roeck <linux(a)roeck-us.net> hwmon: Support guard() and scoped_guard for subsystem locks Guenter Roeck <linux(a)roeck-us.net> hwmon: (ltc4282) Fix parsing adi,current-limit-sense-microvolt Guenter Roeck <linux(a)roeck-us.net> hwmon: (ltc4282) Clamp negative current limits Guenter Roeck <linux(a)roeck-us.net> hwmon: (ltc4282) Avoid overflow in maximum power calculation Qingshuang Fu <fuqingshuang(a)kylinos.cn> hwmon: (ads7828) Fix external VREF regulator handling Wilken Gottwalt <wilken.gottwalt(a)posteo.net> hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination Kumar Kartikeya Dwivedi <memxor(a)gmail.com> rqspinlock: Reset tail when preserving queue on deadlock Hongyan Xu <getshell(a)seu.edu.cn> watchdog: at91sam9_wdt: prevent timer rearm during teardown Maximilian Immanuel Brandtner <maxbr(a)linux.ibm.com> tls: don't abort the connection on signal-interrupted sends Xin Long <lucien.xin(a)gmail.com> sctp: clear control chunk transport if it is being removed Eric Dumazet <edumazet(a)google.com> net/atm: fix slab-out-of-bounds read in vcc_setsockopt() Alexandra Winter <wintera(a)linux.ibm.com> s390/ism: Fix UAF of sba and ieq during ism_dev_exit() Bhargava Marreddy <bhargava.marreddy(a)broadcom.com> bnge: Fix resource leak in bnge_init_nic() error path Hongyan Xu <getshell(a)seu.edu.cn> ata: pata_sl82c105: fix bridge revision use-after-free Fan XinRan <shinjiangjiang(a)gmail.com> net: thunderbolt: Tear down DMA paths before stopping the rings Łukasz Patron <priv.luk(a)gmail.com> net: qrtr: ns: Raise lookup limit to 128 Sidraya Jayagond <sidraya(a)linux.ibm.com> net/smc: fix TOCTOU race between smc_listen_out() and listener close Eric Dumazet <edumazet(a)google.com> net: remove WARN_ON_ONCE() from sk_mc_loop() Pengpeng Hou <pengpeng(a)iscas.ac.cn> net: prestera: validate firmware header length Henry Martin <bsdhenrymartin(a)gmail.com> net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length Eric Dumazet <edumazet(a)google.com> netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref() Jiayuan Chen <jiayuan.chen(a)linux.dev> tcp: fix TFO max_qlen accounting across reuseport migration Luxiao Xu <rakukuip(a)gmail.com> bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie Qing Luo <luoqing(a)kylinos.cn> sctp: fix addip_serial increment on ASCONF_ACK allocation failure Keegan Freyhof <keegan.freyhof(a)broadcom.com> bnxt_en: Fix PTP PPS setting bug Michael Chan <michael.chan(a)broadcom.com> bnxt_en: Disable EOP for TPA on all chips to prevent data corruption Shravya KN <shravya.k-n(a)broadcom.com> bnxt_en: Refresh VNIC default ring on queue restart if needed Shravya KN <shravya.k-n(a)broadcom.com> bnxt_en: Determine and store default RX ring in vnic structure Shravya KN <shravya.k-n(a)broadcom.com> bnxt_en: Move RSS table fill outside __bnxt_hwrm_vnic_set_rss() Bobby Eshleman <bobbyeshleman(a)meta.com> net/mlx5e: fix BQL reset on SQ re-activation Alok Tiwari <alok.a.tiwari(a)oracle.com> bnge: use int for bnge_fix_rings_count() return value Stefan Agner <stefan(a)agner.ch> net: stmmac: resume PHY before hardware setup when opening the interface Martin Kaiser <martin(a)kaiser.cx> selftests/ftrace: refactor eprobes test to fix argument checks Guenter Roeck <linux(a)roeck-us.net> hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations Qingshuang Fu <fuqingshuang(a)kylinos.cn> hwmon: (nzxt-smart2) Check return value of init_device() in probe Marcin Bernatowicz <marcin.bernatowicz(a)linux.intel.com> drm/xe/uc: Apply RCS/CCS yield policy to SR-IOV VFs Michał Winiarski <michal.winiarski(a)intel.com> drm/xe: Fix memory leak in exec_queue_set_hang_replay_state() Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers Cen Zhang (Microsoft) <blbllhy(a)gmail.com> net/openvswitch: check Ethernet header length in key_extract() Jia Jia <physicalmtea(a)gmail.com> vhost-scsi: reject feature changes after endpoint Linfeng Sun <slf(a)hdu.edu.cn> vhost-scsi: Validate T10 PI scatterlist counts Toke Høiland-Jørgensen <toke(a)toke.dk> net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter Xuanqiang Luo <luoxuanqiang(a)kylinos.cn> udp: fix potential use-after-free in tunnel segmentation Alok Tiwari <alok.a.tiwari(a)oracle.com> bnge: Fix NULL pointer dereference in aux device release Stanislav Fomichev <sdf.kernel(a)gmail.com> xsk: validate metadata when processing requests Stanislav Fomichev <sdf.kernel(a)gmail.com> xsk: move xsk_tx_metadata_request() to xdp_sock_drv.h Stanislav Fomichev <sdf.kernel(a)gmail.com> xsk: validate launch-time metadata size Stanislav Fomichev <sdf.kernel(a)gmail.com> xsk: clear metadata pointer when no timestamp is requested Stanislav Fomichev <sdf.kernel(a)gmail.com> xsk: pass TX metadata pointer by reference Stanislav Fomichev <sdf.kernel(a)gmail.com> xsk: require at least 16 bytes of TX metadata Will Chen <will.chen.tty(a)gmail.com> bnxt: fix memory leak in bnxt_queue_mem_alloc error cases Nathan Gao <zcgao(a)amazon.com> tcp: do not change rcv_ssthresh in tcp_measure_rcv_mss() Guenter Roeck <linux(a)roeck-us.net> hwmon: (pmbus) Fix type confusion in notification logic Guenter Roeck <linux(a)roeck-us.net> hwmon: (pmbus/core) Avoid race condition during probe Christian Borntraeger <borntraeger(a)linux.ibm.com> vdpa/mlx5: Fix buffer length in create_direct_keys() Yousef Alhouseen <alhouseenyousef(a)gmail.com> vhost/vdpa: reject overflowing PA map page counts on 32-bit Linfeng Sun <linfeng.sun.dev(a)gamil.com> vhost_iotlb: bound map allocation in add_range Rong Zhang <i(a)rong.moe> ALSA: usb-audio: Add QUIRK_FLAG_MIXER_GET_CUR_BROKEN for Logitech PRO X 2 LIGHTSPEED Rong Zhang <i(a)rong.moe> ALSA: usb-audio: Add QUIRK_FLAG_MIXER_GET_CUR_BROKEN Jose Fernandez (Anthropic) <jose.fernandez(a)linux.dev> bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch() Babanpreet Singh <bbnpreetsingh(a)gmail.com> counter: microchip-tcb-capture: Fix DT channel validation Chengfeng Ye <nicoyip.dev(a)gmail.com> bpf: Fix netns reference imbalance in conntrack kfuncs Lizhi Hou <lizhi.hou(a)amd.com> accel/amdxdna: Fix locally exploitable BUG_ON in amdxdna_insert_pages() Michael Guralnik <michaelgur(a)nvidia.com> net/mlx5: fw_tracer, return NULL on create error Or Har-Toov <ohartoov(a)nvidia.com> devlink: fix net namespace reference leak in reload Jiawen Liu <1298662399(a)qq.com> net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: cls_route: fix fastmap use-after-free on filter Mahanta Jambigi <mjambigi(a)linux.ibm.com> net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler() Yiyang Chen <chenyy23(a)mails.tsinghua.edu.cn> bpf: Propagate untrusted pointer state in commuted arithmetic Yiyang Chen <chenyy23(a)mails.tsinghua.edu.cn> bpf: Preserve pointer state for commuted arithmetic Lizhi Hou <lizhi.hou(a)amd.com> accel/amxdna: Fix page-insertion errors in amdxdna_insert_pages() Qu Wenruo <wqu(a)suse.com> btrfs: initialize inode mapping flags for cached inodes Dmitry Antipov <dmantipov(a)yandex.ru> btrfs: fix memory leak in btrfs_do_encoded_write() David Lee <david.lee(a)trailofbits.com> btrfs: lzo: reject inline extents without valid headers Qu Wenruo <wqu(a)suse.com> btrfs: lzo: add error message for invalid headers Matti Vaittinen <mazziesaccount(a)gmail.com> watchdog: bd96801_wdt: Fix timeout for enabled WDG Julian Anastasov <ja(a)ssi.bg> ipvs: return the csum validation for forward hook Julian Anastasov <ja(a)ssi.bg> ipvs: avoid out-of-bounds write in ip_vs_nat_icmp Jozsef Kadlecsik <kadlec(a)netfilter.org> netfilter: ipset: switch ext_size to atomic64_t Nikhil P. Rao <nikhil.rao(a)amd.com> pds_core: cancel pending PCI reset work on AER recovery Nikhil P. Rao <nikhil.rao(a)amd.com> pds_core: keep the health thread stopped during reset Shay Drory <shayd(a)nvidia.com> net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock Satish Kharat <satishkh(a)cisco.com> enic: fix tx_hang_reset use-after-free on device removal Xiang Mei (Microsoft) <xmei5(a)asu.edu> bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor Fan Ye <fy15309206903(a)gmail.com> Revert "net: thunderbolt: Enable end-to-end flow control also in transmit" Jijie Shao <shaojijie(a)huawei.com> net: hns3: fix speed configuration residue after driver reload Pengpeng Hou <pengpeng(a)iscas.ac.cn> drm/bridge: ps8640: propagate AUX transfer register errors Qingfang Deng <qingfang.deng(a)linux.dev> ovpn: fix incorrect use of rcu_access_pointer() Antonio Quartulli <antonio(a)openvpn.net> ovpn: ensure TCP vars are initialized first Antonio Quartulli <antonio(a)openvpn.net> ovpn: disable IPv4 redirects on MP interfaces Antonio Quartulli <antonio(a)openvpn.net> ovpn: hash floated peer by transport identity only Antonio Quartulli <antonio(a)openvpn.net> ovpn: zero-initialize sockaddr before learning a floated endpoint Antonio Quartulli <antonio(a)openvpn.net> ovpn: ensure socket is owned by ovpn before deref sk_user_data Antonio Quartulli <antonio(a)openvpn.net> ovpn: rehash peer in by_transp_addr table on CMD_PEER_SET Antonio Quartulli <antonio(a)openvpn.net> ovpn: skip rehash for peers already removed from by_id Rosen Penev <rosenp(a)gmail.com> ARM: dts: BCM5301X: fix PCIe controller 2 second interrupt Ralf Lici <ralf(a)mandelbit.com> ovpn: add missing rtnl_link_ops->get_size callback Hans Ulli Kroll <linux(a)ulli-kroll.de> pinctrl: qcom: ipq806x: mark pci reset as a GPIO pin function Hans Ulli Kroll <linux(a)ulli-kroll.de> pinctrl: qcom: ipq806x: mark gpio as a GPIO pin function Kuba Piecuch <jpiecuch(a)google.com> selftests/sched_ext: Handle sleeping task affinity changes in numa test Yuho Choi <dbgh9129(a)gmail.com> ARM: npcm: Fix OF node refcount leaks in SMP setup Yun Zhou <yun.zhou(a)windriver.com> xfs: handle NULL b_addr in xfs_buf_free Karthikeyan KS <karthiproffesional(a)gmail.com> soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read Daniel Drake <dan(a)reactivated.net> arm64: dts: broadcom: bcm2712: Remove non-functional EL2 virtual timer Anna Schumaker <anna.schumaker(a)hammerspace.com> NFS: Decrement refcounts if allocating nfs_free_stateid_data fails Anna Schumaker <anna.schumaker(a)hammerspace.com> NFS: Pin the 'struct nfs_server' during a FREE_STATEID call Tejun Heo <tj(a)kernel.org> sched_ext: Don't enable non-ext tasks in the sub-sched task loops Tejun Heo <tj(a)kernel.org> sched_ext: Skip sub-disable teardown for never-linked sub-schedulers Tejun Heo <tj(a)kernel.org> sched_ext: Reject setting disallow from init_task outside the enable path Dmitry Baryshkov <dmitry.baryshkov(a)oss.qualcomm.com> arm64: dts: qcom: sdm850-lenovo-yoga-c630: lower PSCI cluster idle Alexander Koskovich <akoskovich(a)pm.me> arm64: dts: qcom: sm8650: Fix IPA IMEM slice Krzysztof Kozlowski <krzysztof.kozlowski(a)oss.qualcomm.com> arm64: dts: qcom: monaco: Add default GIC address cells Akhil P Oommen <akhilpo(a)oss.qualcomm.com> arm64: dts: qcom: purwa: Fix GPU IOMMU property Bjorn Andersson <bjorn.andersson(a)oss.qualcomm.com> arm64: dts: qcom: glymur: fix QUP serial engine IRQs Bjorn Andersson <bjorn.andersson(a)oss.qualcomm.com> arm64: dts: qcom: glymur: fix PCIe SMMU interrupts Ray Wu <ray.wu(a)amd.com> drm/amd/display: Check for tg ops in dce110_set_avmute Ray Wu <ray.wu(a)amd.com> drm/amd/display: Add AV mute wait frames to dce110_set_avmute Mark Tomlinson <mark.tomlinson(a)alliedtelesis.co.nz> gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock Mykyta Yatsenko <yatsenko(a)meta.com> selftests/bpf: Add tests for sleepable tracepoint programs Michal Luczaj <mhal(a)rbox.co> selftests/bpf: Fail unbound UDP on sockmap update Al Viro <viro(a)zeniv.linux.org.uk> mount: honour SB_NOUSER in the new mount API ------------- Diffstat: Documentation/admin-guide/kernel-parameters.txt | 9 ++ Documentation/hwmon/hwmon-kernel-api.rst | 7 +- Documentation/sound/alsa-configuration.rst | 12 ++ MAINTAINERS | 5 + Makefile | 4 +- arch/arm/boot/dts/broadcom/bcm-ns.dtsi | 2 +- arch/arm/mach-npcm/platsmp.c | 2 + arch/arm64/boot/dts/broadcom/bcm2712.dtsi | 2 - arch/arm64/boot/dts/qcom/glymur.dtsi | 32 ++-- arch/arm64/boot/dts/qcom/monaco.dtsi | 1 + arch/arm64/boot/dts/qcom/purwa.dtsi | 2 + .../boot/dts/qcom/sdm850-lenovo-yoga-c630.dts | 4 + arch/arm64/boot/dts/qcom/sm8650.dtsi | 4 +- arch/arm64/include/asm/ptdump.h | 2 - arch/arm64/mm/mmu.c | 43 +----- arch/arm64/mm/ptdump.c | 11 +- arch/x86/kernel/cpu/common.c | 10 ++ arch/x86/kernel/cpu/mce/core.c | 2 +- arch/x86/kvm/mmu/mmu.c | 3 + arch/x86/kvm/svm/sev.c | 34 ++-- arch/x86/kvm/svm/svm.h | 1 + drivers/accel/amdxdna/amdxdna_gem.c | 47 +++--- drivers/android/binder/process.rs | 12 +- drivers/ata/pata_sl82c105.c | 4 +- drivers/bluetooth/btrtl.c | 13 ++ drivers/bluetooth/btusb.c | 2 + drivers/counter/microchip-tcb-capture.c | 4 +- drivers/dibs/dibs_loopback.c | 1 - drivers/dibs/dibs_main.c | 16 +- drivers/gpio/gpio-pca953x.c | 19 ++- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 2 + drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 35 +++-- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 6 +- .../drm/amd/display/dc/hwss/dce110/dce110_hwseq.c | 24 ++- drivers/gpu/drm/bridge/parade-ps8640.c | 27 +++- drivers/gpu/drm/v3d/v3d_drv.h | 6 + drivers/gpu/drm/v3d/v3d_sched.c | 9 +- drivers/gpu/drm/xe/xe_exec_queue.c | 3 + drivers/gpu/drm/xe/xe_uc.c | 7 +- drivers/hwmon/ads7828.c | 11 +- drivers/hwmon/corsair-psu.c | 8 +- drivers/hwmon/ltc4282.c | 20 ++- drivers/hwmon/nzxt-smart2.c | 6 +- drivers/hwmon/pmbus/lm25066.c | 5 +- drivers/hwmon/pmbus/pmbus_core.c | 65 +++++--- drivers/input/evdev.c | 27 ++-- drivers/misc/fastrpc.c | 27 ++-- drivers/misc/mei/client.c | 25 +-- drivers/net/bonding/bond_alb.c | 10 +- drivers/net/ethernet/amd/pds_core/core.h | 1 + drivers/net/ethernet/amd/pds_core/main.c | 14 +- drivers/net/ethernet/aquantia/atlantic/aq_ring.c | 51 +++++- drivers/net/ethernet/aquantia/atlantic/aq_ring.h | 1 + drivers/net/ethernet/aquantia/atlantic/aq_vec.c | 2 +- drivers/net/ethernet/broadcom/bnge/bnge_auxr.c | 9 +- drivers/net/ethernet/broadcom/bnge/bnge_netdev.c | 2 - drivers/net/ethernet/broadcom/bnge/bnge_resc.c | 3 +- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 64 +++++--- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 1 + drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c | 7 +- drivers/net/ethernet/cisco/enic/enic_main.c | 5 +- drivers/net/ethernet/hisilicon/hix5hd2_gmac.c | 1 - .../ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 6 +- drivers/net/ethernet/intel/igc/igc_main.c | 10 +- .../net/ethernet/marvell/octeontx2/nic/otx2_tc.c | 6 +- .../net/ethernet/marvell/prestera/prestera_pci.c | 3 + .../ethernet/mellanox/mlx5/core/diag/fw_tracer.c | 16 +- drivers/net/ethernet/mellanox/mlx5/core/en.h | 2 +- .../net/ethernet/mellanox/mlx5/core/en/tc_priv.h | 1 + drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c | 15 +- drivers/net/ethernet/mellanox/mlx5/core/en/xdp.h | 4 +- .../net/ethernet/mellanox/mlx5/core/en/xsk/tx.c | 2 +- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 4 +- drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 4 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 13 +- drivers/net/ntb_netdev.c | 15 +- drivers/net/ovpn/main.c | 64 +++++--- drivers/net/ovpn/netlink.c | 6 + drivers/net/ovpn/peer.c | 172 +++++++++++++++------ drivers/net/ovpn/peer.h | 1 + drivers/net/ovpn/socket.c | 9 ++ drivers/net/phy/mediatek/mtk.h | 8 +- drivers/net/tap.c | 24 +-- drivers/net/thunderbolt/main.c | 33 ++-- drivers/net/usb/ax88179_178a.c | 4 +- drivers/net/usb/ipheth.c | 11 +- drivers/net/usb/usbnet.c | 3 +- drivers/net/veth.c | 22 ++- drivers/net/vxlan/vxlan_core.c | 2 +- drivers/nvmem/apple-spmi-nvmem.c | 20 ++- drivers/nvmem/core.c | 24 +-- drivers/nvmem/internals.h | 2 + drivers/nvmem/layouts.c | 11 -- drivers/nvmem/layouts/Makefile | 1 + drivers/nvmem/layouts/fixed-layout.c | 58 +++++++ drivers/pinctrl/qcom/pinctrl-ipq8064.c | 8 +- drivers/pinctrl/qcom/pinctrl-msm.h | 5 + drivers/ptp/ptp_ocp.c | 4 +- drivers/s390/net/ism_drv.c | 19 ++- drivers/scsi/scsi_debug.c | 4 +- drivers/soc/aspeed/Makefile | 1 + drivers/soc/aspeed/aspeed-lpc-snoop.c | 38 +++-- drivers/staging/rtl8723bs/core/rtw_ieee80211.c | 3 + drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 2 +- drivers/staging/rtl8723bs/core/rtw_wlan_util.c | 3 + drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 4 + drivers/thermal/thermal_hwmon.c | 154 ++++++++++++------ drivers/thunderbolt/eeprom.c | 9 +- drivers/thunderbolt/icm.c | 2 +- drivers/thunderbolt/tb.c | 2 +- drivers/tty/serial/8250/8250_dma.c | 12 +- drivers/tty/serial/8250/8250_of.c | 38 +++++ drivers/tty/serial/amba-pl011.c | 86 +++++++---- drivers/tty/serial/qcom_geni_serial.c | 43 +++--- drivers/tty/serial/sc16is7xx.c | 3 + drivers/tty/vt/keyboard.c | 5 +- drivers/tty/vt/vt_ioctl.c | 2 + drivers/usb/atm/cxacru.c | 2 + drivers/usb/cdns3/cdnsp-gadget.c | 4 +- drivers/usb/core/config.c | 32 +++- drivers/usb/core/quirks.c | 7 + drivers/usb/gadget/function/f_ncm.c | 2 +- drivers/usb/host/xhci.h | 12 +- drivers/usb/misc/usbio.c | 2 +- drivers/vdpa/mlx5/core/mlx5_vdpa.h | 2 + drivers/vdpa/mlx5/core/mr.c | 8 +- drivers/vdpa/mlx5/core/resources.c | 11 +- drivers/vdpa/vdpa_sim/vdpa_sim.c | 10 +- drivers/vdpa/vdpa_user/iova_domain.c | 11 +- drivers/vhost/iotlb.c | 47 ++++-- drivers/vhost/scsi.c | 17 ++ drivers/vhost/vdpa.c | 18 ++- drivers/vhost/vhost.c | 16 ++ drivers/video/fbdev/core/bitblit.c | 9 +- drivers/watchdog/at91sam9_wdt.c | 4 +- drivers/watchdog/bd96801_wdt.c | 5 +- fs/attr.c | 2 +- fs/binfmt_misc.c | 3 +- fs/btrfs/inode.c | 4 +- fs/btrfs/lzo.c | 16 +- fs/crypto/policy.c | 2 +- fs/namespace.c | 4 + fs/nfs/nfs4proc.c | 17 +- fs/overlayfs/super.c | 3 +- fs/smb/client/sess.c | 2 +- fs/smb/client/smb1transport.c | 28 +++- fs/tracefs/event_inode.c | 28 +++- fs/tracefs/internal.h | 4 +- fs/verity/measure.c | 15 +- fs/xfs/xfs_buf.c | 2 +- include/linux/dibs.h | 2 +- include/linux/hwmon.h | 3 + include/linux/mmap_lock.h | 1 + include/linux/netdevice.h | 11 +- include/linux/netfilter/ipset/ip_set.h | 2 +- include/linux/nvmem-provider.h | 6 + include/linux/psi.h | 4 +- include/linux/sched/ext.h | 10 +- include/linux/usb/quirks.h | 3 + include/net/act_api.h | 19 +++ include/net/addrconf.h | 4 +- include/net/ip_vs.h | 48 +++--- include/net/libeth/xsk.h | 2 +- include/net/route.h | 2 + include/net/sch_generic.h | 1 + include/net/xdp_sock.h | 47 +----- include/net/xdp_sock_drv.h | 77 +++++++-- include/uapi/linux/ip_vs.h | 6 - kernel/bpf/rqspinlock.c | 5 +- kernel/bpf/verifier.c | 29 ++-- kernel/cgroup/cgroup.c | 23 ++- kernel/events/core.c | 67 ++++---- kernel/futex/core.c | 85 ++++++---- kernel/sched/ext.c | 47 ++++-- kernel/sched/psi.c | 75 +++++++-- kernel/trace/ring_buffer.c | 15 +- kernel/trace/trace_events.c | 4 +- mm/damon/lru_sort.c | 2 + mm/damon/ops-common.c | 13 +- mm/damon/paddr.c | 2 + mm/damon/vaddr.c | 3 +- mm/filemap.c | 6 + mm/huge_memory.c | 53 ++++--- mm/memory.c | 2 +- mm/page_table_check.c | 20 ++- mm/pagewalk.c | 36 +++-- mm/ptdump.c | 7 + mm/vmalloc.c | 40 +++-- net/atm/common.c | 14 +- net/bridge/br_mrp.c | 6 +- net/bridge/netfilter/ebt_nflog.c | 17 +- net/bridge/netfilter/nf_conntrack_bridge.c | 1 + net/core/datagram.c | 3 + net/core/dev.c | 10 +- net/core/filter.c | 4 +- net/core/sock.c | 1 - net/core/xdp.c | 2 +- net/devlink/dev.c | 1 + net/ipv4/fib_semantics.c | 101 +++++++----- net/ipv4/inet_connection_sock.c | 20 ++- net/ipv4/inet_fragment.c | 10 +- net/ipv4/route.c | 29 ++++ net/ipv4/tcp_bpf.c | 2 + net/ipv4/tcp_input.c | 2 +- net/ipv4/tcp_ipv4.c | 43 +++--- net/ipv4/udp_offload.c | 4 +- net/ipv6/ip6_tunnel.c | 3 + net/ipv6/route.c | 8 +- net/mac802154/scan.c | 4 + net/ncsi/ncsi-netlink.c | 4 + net/netfilter/ipset/ip_set_bitmap_gen.h | 4 +- net/netfilter/ipset/ip_set_core.c | 6 +- net/netfilter/ipset/ip_set_hash_gen.h | 2 +- net/netfilter/ipset/ip_set_list_set.c | 4 +- net/netfilter/ipvs/ip_vs_conn.c | 45 ++---- net/netfilter/ipvs/ip_vs_core.c | 76 ++++----- net/netfilter/ipvs/ip_vs_ctl.c | 81 ++++++++-- net/netfilter/ipvs/ip_vs_dh.c | 4 +- net/netfilter/ipvs/ip_vs_est.c | 10 +- net/netfilter/ipvs/ip_vs_lblc.c | 2 +- net/netfilter/ipvs/ip_vs_lblcr.c | 8 +- net/netfilter/ipvs/ip_vs_lc.c | 4 +- net/netfilter/ipvs/ip_vs_proto_sctp.c | 4 +- net/netfilter/ipvs/ip_vs_proto_tcp.c | 2 - net/netfilter/ipvs/ip_vs_sync.c | 7 +- net/netfilter/ipvs/ip_vs_xmit.c | 6 +- net/netfilter/nf_conntrack_bpf.c | 72 ++++++--- net/netfilter/nf_conntrack_proto.c | 6 + net/netfilter/nf_conntrack_proto_sctp.c | 12 +- net/netfilter/nf_conntrack_proto_tcp.c | 132 ++++++++++------ net/netfilter/nf_flow_table_ip.c | 3 + net/openvswitch/datapath.c | 29 +++- net/openvswitch/flow.c | 11 +- net/packet/af_packet.c | 72 ++++++--- net/qrtr/ns.c | 2 +- net/sched/act_ct.c | 29 +++- net/sched/act_gact.c | 5 + net/sched/act_police.c | 6 + net/sched/cls_api.c | 17 +- net/sched/cls_route.c | 35 +++-- net/sched/sch_api.c | 9 ++ net/sched/sch_cake.c | 1 - net/sctp/associola.c | 11 +- net/sctp/outqueue.c | 1 + net/sctp/sm_make_chunk.c | 3 +- net/sctp/sm_statefuns.c | 6 +- net/smc/af_smc.c | 3 +- net/smc/smc_llc.c | 3 +- net/smc/smc_rx.c | 19 +-- net/tipc/node.c | 15 +- net/tls/tls_sw.c | 18 ++- net/vmw_vsock/virtio_transport.c | 14 +- net/x25/af_x25.c | 4 +- net/x25/x25_timer.c | 25 +-- net/xdp/xdp_umem.c | 2 + net/xdp/xsk.c | 11 +- net/xdp/xsk_buff_pool.c | 6 +- samples/damon/mtier.c | 3 + security/integrity/ima/ima_appraise.c | 9 +- security/integrity/ima/ima_main.c | 39 +++++ sound/hda/codecs/side-codecs/tas2781_hda_spi.c | 3 +- sound/usb/endpoint.c | 6 +- sound/usb/fcp.c | 10 +- sound/usb/midi2.c | 9 ++ sound/usb/mixer.c | 60 +++++-- sound/usb/mixer.h | 1 + sound/usb/quirks.c | 7 + sound/usb/usbaudio.h | 13 ++ sound/usb/usx2y/us144mkii_capture.c | 1 + sound/usb/usx2y/usX2Yhwdep.c | 2 + sound/usb/usx2y/usx2yhwdeppcm.c | 2 + .../selftests/bpf/prog_tests/sockmap_basic.c | 6 +- .../selftests/bpf/prog_tests/sockmap_listen.c | 21 +-- tools/testing/selftests/bpf/prog_tests/test_xsk.c | 50 +++--- tools/testing/selftests/bpf/test_maps.c | 13 +- tools/testing/selftests/bpf/verifier/sleepable.c | 17 +- .../ftrace/test.d/dynevent/add_remove_eprobe.tc | 16 +- tools/testing/selftests/net/tls.c | 57 +++++++ tools/testing/selftests/sched_ext/numa.bpf.c | 13 +- 279 files changed, 3087 insertions(+), 1355 deletions(-)

2 weeks, 3 days

[PATCH 6.12 000/181] 6.12.104-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.12.104 release. There are 181 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 19 Aug 2026 13:23:44 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.104-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.12.104-rc1 Xiang Mei (Microsoft) <xmei5(a)asu.edu> bpf: tcp: fix double sock release on batch realloc Xu Rao <raoxu(a)uniontech.com> thunderbolt: Fix bandwidth group reservation indexing Bryam Vargas <hexlabsecurity(a)proton.me> thunderbolt: Bound the DROM dual link port number before indexing sw->ports Qing Ming <a0yami(a)mailbox.org> sctp: clear new_transport when removing a peer Yuxiang Yang <yangyx22(a)mails.tsinghua.edu.cn> sctp: fix use-after-free of cached ASCONF chunk Baul Lee <baul.lee(a)xbow.com> sctp: keep chunk->transport in step with the list it is queued on Xu Rao <raoxu(a)uniontech.com> scsi: scsi_debug: Negate wrapped memcmp() result Chengfeng Ye <nicoyip.dev(a)gmail.com> bpf, sockmap: Fix sk_redir use-after-free in send verdict Eric Biggers <ebiggers(a)kernel.org> fsverity: Fix silent truncation in bpf_get_fsverity_digest() Eric Biggers <ebiggers(a)kernel.org> fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions Mimi Zohar <zohar(a)linux.ibm.com> ima: Instantiate file_truncate and path_truncate hooks Tejun Heo <tj(a)kernel.org> sched/psi: Shut down rtpoll_timer in psi_cgroup_free() Zhan Xusheng <zhanxusheng(a)xiaomi.com> fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() Zhiling Zou <zhilinz(a)nebusec.ai> ip6_tunnel: clear skb2->cb[] in ip6ip6_err() Yuejie Shi <syjcnss(a)gmail.com> ipv6: fix Route Information option length validation Tengda Wu <wutengda(a)huaweicloud.com> ring-buffer: Use current_context for safe per-CPU buffer swap Ahmad Byagowi <ahmadexp(a)gmail.com> ptp: ocp: Fix board ID over-read Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Revert "thermal/drivers/hwmon: Cleanup coding style a bit" Steven Rostedt <rostedt(a)goodmis.org> eventfs: Use children field for rcu head and add memory barriers Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> eventfs: Fix use-after-free in eventfs_remove_rec() Sean Christopherson <seanjc(a)google.com> KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> smb: client: Fix use-after-free in cifs_try_adding_channels() Jun Yang <junvyyang(a)tencent.com> tipc: read le->link under the node lock in tipc_node_link_down() chanyoung <ppoo1220(a)gmail.com> tls: don't leave a full plaintext sk_msg ring unpushed Jun Yang <junvyyang(a)tencent.com> vhost: reset the vring metadata cache on vring reconfiguration Sun Jian <sun.jian.kdev(a)gmail.com> veth: fix skb length accounting after XDP frag adjustment Weiming Shi <bestswngs(a)gmail.com> vsock/virtio: avoid refilling the RX queue after teardown Weiming Shi <bestswngs(a)gmail.com> vsock/virtio: read virtqueues under worker locks Baul Lee <baul.lee(a)xbow.com> vxlan: do not arm the ageing timer on a device that is down Zhiling Zou <zhilinz(a)nebusec.ai> xdp: reject clones that overrun skb_shared_info tailroom Asad Kamal <asad.kamal(a)amd.com> Revert "drm/amdgpu: fix aperture mapping leak" Christian Brauner <brauner(a)kernel.org> binfmt_misc: don't warn when the mount is completed from another user namespace Christian Brauner <brauner(a)kernel.org> ovl: don't warn when the mount is completed from another user namespace Hyunjung Ko <hj351016(a)gmail.com> net/sched: act_gact, act_police: range check the fallback control action Hyunjung Ko <hj351016(a)gmail.com> net/sched: act_ct: fix sk_buff leak when the header checks reject a packet Yangyu Chen <cyy(a)cyyself.name> net: atlantic: free RX pages of consumed but not refilled buffers Yangyu Chen <cyy(a)cyyself.name> net: atlantic: free stranded TX buffers on ring deinit Zihan Xi <zihanx(a)nebusec.ai> netfilter: nf_conntrack: defer invalid log until after unlock Zhiling Zou <zhilinz(a)nebusec.ai> netfilter: bridge: release template ct on non-IP path Kyle Zeng <kylebot(a)openai.com> ipv6: prevent in6_dev_get() from resurrecting inet6_dev Daming Li <d4n.for.sec(a)gmail.com> net: smc: fix splice entry lifetime imbalance in smc_rx_splice Lorenzo Stoakes (ARM) <ljs(a)kernel.org> mm/huge_memory: fix huge_zero_pfn race Vincent Donnefort <vdonnefort(a)google.com> ring-buffer: Prevent subbuf order change when resizing is disabled Rik van Riel <riel(a)surriel.com> fbdev: bitblit: bound-check glyph index in bit_cursor() Michael Wu <michael(a)allwinnertech.com> tracing: Fix race between update_event_fields and, event_define_fields Baul Lee <baul.lee(a)xbow.com> ALSA: usx2y: bound the hwdep mmap fault offset Takashi Iwai <tiwai(a)suse.de> ALSA: usb: Fix UAF at delayed release of MIDI2 EPs Hui Su <sh_def(a)163.com> ring-buffer: Fix crash passing ERR_PTR to kthread_stop() Eddie Lin <eddie.lin(a)oss.qualcomm.com> misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free Junrui Luo <moonafterrain(a)outlook.com> misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke Ekansh Gupta <ekansh.gupta(a)oss.qualcomm.com> misc: fastrpc: Remove buffer from list prior to unmap operation Anandu Krishnan E <anandu.e(a)oss.qualcomm.com> misc: fastrpc: fix channel ctx ref leak when session alloc fails Mariano Baragiola <mbaragiola(a)linux.com> staging: rtl8723bs: validate monitor transmit frame lengths Panagiotis Petrakopoulos <npetrakopoulos2003(a)gmail.com> staging: rtl8723bs: fix missing shared-key auth challenge length check Muhammad Bilal <meatuni001(a)gmail.com> staging: rtl8723bs: fix OOB read in WMM_param_handler() Muhammad Bilal <meatuni001(a)gmail.com> staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() Cunhao Lu <1579567540(a)qq.com> serial: 8250_dma: Clear stale RX state on shutdown Jan Sebastian Götte <linux(a)jaseg.de> serial: qcom-geni: fix TX DMA buffer flush Mathieu Dubois-Briand <mathieu.dubois-briand(a)bootlin.com> nvmem: layouts: Add fixed-layout driver Alexander Usyskin <alexander.usyskin(a)intel.com> mei: pull kvfree out of spinlock Chengfeng Ye <nicoyip.dev(a)gmail.com> ipv4: fix use-after-free in fib_nhc_update_mtu() Zihan Xi <zihanx(a)nebusec.ai> ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops Michal Luczaj <mhal(a)rbox.co> selftests/bpf: Adapt sockmap update error handling Michal Luczaj <mhal(a)rbox.co> selftests/bpf: Ensure UDP sockets are bound Claudiu Beznea <claudiu.beznea.uj(a)bp.renesas.com> pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP Kees Cook <kees(a)kernel.org> kunit/fortify: Add back "volatile" for sizeof() constants Kees Cook <kees(a)kernel.org> kunit/fortify: Replace "volatile" with OPTIMIZER_HIDE_VAR() Keno Fischer <keno(a)juliacomputing.com> futex: Prevent robust futex exit race some more Ashish Kalra <ashish.kalra(a)amd.com> crypto: ccp - Abort doing SEV INIT if SNP INIT fails Michael Roth <michael.roth(a)amd.com> crypto: ccp - Fix checks for SNP_VLEK_LOAD input buffer length Ashish Kalra <ashish.kalra(a)amd.com> KVM: SVM: Add support to initialize SEV/SNP functionality in KVM Ashish Kalra <ashish.kalra(a)amd.com> crypto: ccp - Add new SEV/SNP platform shutdown API Harshal Dev <harshal.dev(a)oss.qualcomm.com> dt-bindings: crypto: qcom,ice: Fix missing power-domain and iface clk Keith Busch <kbusch(a)kernel.org> blk-mq: reinsert cached request to the list Keith Busch <kbusch(a)kernel.org> blk-mq: pop cached request if it is usable Bart Van Assche <bvanassche(a)acm.org> block: Reorder the request allocation code in blk_mq_submit_bio() Matthew Rosato <mjrosato(a)linux.ibm.com> KVM: s390: pci: Fix aisb calculation Farhan Ali <alifm(a)linux.ibm.com> KVM: s390: pci: Fix resource leak on IRQ registration failure Farhan Ali <alifm(a)linux.ibm.com> KVM: s390: pci: Fix missing error codes and memory unaccounting Farhan Ali <alifm(a)linux.ibm.com> KVM: s390: pci: Fix memory accounting for pinned/unpinned pages Baul Lee <baul.lee(a)xbow.com> net: bridge: mrp: fix uninitialised bytes on the wire Chengfeng Ye <nicoyip.dev(a)gmail.com> netfilter: ebt_nflog: pin the NFLOG backend Zihan Xi <zihanx(a)nebusec.ai> mac802154: fix netdev use-after-free in beacon worker Qihang Tang <q.h.hack.winter(a)gmail.com> net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header Sergey V. Frolov <Sergey.V.Frolov(a)kaspersky.com> net: octeontx2-pf: Fix UB in shift operation Zijie Huang <milkory(a)outlook.com> net/sched: reject overly deep qdisc hierarchies Zhiling Zou <zhilinz(a)nebusec.ai> net: openvswitch: reallocate update replies for mismatched IDs Sun Jian <sun.jian.kdev(a)gmail.com> net: fix skb length accounting after generic XDP frag adjustment Zihan Xi <zihanx(a)nebusec.ai> packet: synchronize pressure clearing with ring reconfiguration Doruk Tan Ozturk <doruk(a)0sec.ai> net/packet: reset the MAC header on the packet-socket transmit path Qihang Tang <q.h.hack.winter(a)gmail.com> packet: use consistent hard_header_len in TX_RING send path Qihang Tang <q.h.hack.winter(a)gmail.com> packet: use consistent hard_header_len in non-ring send paths Kyle Zeng <kylebot(a)openai.com> ipvs: clear IPv4 options after rebasing tunnel ICMP errors Julian Anastasov <ja(a)ssi.bg> ipvs: properly update the overload flag on dest edit Julian Anastasov <ja(a)ssi.bg> ipvs: add totalconns for dest Zhiling Zou <zhilinz(a)nebusec.ai> ipvs: stop estimator after disabled calc phase Lincoln Wallace <locnnil0(a)gmail.com> ima: fix out-of-bounds read in xattr_verify() Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: evdev - fix information leak in evdev_pass_values() Joshua Rogers <linux(a)joshua.hu> vt: stabilize tty reference in kbd_keycode with tty_port_tty_get Joshua Rogers <linux(a)joshua.hu> vt: add permission check for KDSKBMETA ioctl Doruk Tan Ozturk <doruk(a)0sec.ai> net: usb: ipheth: fix carrier_work UAF on disconnect Yi Cong <yicong(a)kylinos.cn> net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup() Sonali Pradhan <sonalipradhan(a)google.com> usb: gadget: f_ncm: Use unsigned int for ndp_index Pawel Laszczak <pawell(a)cadence.com> usb: cdnsp: fix incorrect endian conversions for APB timeout register Xu Rao <raoxu(a)uniontech.com> thunderbolt: icm: Preserve USB4 proxy data-valid bit Aleksandr Nogikh <nogikh(a)google.com> usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() Baul Lee <baul.lee(a)xbow.com> ALSA: usb-audio: fix OOB write on Type II inbound URBs Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: evdev - sanitize event type index when fetching event masks Guillaume Morin <guillaume(a)morinfr.org> swapfile: call cond_resched() before locking si->lock Mikhail Kshevetskiy <mikhail.kshevetskiy(a)iopsys.eu> mtd: spinand: repeat reading in regular mode if continuous reading fails Mikhail Kshevetskiy <mikhail.kshevetskiy(a)iopsys.eu> mtd: spinand: try a regular dirmap if creating a dirmap for continuous reading fails Mikhail Kshevetskiy <mikhail.kshevetskiy(a)iopsys.eu> mtd: spinand: fix direct mapping creation sizes Larisa Grigore <larisa.grigore(a)nxp.com> spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers Mehmet Fide <mehmet.fide(a)screeningeagle.com> net: fec: do not release NULL pages when RX buffer allocation fails Zeng Jingxiang <linuszeng(a)tencent.com> mm/vmscan: wake up flushers conditionally to avoid cgroup OOM Guenter Roeck <linux(a)roeck-us.net> hwmon: (ltc4282) Fix parsing adi,current-limit-sense-microvolt Guenter Roeck <linux(a)roeck-us.net> hwmon: (ltc4282) Clamp negative current limits Guenter Roeck <linux(a)roeck-us.net> hwmon: (ltc4282) Avoid overflow in maximum power calculation Qingshuang Fu <fuqingshuang(a)kylinos.cn> hwmon: (ads7828) Fix external VREF regulator handling Wilken Gottwalt <wilken.gottwalt(a)posteo.net> hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination Maximilian Immanuel Brandtner <maxbr(a)linux.ibm.com> tls: don't abort the connection on signal-interrupted sends Xin Long <lucien.xin(a)gmail.com> sctp: clear control chunk transport if it is being removed Eric Dumazet <edumazet(a)google.com> net/atm: fix slab-out-of-bounds read in vcc_setsockopt() Hongyan Xu <getshell(a)seu.edu.cn> ata: pata_sl82c105: fix bridge revision use-after-free Fan XinRan <shinjiangjiang(a)gmail.com> net: thunderbolt: Tear down DMA paths before stopping the rings Sidraya Jayagond <sidraya(a)linux.ibm.com> net/smc: fix TOCTOU race between smc_listen_out() and listener close Eric Dumazet <edumazet(a)google.com> net: remove WARN_ON_ONCE() from sk_mc_loop() Pengpeng Hou <pengpeng(a)iscas.ac.cn> net: prestera: validate firmware header length Henry Martin <bsdhenrymartin(a)gmail.com> net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length Jiayuan Chen <jiayuan.chen(a)linux.dev> tcp: fix TFO max_qlen accounting across reuseport migration Qing Luo <luoqing(a)kylinos.cn> sctp: fix addip_serial increment on ASCONF_ACK allocation failure Keegan Freyhof <keegan.freyhof(a)broadcom.com> bnxt_en: Fix PTP PPS setting bug Shravya KN <shravya.k-n(a)broadcom.com> bnxt_en: Refresh VNIC default ring on queue restart if needed Shravya KN <shravya.k-n(a)broadcom.com> bnxt_en: Determine and store default RX ring in vnic structure Shravya KN <shravya.k-n(a)broadcom.com> bnxt_en: Move RSS table fill outside __bnxt_hwrm_vnic_set_rss() Martin Kaiser <martin(a)kaiser.cx> selftests/ftrace: refactor eprobes test to fix argument checks Guenter Roeck <linux(a)roeck-us.net> hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations Qingshuang Fu <fuqingshuang(a)kylinos.cn> hwmon: (nzxt-smart2) Check return value of init_device() in probe Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers Cen Zhang (Microsoft) <blbllhy(a)gmail.com> net/openvswitch: check Ethernet header length in key_extract() Toke Høiland-Jørgensen <toke(a)toke.dk> net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter Xuanqiang Luo <luoxuanqiang(a)kylinos.cn> udp: fix potential use-after-free in tunnel segmentation Stanislav Fomichev <sdf.kernel(a)gmail.com> xsk: require at least 16 bytes of TX metadata Nathan Gao <zcgao(a)amazon.com> tcp: do not change rcv_ssthresh in tcp_measure_rcv_mss() Christian Borntraeger <borntraeger(a)linux.ibm.com> vdpa/mlx5: Fix buffer length in create_direct_keys() Yousef Alhouseen <alhouseenyousef(a)gmail.com> vhost/vdpa: reject overflowing PA map page counts on 32-bit Jose Fernandez (Anthropic) <jose.fernandez(a)linux.dev> bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch() Jordan Rife <jordan(a)jrife.io> bpf: tcp: Avoid socket skips and repeats during iteration Jordan Rife <jordan(a)jrife.io> bpf: tcp: Use bpf_tcp_iter_batch_item for bpf_tcp_iter_state batch items Jordan Rife <jordan(a)jrife.io> bpf: tcp: Get rid of st_bucket_done Jordan Rife <jordan(a)jrife.io> bpf: tcp: Make sure iter->batch always contains a full bucket snapshot Jordan Rife <jordan(a)jrife.io> bpf: tcp: Make mem flags configurable through bpf_iter_tcp_realloc_batch Babanpreet Singh <bbnpreetsingh(a)gmail.com> counter: microchip-tcb-capture: Fix DT channel validation Michael Guralnik <michaelgur(a)nvidia.com> net/mlx5: fw_tracer, return NULL on create error Or Har-Toov <ohartoov(a)nvidia.com> devlink: fix net namespace reference leak in reload Jiawen Liu <1298662399(a)qq.com> net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: cls_route: fix fastmap use-after-free on filter Mahanta Jambigi <mjambigi(a)linux.ibm.com> net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler() Yiyang Chen <chenyy23(a)mails.tsinghua.edu.cn> bpf: Preserve pointer state for commuted arithmetic Dmitry Antipov <dmantipov(a)yandex.ru> btrfs: fix memory leak in btrfs_do_encoded_write() Matti Vaittinen <mazziesaccount(a)gmail.com> watchdog: bd96801_wdt: Fix timeout for enabled WDG Julian Anastasov <ja(a)ssi.bg> ipvs: return the csum validation for forward hook Julian Anastasov <ja(a)ssi.bg> ipvs: avoid out-of-bounds write in ip_vs_nat_icmp Jozsef Kadlecsik <kadlec(a)netfilter.org> netfilter: ipset: switch ext_size to atomic64_t Nikhil P. Rao <nikhil.rao(a)amd.com> pds_core: cancel pending PCI reset work on AER recovery Nikhil P. Rao <nikhil.rao(a)amd.com> pds_core: keep the health thread stopped during reset Shay Drory <shayd(a)nvidia.com> net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock Satish Kharat <satishkh(a)cisco.com> enic: fix tx_hang_reset use-after-free on device removal Xiang Mei (Microsoft) <xmei5(a)asu.edu> bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor Fan Ye <fy15309206903(a)gmail.com> Revert "net: thunderbolt: Enable end-to-end flow control also in transmit" Jijie Shao <shaojijie(a)huawei.com> net: hns3: fix speed configuration residue after driver reload Pengpeng Hou <pengpeng(a)iscas.ac.cn> drm/bridge: ps8640: propagate AUX transfer register errors Rosen Penev <rosenp(a)gmail.com> ARM: dts: BCM5301X: fix PCIe controller 2 second interrupt Yuho Choi <dbgh9129(a)gmail.com> ARM: npcm: Fix OF node refcount leaks in SMP setup Daniel Drake <dan(a)reactivated.net> arm64: dts: broadcom: bcm2712: Remove non-functional EL2 virtual timer Anna Schumaker <anna.schumaker(a)hammerspace.com> NFS: Pin the 'struct nfs_server' during a FREE_STATEID call Harald Freudenberger <freude(a)linux.ibm.com> s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey() Ray Wu <ray.wu(a)amd.com> drm/amd/display: Check for tg ops in dce110_set_avmute Ray Wu <ray.wu(a)amd.com> drm/amd/display: Add AV mute wait frames to dce110_set_avmute Michal Luczaj <mhal(a)rbox.co> selftests/bpf: Fail unbound UDP on sockmap update Al Viro <viro(a)zeniv.linux.org.uk> mount: honour SB_NOUSER in the new mount API ------------- Diffstat: .../bindings/crypto/qcom,inline-crypto-engine.yaml | 16 +- MAINTAINERS | 5 + Makefile | 4 +- arch/arm/boot/dts/broadcom/bcm-ns.dtsi | 2 +- arch/arm/mach-npcm/platsmp.c | 2 + arch/arm64/boot/dts/broadcom/bcm2712.dtsi | 2 - arch/s390/kvm/pci.c | 86 ++++-- arch/s390/kvm/pci.h | 2 + arch/x86/kvm/mmu/mmu.c | 3 + arch/x86/kvm/svm/sev.c | 12 + block/blk-mq.c | 38 +-- drivers/ata/pata_sl82c105.c | 4 +- drivers/counter/microchip-tcb-capture.c | 4 +- drivers/crypto/ccp/sev-dev.c | 17 +- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 2 + drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 35 +-- .../drm/amd/display/dc/hwss/dce110/dce110_hwseq.c | 24 +- drivers/gpu/drm/bridge/parade-ps8640.c | 27 +- drivers/hwmon/ads7828.c | 11 +- drivers/hwmon/corsair-psu.c | 4 +- drivers/hwmon/ltc4282.c | 20 +- drivers/hwmon/nzxt-smart2.c | 6 +- drivers/hwmon/pmbus/lm25066.c | 5 +- drivers/input/evdev.c | 27 +- drivers/misc/fastrpc.c | 19 +- drivers/misc/mei/client.c | 25 +- drivers/mtd/nand/spi/core.c | 74 ++++-- drivers/net/bonding/bond_alb.c | 10 +- drivers/net/ethernet/amd/pds_core/core.h | 1 + drivers/net/ethernet/amd/pds_core/main.c | 14 +- drivers/net/ethernet/aquantia/atlantic/aq_ring.c | 51 +++- drivers/net/ethernet/aquantia/atlantic/aq_ring.h | 1 + drivers/net/ethernet/aquantia/atlantic/aq_vec.c | 2 +- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 50 ++-- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 1 + drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c | 7 +- drivers/net/ethernet/cisco/enic/enic_main.c | 5 +- drivers/net/ethernet/freescale/fec_main.c | 11 +- drivers/net/ethernet/hisilicon/hix5hd2_gmac.c | 1 - .../ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 6 +- .../net/ethernet/marvell/octeontx2/nic/otx2_tc.c | 6 +- .../net/ethernet/marvell/prestera/prestera_pci.c | 3 + .../ethernet/mellanox/mlx5/core/diag/fw_tracer.c | 16 +- .../net/ethernet/mellanox/mlx5/core/en/tc_priv.h | 1 + drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 4 +- drivers/net/thunderbolt/main.c | 33 ++- drivers/net/usb/ax88179_178a.c | 4 +- drivers/net/usb/ipheth.c | 11 +- drivers/net/veth.c | 22 +- drivers/net/vxlan/vxlan_core.c | 2 +- drivers/nvmem/core.c | 24 +- drivers/nvmem/internals.h | 2 + drivers/nvmem/layouts.c | 11 - drivers/nvmem/layouts/Makefile | 1 + drivers/nvmem/layouts/fixed-layout.c | 58 ++++ drivers/pinctrl/renesas/pinctrl-rzg2l.c | 4 +- drivers/ptp/ptp_ocp.c | 4 +- drivers/s390/crypto/zcrypt_ccamisc.c | 20 +- drivers/scsi/scsi_debug.c | 4 +- drivers/spi/spi-fsl-dspi.c | 13 +- drivers/staging/rtl8723bs/core/rtw_ieee80211.c | 3 + drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 2 +- drivers/staging/rtl8723bs/core/rtw_wlan_util.c | 3 + drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 4 + drivers/thermal/thermal_hwmon.c | 3 +- drivers/thunderbolt/eeprom.c | 9 +- drivers/thunderbolt/icm.c | 2 +- drivers/thunderbolt/tb.c | 2 +- drivers/tty/serial/8250/8250_dma.c | 12 +- drivers/tty/serial/qcom_geni_serial.c | 43 +-- drivers/tty/vt/keyboard.c | 5 +- drivers/tty/vt/vt_ioctl.c | 2 + drivers/usb/atm/cxacru.c | 2 + drivers/usb/cdns3/cdnsp-gadget.c | 4 +- drivers/usb/gadget/function/f_ncm.c | 2 +- drivers/vdpa/mlx5/core/mr.c | 3 +- drivers/vhost/vdpa.c | 9 +- drivers/vhost/vhost.c | 8 + drivers/video/fbdev/core/bitblit.c | 9 +- drivers/watchdog/bd96801_wdt.c | 5 +- fs/binfmt_misc.c | 3 +- fs/btrfs/inode.c | 1 + fs/crypto/policy.c | 2 +- fs/namespace.c | 5 + fs/nfs/nfs4proc.c | 5 + fs/overlayfs/super.c | 3 +- fs/smb/client/sess.c | 2 +- fs/tracefs/event_inode.c | 28 +- fs/tracefs/internal.h | 4 +- fs/verity/measure.c | 15 +- include/linux/netdevice.h | 11 +- include/linux/netfilter/ipset/ip_set.h | 2 +- include/linux/nvmem-provider.h | 6 + include/linux/psp-sev.h | 3 + include/net/act_api.h | 19 ++ include/net/addrconf.h | 4 +- include/net/ip_vs.h | 41 +-- include/net/route.h | 2 + include/net/sch_generic.h | 1 + kernel/bpf/verifier.c | 15 +- kernel/futex/core.c | 85 ++++-- kernel/sched/psi.c | 6 + kernel/trace/ring_buffer.c | 12 +- kernel/trace/trace_events.c | 2 + lib/fortify_kunit.c | 139 +++++----- mm/huge_memory.c | 49 ++-- mm/swapfile.c | 2 +- mm/vmscan.c | 25 +- net/atm/common.c | 14 +- net/bridge/br_mrp.c | 6 +- net/bridge/netfilter/ebt_nflog.c | 17 +- net/bridge/netfilter/nf_conntrack_bridge.c | 1 + net/core/dev.c | 10 +- net/core/sock.c | 1 - net/core/xdp.c | 2 +- net/devlink/dev.c | 1 + net/ipv4/fib_semantics.c | 101 ++++--- net/ipv4/inet_connection_sock.c | 20 +- net/ipv4/route.c | 29 ++ net/ipv4/tcp_bpf.c | 2 + net/ipv4/tcp_input.c | 2 +- net/ipv4/tcp_ipv4.c | 293 +++++++++++++++------ net/ipv4/udp_offload.c | 4 +- net/ipv6/ip6_tunnel.c | 3 + net/ipv6/route.c | 8 +- net/mac802154/scan.c | 4 + net/ncsi/ncsi-netlink.c | 4 + net/netfilter/ipset/ip_set_bitmap_gen.h | 4 +- net/netfilter/ipset/ip_set_core.c | 6 +- net/netfilter/ipset/ip_set_hash_gen.h | 2 +- net/netfilter/ipset/ip_set_list_set.c | 4 +- net/netfilter/ipvs/ip_vs_conn.c | 41 +-- net/netfilter/ipvs/ip_vs_core.c | 70 ++--- net/netfilter/ipvs/ip_vs_ctl.c | 77 +++++- net/netfilter/ipvs/ip_vs_est.c | 10 +- net/netfilter/ipvs/ip_vs_lc.c | 4 +- net/netfilter/ipvs/ip_vs_proto_sctp.c | 4 +- net/netfilter/ipvs/ip_vs_proto_tcp.c | 2 - net/netfilter/ipvs/ip_vs_sync.c | 7 +- net/netfilter/ipvs/ip_vs_xmit.c | 2 +- net/netfilter/nf_conntrack_proto.c | 6 + net/netfilter/nf_conntrack_proto_sctp.c | 12 +- net/netfilter/nf_conntrack_proto_tcp.c | 132 ++++++---- net/openvswitch/datapath.c | 29 +- net/openvswitch/flow.c | 11 +- net/packet/af_packet.c | 72 +++-- net/sched/act_ct.c | 29 +- net/sched/act_gact.c | 5 + net/sched/act_police.c | 6 + net/sched/cls_api.c | 17 +- net/sched/cls_route.c | 35 ++- net/sched/sch_api.c | 9 + net/sched/sch_cake.c | 1 - net/sctp/associola.c | 11 +- net/sctp/outqueue.c | 1 + net/sctp/sm_make_chunk.c | 3 +- net/sctp/sm_statefuns.c | 6 +- net/smc/af_smc.c | 3 +- net/smc/smc_llc.c | 3 +- net/smc/smc_rx.c | 19 +- net/tipc/node.c | 15 +- net/tls/tls_sw.c | 16 +- net/vmw_vsock/virtio_transport.c | 14 +- net/xdp/xdp_umem.c | 2 + security/integrity/ima/ima_appraise.c | 9 +- security/integrity/ima/ima_main.c | 39 +++ sound/usb/endpoint.c | 6 +- sound/usb/midi2.c | 9 + sound/usb/usx2y/usX2Yhwdep.c | 2 + sound/usb/usx2y/usx2yhwdeppcm.c | 2 + .../selftests/bpf/prog_tests/sockmap_basic.c | 6 +- .../selftests/bpf/prog_tests/sockmap_listen.c | 21 +- tools/testing/selftests/bpf/test_maps.c | 13 +- .../ftrace/test.d/dynevent/add_remove_eprobe.tc | 16 +- 174 files changed, 1957 insertions(+), 881 deletions(-)

2 weeks, 3 days

[PATCH 6.18 000/250] 6.18.45-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.18.45 release. There are 250 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 19 Aug 2026 13:23:44 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.45-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.18.45-rc1 Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: flowtable: ensure sufficient headroom in xmit path Lorenzo Bianconi <lorenzo(a)kernel.org> netfilter: always set route tuple out ifindex Xu Rao <raoxu(a)uniontech.com> thunderbolt: Fix bandwidth group reservation indexing Bryam Vargas <hexlabsecurity(a)proton.me> thunderbolt: Bound the DROM dual link port number before indexing sw->ports Qing Ming <a0yami(a)mailbox.org> sctp: clear new_transport when removing a peer Yuxiang Yang <yangyx22(a)mails.tsinghua.edu.cn> sctp: fix use-after-free of cached ASCONF chunk Baul Lee <baul.lee(a)xbow.com> sctp: keep chunk->transport in step with the list it is queued on Xu Rao <raoxu(a)uniontech.com> scsi: scsi_debug: Negate wrapped memcmp() result Chengfeng Ye <nicoyip.dev(a)gmail.com> bpf, sockmap: Fix sk_redir use-after-free in send verdict Eric Biggers <ebiggers(a)kernel.org> fsverity: Fix silent truncation in bpf_get_fsverity_digest() Eric Biggers <ebiggers(a)kernel.org> fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions Hugh Dickins <hughd(a)google.com> mm/filemap: __filemap_add_folio() restore index before retrying Mimi Zohar <zohar(a)linux.ibm.com> ima: Instantiate file_truncate and path_truncate hooks Tejun Heo <tj(a)kernel.org> sched/psi: Create the psimon kthread outside of cgroup_mutex Tejun Heo <tj(a)kernel.org> sched/psi: Shut down rtpoll_timer in psi_cgroup_free() Zhan Xusheng <zhanxusheng(a)xiaomi.com> fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() Zhiling Zou <zhilinz(a)nebusec.ai> ip6_tunnel: clear skb2->cb[] in ip6ip6_err() Yuejie Shi <syjcnss(a)gmail.com> ipv6: fix Route Information option length validation Lorenzo Stoakes (ARM) <ljs(a)kernel.org> mm/ptdump: always stabilise against page table freeing using init_mm Tengda Wu <wutengda(a)huaweicloud.com> ring-buffer: Use current_context for safe per-CPU buffer swap Vincent Donnefort <vdonnefort(a)google.com> ring-buffer: Initialise reader page order in rb_allocate_cpu_buffer() Ahmad Byagowi <ahmadexp(a)gmail.com> ptp: ocp: Fix board ID over-read Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Revert "thermal/drivers/hwmon: Cleanup coding style a bit" Steven Rostedt <rostedt(a)goodmis.org> eventfs: Use children field for rcu head and add memory barriers Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> eventfs: Fix use-after-free in eventfs_remove_rec() Sean Christopherson <seanjc(a)google.com> KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page Paolo Bonzini <pbonzini(a)redhat.com> KVM: SVM: Serialize accesses to the owner and mirror list with separate lock Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> smb: client: Fix use-after-free in cifs_try_adding_channels() Jun Yang <junvyyang(a)tencent.com> tipc: read le->link under the node lock in tipc_node_link_down() chanyoung <ppoo1220(a)gmail.com> tls: don't leave a full plaintext sk_msg ring unpushed Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> tls: rx: restore msg_iter before TLS 1.3 optimistic retry Jun Yang <junvyyang(a)tencent.com> vhost: reset the vring metadata cache on vring reconfiguration Sun Jian <sun.jian.kdev(a)gmail.com> veth: fix skb length accounting after XDP frag adjustment Weiming Shi <bestswngs(a)gmail.com> vsock/virtio: avoid refilling the RX queue after teardown Weiming Shi <bestswngs(a)gmail.com> vsock/virtio: read virtqueues under worker locks Baul Lee <baul.lee(a)xbow.com> vxlan: do not arm the ageing timer on a device that is down Zhiling Zou <zhilinz(a)nebusec.ai> xdp: reject clones that overrun skb_shared_info tailroom Breno Leitao <leitao(a)debian.org> x86/mce: Set up the polling timer before CMCI discovery Rik van Riel <riel(a)surriel.com> x86/CPU: Add a tlbi= cmdline switch Lorenzo Stoakes (ARM) <ljs(a)kernel.org> arm64: remove redundant concurrent ptdump UAF mitigation Hidayath Khan <hidayath(a)linux.ibm.com> dibs: initialise dibs->lock in dibs_dev_alloc() Asad Kamal <asad.kamal(a)amd.com> Revert "drm/amdgpu: fix aperture mapping leak" Christian Brauner <brauner(a)kernel.org> binfmt_misc: don't warn when the mount is completed from another user namespace Christian Brauner <brauner(a)kernel.org> ovl: don't warn when the mount is completed from another user namespace Hyunjung Ko <hj351016(a)gmail.com> net/sched: act_gact, act_police: range check the fallback control action Hyunjung Ko <hj351016(a)gmail.com> net/sched: act_ct: fix sk_buff leak when the header checks reject a packet Yangyu Chen <cyy(a)cyyself.name> net: atlantic: free RX pages of consumed but not refilled buffers Yangyu Chen <cyy(a)cyyself.name> net: atlantic: free stranded TX buffers on ring deinit Zihan Xi <zihanx(a)nebusec.ai> netfilter: nf_conntrack: defer invalid log until after unlock Zhiling Zou <zhilinz(a)nebusec.ai> netfilter: bridge: release template ct on non-IP path Pavel Begunkov <asml.silence(a)gmail.com> net: devmem: prevent net-iov / page mixing Baul Lee <baul.lee(a)xbow.com> net/x25: fix use-after-free of the socket by its timers Alexandra Winter <wintera(a)linux.ibm.com> net/dibs: Correct freeing of dmb_clientid_arr Kyle Zeng <kylebot(a)openai.com> ipv6: prevent in6_dev_get() from resurrecting inet6_dev Daming Li <d4n.for.sec(a)gmail.com> net: smc: fix splice entry lifetime imbalance in smc_rx_splice Ahmed Naseef <naseefkm(a)gmail.com> net: phy: mediatek: fix TX blink masks using the RX bits Lorenzo Stoakes (ARM) <ljs(a)kernel.org> mm/huge_memory: fix huge_zero_pfn race Hui Su <sh_def(a)163.com> tracing: Fix NULL pointer dereference in module event cache removal Vincent Donnefort <vdonnefort(a)google.com> ring-buffer: Prevent subbuf order change when resizing is disabled Rik van Riel <riel(a)surriel.com> fbdev: bitblit: bound-check glyph index in bit_cursor() Michael Wu <michael(a)allwinnertech.com> tracing: Fix race between update_event_fields and, event_define_fields Aditya Chillara <aditya.chillara(a)oss.qualcomm.com> perf/core: Fix group leader use-after-free after sibling detach Maíra Canal <mcanal(a)igalia.com> drm/v3d: Serialize the scheduler timeout handlers Baul Lee <baul.lee(a)xbow.com> ALSA: us144mkii: re-anchor capture URBs on resubmission Xu Rao <raoxu(a)uniontech.com> ALSA: hda/tas2781: fix ACPI reference handling Baul Lee <baul.lee(a)xbow.com> ALSA: FCP: fix OOB write in fcp_meter_ctl_get() Baul Lee <baul.lee(a)xbow.com> ALSA: usx2y: bound the hwdep mmap fault offset Takashi Iwai <tiwai(a)suse.de> ALSA: usb: Fix UAF at delayed release of MIDI2 EPs SJ Park <sj(a)kernel.org> mm/damon: adjust isolated pages stat for DAMOS_MIGRATE_{HOT,COLD} SJ Park <sj(a)kernel.org> samples/damon/mtier: error out for zero quota goal target values liyouhong <liyouhong(a)kylinos.cn> mm/damon/ops-common: putback folios on invalid migrate nid Hui Su <sh_def(a)163.com> ring-buffer: Fix crash passing ERR_PTR to kthread_stop() Eddie Lin <eddie.lin(a)oss.qualcomm.com> misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free Junrui Luo <moonafterrain(a)outlook.com> misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke Ekansh Gupta <ekansh.gupta(a)oss.qualcomm.com> misc: fastrpc: Remove buffer from list prior to unmap operation Anandu Krishnan E <anandu.e(a)oss.qualcomm.com> misc: fastrpc: fix channel ctx ref leak when session alloc fails Ekansh Gupta <ekansh.gupta(a)oss.qualcomm.com> misc: fastrpc: Fix initial memory allocation for Audio PD memory pool Mariano Baragiola <mbaragiola(a)linux.com> staging: rtl8723bs: validate monitor transmit frame lengths Panagiotis Petrakopoulos <npetrakopoulos2003(a)gmail.com> staging: rtl8723bs: fix missing shared-key auth challenge length check Muhammad Bilal <meatuni001(a)gmail.com> staging: rtl8723bs: fix OOB read in WMM_param_handler() Muhammad Bilal <meatuni001(a)gmail.com> staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() Fan Wu <fanwu01(a)zju.edu.cn> serial: amba-pl011: synchronize DMA teardown Fan Wu <fanwu01(a)zju.edu.cn> serial: amba-pl011: cancel RS485 hrtimers after freeing IRQ Fan Wu <fanwu01(a)zju.edu.cn> serial: amba-pl011: fix indefinite RS485 post-send delay Ryan Wilbur <rwilbur633(a)gmail.com> serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx Cunhao Lu <1579567540(a)qq.com> serial: 8250_dma: Clear stale RX state on shutdown Jan Sebastian Götte <linux(a)jaseg.de> serial: qcom-geni: fix TX DMA buffer flush Alice Ryhl <aliceryhl(a)google.com> rust_binder: do not query current thread for all ioctls Mathieu Dubois-Briand <mathieu.dubois-briand(a)bootlin.com> nvmem: layouts: Add fixed-layout driver Aelin Reidel <aelin(a)mainlining.org> nvmem: apple-spmi-nvmem: wrap regmap calls to satisfy CFI Alexander Usyskin <alexander.usyskin(a)intel.com> mei: pull kvfree out of spinlock Chengfeng Ye <nicoyip.dev(a)gmail.com> ipv4: fix use-after-free in fib_nhc_update_mtu() Zihan Xi <zihanx(a)nebusec.ai> ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops Michal Luczaj <mhal(a)rbox.co> selftests/bpf: Adapt sockmap update error handling Michal Luczaj <mhal(a)rbox.co> selftests/bpf: Ensure UDP sockets are bound Nils Helmig <nils.helmig(a)web.de> Bluetooth: btusb: Add TP-Link UB600 for Realtek 8761BUV Alexej Sidorenko <alexej(a)sidorenko.cz> Bluetooth: btrtl: fix RTL8761B/BU broken LE extended scan Florian Westphal <fw(a)strlen.de> netfilter: nf_tables: avoid softlockup warnings in nft_chain_validate Keno Fischer <keno(a)juliacomputing.com> futex: Prevent robust futex exit race some more Jose Fernandez (Anthropic) <jose.fernandez(a)linux.dev> iommu/vt-d: Gather the unmapped range before freeing its page tables Harshal Dev <harshal.dev(a)oss.qualcomm.com> dt-bindings: crypto: qcom,ice: Fix missing power-domain and iface clk Matthew Rosato <mjrosato(a)linux.ibm.com> KVM: s390: pci: Fix aisb calculation Keith Busch <kbusch(a)kernel.org> blk-mq: reinsert cached request to the list Keith Busch <kbusch(a)kernel.org> blk-mq: pop cached request if it is usable Alex Deucher <alexander.deucher(a)amd.com> Revert "drm/amd/display: Fix backlight max_brightness to match exported range" Baul Lee <baul.lee(a)xbow.com> net: bridge: mrp: fix uninitialised bytes on the wire Chengfeng Ye <nicoyip.dev(a)gmail.com> netfilter: ebt_nflog: pin the NFLOG backend Philipp David <pd-lkml(a)3b.pm> igc: fix netdev not re-attached after resume if interface is down Zihan Xi <zihanx(a)nebusec.ai> mac802154: fix netdev use-after-free in beacon worker Zhiling Zou <zhilinz(a)nebusec.ai> inet: frags: publish queues before arming timer Qihang Tang <q.h.hack.winter(a)gmail.com> net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header Sergey V. Frolov <Sergey.V.Frolov(a)kaspersky.com> net: octeontx2-pf: Fix UB in shift operation Zijie Huang <milkory(a)outlook.com> net/sched: reject overly deep qdisc hierarchies Zhiling Zou <zhilinz(a)nebusec.ai> net: openvswitch: reallocate update replies for mismatched IDs Sun Jian <sun.jian.kdev(a)gmail.com> net: fix skb length accounting after generic XDP frag adjustment Zihan Xi <zihanx(a)nebusec.ai> packet: synchronize pressure clearing with ring reconfiguration Doruk Tan Ozturk <doruk(a)0sec.ai> net/packet: reset the MAC header on the packet-socket transmit path Qihang Tang <q.h.hack.winter(a)gmail.com> packet: use consistent hard_header_len in TX_RING send path Qihang Tang <q.h.hack.winter(a)gmail.com> packet: use consistent hard_header_len in non-ring send paths Kyle Zeng <kylebot(a)openai.com> ipvs: clear IPv4 options after rebasing tunnel ICMP errors Julian Anastasov <ja(a)ssi.bg> ipvs: properly update the overload flag on dest edit Julian Anastasov <ja(a)ssi.bg> ipvs: add totalconns for dest Zhiling Zou <zhilinz(a)nebusec.ai> ipvs: stop estimator after disabled calc phase Lincoln Wallace <locnnil0(a)gmail.com> ima: fix out-of-bounds read in xattr_verify() Lorenzo Stoakes (ARM) <ljs(a)kernel.org> mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: evdev - fix information leak in evdev_pass_values() Joshua Rogers <linux(a)joshua.hu> vt: stabilize tty reference in kbd_keycode with tty_port_tty_get Joshua Rogers <linux(a)joshua.hu> vt: add permission check for KDSKBMETA ioctl Doruk Tan Ozturk <doruk(a)0sec.ai> net: usb: ipheth: fix carrier_work UAF on disconnect Yi Cong <yicong(a)kylinos.cn> net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup() Sonali Pradhan <sonalipradhan(a)google.com> usb: gadget: f_ncm: Use unsigned int for ndp_index Pawel Laszczak <pawell(a)cadence.com> usb: cdnsp: fix incorrect endian conversions for APB timeout register Xu Rao <raoxu(a)uniontech.com> thunderbolt: icm: Preserve USB4 proxy data-valid bit Aleksandr Nogikh <nogikh(a)google.com> usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() Jiangshan Yi <yijiangshan(a)kylinos.cn> usb: misc: usbio: check ibuf_len against rxbuf_len in bulk msg Ishaan Dandekar <ishaan.dandekar(a)gmail.com> usb: quirks: Add ShanWan gamepad to quirk list Nikhil Solanke <nikhilsolanke5(a)gmail.com> usb: core: Add quirk for 255-bytes initial config read Baul Lee <baul.lee(a)xbow.com> ALSA: usb-audio: fix OOB write on Type II inbound URBs Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: evdev - sanitize event type index when fetching event masks Dongli Zhang <dongli.zhang(a)oracle.com> net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() Mehmet Fide <mehmet.fide(a)screeningeagle.com> net: fec: do not release NULL pages when RX buffer allocation fails Guenter Roeck <linux(a)roeck-us.net> hwmon: (ltc4282) Fix parsing adi,current-limit-sense-microvolt Guenter Roeck <linux(a)roeck-us.net> hwmon: (ltc4282) Clamp negative current limits Guenter Roeck <linux(a)roeck-us.net> hwmon: (ltc4282) Avoid overflow in maximum power calculation Qingshuang Fu <fuqingshuang(a)kylinos.cn> hwmon: (ads7828) Fix external VREF regulator handling Wilken Gottwalt <wilken.gottwalt(a)posteo.net> hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination Hongyan Xu <getshell(a)seu.edu.cn> watchdog: at91sam9_wdt: prevent timer rearm during teardown Maximilian Immanuel Brandtner <maxbr(a)linux.ibm.com> tls: don't abort the connection on signal-interrupted sends Xin Long <lucien.xin(a)gmail.com> sctp: clear control chunk transport if it is being removed Eric Dumazet <edumazet(a)google.com> net/atm: fix slab-out-of-bounds read in vcc_setsockopt() Alexandra Winter <wintera(a)linux.ibm.com> s390/ism: Fix UAF of sba and ieq during ism_dev_exit() Bhargava Marreddy <bhargava.marreddy(a)broadcom.com> bnge: Fix resource leak in bnge_init_nic() error path Hongyan Xu <getshell(a)seu.edu.cn> ata: pata_sl82c105: fix bridge revision use-after-free Fan XinRan <shinjiangjiang(a)gmail.com> net: thunderbolt: Tear down DMA paths before stopping the rings Sidraya Jayagond <sidraya(a)linux.ibm.com> net/smc: fix TOCTOU race between smc_listen_out() and listener close Eric Dumazet <edumazet(a)google.com> net: remove WARN_ON_ONCE() from sk_mc_loop() Pengpeng Hou <pengpeng(a)iscas.ac.cn> net: prestera: validate firmware header length Henry Martin <bsdhenrymartin(a)gmail.com> net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length Eric Dumazet <edumazet(a)google.com> netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref() Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: flowtable: consolidate xmit path Jiayuan Chen <jiayuan.chen(a)linux.dev> tcp: fix TFO max_qlen accounting across reuseport migration Qing Luo <luoqing(a)kylinos.cn> sctp: fix addip_serial increment on ASCONF_ACK allocation failure Keegan Freyhof <keegan.freyhof(a)broadcom.com> bnxt_en: Fix PTP PPS setting bug Michael Chan <michael.chan(a)broadcom.com> bnxt_en: Disable EOP for TPA on all chips to prevent data corruption Shravya KN <shravya.k-n(a)broadcom.com> bnxt_en: Refresh VNIC default ring on queue restart if needed Shravya KN <shravya.k-n(a)broadcom.com> bnxt_en: Determine and store default RX ring in vnic structure Shravya KN <shravya.k-n(a)broadcom.com> bnxt_en: Move RSS table fill outside __bnxt_hwrm_vnic_set_rss() Bobby Eshleman <bobbyeshleman(a)meta.com> net/mlx5e: fix BQL reset on SQ re-activation Alok Tiwari <alok.a.tiwari(a)oracle.com> bnge: use int for bnge_fix_rings_count() return value Stefan Agner <stefan(a)agner.ch> net: stmmac: resume PHY before hardware setup when opening the interface Martin Kaiser <martin(a)kaiser.cx> selftests/ftrace: refactor eprobes test to fix argument checks Guenter Roeck <linux(a)roeck-us.net> hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations Qingshuang Fu <fuqingshuang(a)kylinos.cn> hwmon: (nzxt-smart2) Check return value of init_device() in probe Marcin Bernatowicz <marcin.bernatowicz(a)linux.intel.com> drm/xe/uc: Apply RCS/CCS yield policy to SR-IOV VFs Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers Cen Zhang (Microsoft) <blbllhy(a)gmail.com> net/openvswitch: check Ethernet header length in key_extract() Jia Jia <physicalmtea(a)gmail.com> vhost-scsi: reject feature changes after endpoint Linfeng Sun <slf(a)hdu.edu.cn> vhost-scsi: Validate T10 PI scatterlist counts Toke Høiland-Jørgensen <toke(a)toke.dk> net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter Xuanqiang Luo <luoxuanqiang(a)kylinos.cn> udp: fix potential use-after-free in tunnel segmentation Stanislav Fomichev <sdf.kernel(a)gmail.com> xsk: validate metadata when processing requests Stanislav Fomichev <sdf.kernel(a)gmail.com> xsk: move xsk_tx_metadata_request() to xdp_sock_drv.h Stanislav Fomichev <sdf.kernel(a)gmail.com> xsk: validate launch-time metadata size Stanislav Fomichev <sdf.kernel(a)gmail.com> xsk: clear metadata pointer when no timestamp is requested Stanislav Fomichev <sdf.kernel(a)gmail.com> xsk: pass TX metadata pointer by reference Stanislav Fomichev <sdf.kernel(a)gmail.com> xsk: require at least 16 bytes of TX metadata Will Chen <will.chen.tty(a)gmail.com> bnxt: fix memory leak in bnxt_queue_mem_alloc error cases Pavel Begunkov <asml.silence(a)gmail.com> eth: bnxt: support qcfg provided rx page size Pavel Begunkov <asml.silence(a)gmail.com> eth: bnxt: store rx buffer size per queue Pavel Begunkov <asml.silence(a)gmail.com> net: pass queue rx page size from memory provider Pavel Begunkov <asml.silence(a)gmail.com> net: add bare bone queue configs Jakub Kicinski <kuba(a)kernel.org> net: reduce indent of struct netdev_queue_mgmt_ops members Michael Chan <michael.chan(a)broadcom.com> bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips Nathan Gao <zcgao(a)amazon.com> tcp: do not change rcv_ssthresh in tcp_measure_rcv_mss() Guenter Roeck <linux(a)roeck-us.net> hwmon: (pmbus) Fix type confusion in notification logic Guenter Roeck <linux(a)roeck-us.net> hwmon: (pmbus_core) Use guard() for mutex protection Christian Borntraeger <borntraeger(a)linux.ibm.com> vdpa/mlx5: Fix buffer length in create_direct_keys() Yousef Alhouseen <alhouseenyousef(a)gmail.com> vhost/vdpa: reject overflowing PA map page counts on 32-bit Jose Fernandez (Anthropic) <jose.fernandez(a)linux.dev> bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch() Babanpreet Singh <bbnpreetsingh(a)gmail.com> counter: microchip-tcb-capture: Fix DT channel validation Michael Guralnik <michaelgur(a)nvidia.com> net/mlx5: fw_tracer, return NULL on create error Or Har-Toov <ohartoov(a)nvidia.com> devlink: fix net namespace reference leak in reload Jiawen Liu <1298662399(a)qq.com> net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: cls_route: fix fastmap use-after-free on filter Mahanta Jambigi <mjambigi(a)linux.ibm.com> net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler() Yiyang Chen <chenyy23(a)mails.tsinghua.edu.cn> bpf: Propagate untrusted pointer state in commuted arithmetic Eduard Zingerman <eddyz87(a)gmail.com> bpf: split check_reg_sane_offset() in two parts Yiyang Chen <chenyy23(a)mails.tsinghua.edu.cn> bpf: Preserve pointer state for commuted arithmetic Dmitry Antipov <dmantipov(a)yandex.ru> btrfs: fix memory leak in btrfs_do_encoded_write() Matti Vaittinen <mazziesaccount(a)gmail.com> watchdog: bd96801_wdt: Fix timeout for enabled WDG Julian Anastasov <ja(a)ssi.bg> ipvs: return the csum validation for forward hook Julian Anastasov <ja(a)ssi.bg> ipvs: avoid out-of-bounds write in ip_vs_nat_icmp Jozsef Kadlecsik <kadlec(a)netfilter.org> netfilter: ipset: switch ext_size to atomic64_t Nikhil P. Rao <nikhil.rao(a)amd.com> pds_core: cancel pending PCI reset work on AER recovery Nikhil P. Rao <nikhil.rao(a)amd.com> pds_core: keep the health thread stopped during reset Shay Drory <shayd(a)nvidia.com> net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock Satish Kharat <satishkh(a)cisco.com> enic: fix tx_hang_reset use-after-free on device removal Xiang Mei (Microsoft) <xmei5(a)asu.edu> bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor Fan Ye <fy15309206903(a)gmail.com> Revert "net: thunderbolt: Enable end-to-end flow control also in transmit" Jijie Shao <shaojijie(a)huawei.com> net: hns3: fix speed configuration residue after driver reload Pengpeng Hou <pengpeng(a)iscas.ac.cn> drm/bridge: ps8640: propagate AUX transfer register errors Qingfang Deng <qingfang.deng(a)linux.dev> ovpn: fix incorrect use of rcu_access_pointer() Antonio Quartulli <antonio(a)openvpn.net> ovpn: ensure TCP vars are initialized first Antonio Quartulli <antonio(a)openvpn.net> ovpn: disable IPv4 redirects on MP interfaces Antonio Quartulli <antonio(a)openvpn.net> ovpn: hash floated peer by transport identity only Antonio Quartulli <antonio(a)openvpn.net> ovpn: zero-initialize sockaddr before learning a floated endpoint Antonio Quartulli <antonio(a)openvpn.net> ovpn: ensure socket is owned by ovpn before deref sk_user_data Antonio Quartulli <antonio(a)openvpn.net> ovpn: rehash peer in by_transp_addr table on CMD_PEER_SET Antonio Quartulli <antonio(a)openvpn.net> ovpn: skip rehash for peers already removed from by_id Rosen Penev <rosenp(a)gmail.com> ARM: dts: BCM5301X: fix PCIe controller 2 second interrupt Ralf Lici <ralf(a)mandelbit.com> ovpn: add missing rtnl_link_ops->get_size callback Hans Ulli Kroll <linux(a)ulli-kroll.de> pinctrl: qcom: ipq806x: mark pci reset as a GPIO pin function Hans Ulli Kroll <linux(a)ulli-kroll.de> pinctrl: qcom: ipq806x: mark gpio as a GPIO pin function Kuba Piecuch <jpiecuch(a)google.com> selftests/sched_ext: Handle sleeping task affinity changes in numa test Yuho Choi <dbgh9129(a)gmail.com> ARM: npcm: Fix OF node refcount leaks in SMP setup Yun Zhou <yun.zhou(a)windriver.com> xfs: handle NULL b_addr in xfs_buf_free Daniel Drake <dan(a)reactivated.net> arm64: dts: broadcom: bcm2712: Remove non-functional EL2 virtual timer Anna Schumaker <anna.schumaker(a)hammerspace.com> NFS: Pin the 'struct nfs_server' during a FREE_STATEID call Dmitry Baryshkov <dmitry.baryshkov(a)oss.qualcomm.com> arm64: dts: qcom: sdm850-lenovo-yoga-c630: lower PSCI cluster idle Akhil P Oommen <akhilpo(a)oss.qualcomm.com> arm64: dts: qcom: purwa: Fix GPU IOMMU property Dmitry Baryshkov <dmitry.baryshkov(a)oss.qualcomm.com> arm64: dts: qcom: rename x1p42100 to purwa Aleksandrs Vinarskis <alex(a)vinarskis.com> arm64: dts: qcom: Rework X1-based Asus Zenbook A14's displays Dmitry Baryshkov <dmitry.baryshkov(a)oss.qualcomm.com> arm64: dts: qcom: rename x1e80100 to hamoa Ray Wu <ray.wu(a)amd.com> drm/amd/display: Check for tg ops in dce110_set_avmute Ray Wu <ray.wu(a)amd.com> drm/amd/display: Add AV mute wait frames to dce110_set_avmute Michal Luczaj <mhal(a)rbox.co> selftests/bpf: Fail unbound UDP on sockmap update Peter Zijlstra <peterz(a)infradead.org> sched/fair: Revert 6d71a9c61604 ("sched/fair: Fix EEVDF entity placement bug causing scheduling lag") Ingo Molnar <mingo(a)kernel.org> sched/fair: Separate se->vlag from se->vprot Al Viro <viro(a)zeniv.linux.org.uk> mount: honour SB_NOUSER in the new mount API Farhan Ali <alifm(a)linux.ibm.com> KVM: s390: pci: Fix resource leak on IRQ registration failure ------------- Diffstat: Documentation/admin-guide/kernel-parameters.txt | 9 + .../bindings/crypto/qcom,inline-crypto-engine.yaml | 16 +- MAINTAINERS | 5 + Makefile | 4 +- arch/arm/boot/dts/broadcom/bcm-ns.dtsi | 2 +- arch/arm/mach-npcm/platsmp.c | 2 + arch/arm64/boot/dts/broadcom/bcm2712.dtsi | 2 - arch/arm64/boot/dts/qcom/Makefile | 2 + arch/arm64/boot/dts/qcom/hamoa-iot-som.dtsi | 4 +- .../qcom/{x1e80100-pmics.dtsi => hamoa-pmics.dtsi} | 0 .../boot/dts/qcom/{x1e80100.dtsi => hamoa.dtsi} | 0 .../boot/dts/qcom/{x1p42100.dtsi => purwa.dtsi} | 6 +- .../boot/dts/qcom/sdm850-lenovo-yoga-c630.dts | 4 + arch/arm64/boot/dts/qcom/x1-asus-zenbook-a14.dtsi | 9 +- arch/arm64/boot/dts/qcom/x1-crd.dtsi | 2 +- arch/arm64/boot/dts/qcom/x1-dell-thena.dtsi | 2 +- arch/arm64/boot/dts/qcom/x1e001de-devkit.dts | 4 +- .../dts/qcom/x1e78100-lenovo-thinkpad-t14s.dtsi | 4 +- .../boot/dts/qcom/x1e80100-asus-vivobook-s15.dts | 4 +- .../boot/dts/qcom/x1e80100-asus-zenbook-a14.dts | 10 +- arch/arm64/boot/dts/qcom/x1e80100-crd.dts | 2 +- .../qcom/x1e80100-dell-inspiron-14-plus-7441.dts | 2 +- .../boot/dts/qcom/x1e80100-dell-latitude-7455.dts | 2 +- .../boot/dts/qcom/x1e80100-dell-xps13-9345.dts | 4 +- .../boot/dts/qcom/x1e80100-hp-omnibook-x14.dts | 4 +- .../boot/dts/qcom/x1e80100-lenovo-yoga-slim7x.dts | 4 +- .../boot/dts/qcom/x1e80100-microsoft-romulus.dtsi | 4 +- arch/arm64/boot/dts/qcom/x1e80100-qcp.dts | 4 +- .../dts/qcom/x1p42100-asus-zenbook-a14-lcd.dts | 62 ++++ .../boot/dts/qcom/x1p42100-asus-zenbook-a14.dts | 133 +------- .../boot/dts/qcom/x1p42100-asus-zenbook-a14.dtsi | 138 +++++++++ arch/arm64/boot/dts/qcom/x1p42100-crd.dts | 2 +- .../boot/dts/qcom/x1p42100-hp-omnibook-x14.dts | 4 +- .../boot/dts/qcom/x1p42100-lenovo-thinkbook-16.dts | 4 +- arch/arm64/include/asm/ptdump.h | 2 - arch/arm64/mm/mmu.c | 43 +-- arch/arm64/mm/ptdump.c | 11 +- arch/s390/kvm/pci.c | 31 +- arch/x86/kernel/cpu/common.c | 10 + arch/x86/kernel/cpu/mce/core.c | 2 +- arch/x86/kvm/mmu/mmu.c | 3 + arch/x86/kvm/svm/sev.c | 34 ++- arch/x86/kvm/svm/svm.h | 1 + block/blk-mq.c | 34 +-- drivers/android/binder/process.rs | 12 +- drivers/ata/pata_sl82c105.c | 4 +- drivers/bluetooth/btrtl.c | 13 + drivers/bluetooth/btusb.c | 2 + drivers/counter/microchip-tcb-capture.c | 4 +- drivers/dibs/dibs_loopback.c | 1 - drivers/dibs/dibs_main.c | 16 +- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 2 + drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 35 ++- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 6 +- .../drm/amd/display/dc/hwss/dce110/dce110_hwseq.c | 24 +- drivers/gpu/drm/bridge/parade-ps8640.c | 27 +- drivers/gpu/drm/v3d/v3d_drv.h | 6 + drivers/gpu/drm/v3d/v3d_sched.c | 9 +- drivers/gpu/drm/xe/xe_uc.c | 7 +- drivers/hwmon/ads7828.c | 11 +- drivers/hwmon/corsair-psu.c | 4 +- drivers/hwmon/ltc4282.c | 20 +- drivers/hwmon/nzxt-smart2.c | 6 +- drivers/hwmon/pmbus/lm25066.c | 5 +- drivers/hwmon/pmbus/pmbus_core.c | 340 +++++++++------------ drivers/input/evdev.c | 27 +- drivers/iommu/intel/iommu.c | 11 +- drivers/misc/fastrpc.c | 27 +- drivers/misc/mei/client.c | 25 +- drivers/net/bonding/bond_alb.c | 10 +- drivers/net/ethernet/amd/pds_core/core.h | 1 + drivers/net/ethernet/amd/pds_core/main.c | 14 +- drivers/net/ethernet/aquantia/atlantic/aq_ring.c | 51 +++- drivers/net/ethernet/aquantia/atlantic/aq_ring.h | 1 + drivers/net/ethernet/aquantia/atlantic/aq_vec.c | 2 +- drivers/net/ethernet/broadcom/bnge/bnge_netdev.c | 2 - drivers/net/ethernet/broadcom/bnge/bnge_resc.c | 3 +- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 163 +++++++--- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 4 + drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c | 7 +- drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c | 6 +- drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.h | 2 +- drivers/net/ethernet/cisco/enic/enic_main.c | 5 +- drivers/net/ethernet/freescale/fec_main.c | 11 +- drivers/net/ethernet/google/gve/gve_main.c | 9 +- drivers/net/ethernet/hisilicon/hix5hd2_gmac.c | 1 - .../ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 6 +- drivers/net/ethernet/intel/igc/igc_main.c | 10 +- .../net/ethernet/marvell/octeontx2/nic/otx2_tc.c | 6 +- .../net/ethernet/marvell/prestera/prestera_pci.c | 3 + .../ethernet/mellanox/mlx5/core/diag/fw_tracer.c | 16 +- drivers/net/ethernet/mellanox/mlx5/core/en.h | 2 +- .../net/ethernet/mellanox/mlx5/core/en/tc_priv.h | 1 + drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c | 15 +- drivers/net/ethernet/mellanox/mlx5/core/en/xdp.h | 4 +- .../net/ethernet/mellanox/mlx5/core/en/xsk/tx.c | 2 +- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 14 +- drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 4 +- drivers/net/ethernet/meta/fbnic/fbnic_txrx.c | 8 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 13 +- drivers/net/netdevsim/netdev.c | 7 +- drivers/net/ovpn/main.c | 64 ++-- drivers/net/ovpn/netlink.c | 6 + drivers/net/ovpn/peer.c | 172 ++++++++--- drivers/net/ovpn/peer.h | 1 + drivers/net/ovpn/socket.c | 9 + drivers/net/phy/mediatek/mtk.h | 8 +- drivers/net/tap.c | 24 +- drivers/net/thunderbolt/main.c | 33 +- drivers/net/usb/ax88179_178a.c | 4 +- drivers/net/usb/ipheth.c | 11 +- drivers/net/veth.c | 22 +- drivers/net/vxlan/vxlan_core.c | 2 +- drivers/nvmem/apple-spmi-nvmem.c | 20 +- drivers/nvmem/core.c | 24 +- drivers/nvmem/internals.h | 2 + drivers/nvmem/layouts.c | 11 - drivers/nvmem/layouts/Makefile | 1 + drivers/nvmem/layouts/fixed-layout.c | 58 ++++ drivers/pinctrl/qcom/pinctrl-ipq8064.c | 8 +- drivers/pinctrl/qcom/pinctrl-msm.h | 5 + drivers/ptp/ptp_ocp.c | 4 +- drivers/s390/net/ism_drv.c | 19 +- drivers/scsi/scsi_debug.c | 4 +- drivers/staging/rtl8723bs/core/rtw_ieee80211.c | 3 + drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 2 +- drivers/staging/rtl8723bs/core/rtw_wlan_util.c | 3 + drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 4 + drivers/thermal/thermal_hwmon.c | 3 +- drivers/thunderbolt/eeprom.c | 9 +- drivers/thunderbolt/icm.c | 2 +- drivers/thunderbolt/tb.c | 2 +- drivers/tty/serial/8250/8250_dma.c | 12 +- drivers/tty/serial/8250/8250_of.c | 38 +++ drivers/tty/serial/amba-pl011.c | 86 ++++-- drivers/tty/serial/qcom_geni_serial.c | 43 +-- drivers/tty/vt/keyboard.c | 5 +- drivers/tty/vt/vt_ioctl.c | 2 + drivers/usb/atm/cxacru.c | 2 + drivers/usb/cdns3/cdnsp-gadget.c | 4 +- drivers/usb/core/config.c | 32 +- drivers/usb/core/quirks.c | 7 + drivers/usb/gadget/function/f_ncm.c | 2 +- drivers/usb/misc/usbio.c | 2 +- drivers/vdpa/mlx5/core/mr.c | 3 +- drivers/vhost/scsi.c | 17 ++ drivers/vhost/vdpa.c | 9 +- drivers/vhost/vhost.c | 8 + drivers/video/fbdev/core/bitblit.c | 9 +- drivers/watchdog/at91sam9_wdt.c | 4 +- drivers/watchdog/bd96801_wdt.c | 5 +- fs/binfmt_misc.c | 3 +- fs/btrfs/inode.c | 1 + fs/crypto/policy.c | 2 +- fs/namespace.c | 5 + fs/nfs/nfs4proc.c | 5 + fs/overlayfs/super.c | 3 +- fs/smb/client/sess.c | 2 +- fs/tracefs/event_inode.c | 28 +- fs/tracefs/internal.h | 4 +- fs/verity/measure.c | 15 +- fs/xfs/xfs_buf.c | 2 +- include/linux/dibs.h | 2 +- include/linux/mmap_lock.h | 1 + include/linux/netdevice.h | 11 +- include/linux/netfilter/ipset/ip_set.h | 2 +- include/linux/nvmem-provider.h | 6 + include/linux/psi.h | 4 +- include/linux/sched.h | 13 +- include/linux/usb/quirks.h | 3 + include/net/act_api.h | 19 ++ include/net/addrconf.h | 4 +- include/net/ip_vs.h | 41 +-- include/net/libeth/xsk.h | 2 +- include/net/netdev_queues.h | 47 ++- include/net/netdev_rx_queue.h | 2 + include/net/netfilter/nf_flow_table.h | 1 + include/net/page_pool/types.h | 1 + include/net/route.h | 2 + include/net/sch_generic.h | 1 + include/net/xdp_sock.h | 47 +-- include/net/xdp_sock_drv.h | 77 ++++- kernel/bpf/verifier.c | 68 +++-- kernel/cgroup/cgroup.c | 23 +- kernel/events/core.c | 67 ++-- kernel/futex/core.c | 85 ++++-- kernel/sched/fair.c | 148 +++++++-- kernel/sched/psi.c | 75 ++++- kernel/trace/ring_buffer.c | 13 +- kernel/trace/trace_events.c | 4 +- mm/damon/ops-common.c | 13 +- mm/damon/paddr.c | 2 + mm/damon/vaddr.c | 3 +- mm/filemap.c | 6 + mm/huge_memory.c | 49 +-- mm/pagewalk.c | 36 ++- mm/ptdump.c | 7 + mm/vmalloc.c | 40 ++- net/atm/common.c | 14 +- net/bridge/br_mrp.c | 6 +- net/bridge/netfilter/ebt_nflog.c | 17 +- net/bridge/netfilter/nf_conntrack_bridge.c | 1 + net/core/datagram.c | 3 + net/core/dev.c | 27 +- net/core/netdev_rx_queue.c | 21 +- net/core/sock.c | 1 - net/core/xdp.c | 2 +- net/devlink/dev.c | 1 + net/ipv4/fib_semantics.c | 101 +++--- net/ipv4/inet_connection_sock.c | 20 +- net/ipv4/inet_fragment.c | 10 +- net/ipv4/route.c | 29 ++ net/ipv4/tcp_bpf.c | 2 + net/ipv4/tcp_input.c | 2 +- net/ipv4/tcp_ipv4.c | 43 +-- net/ipv4/udp_offload.c | 4 +- net/ipv6/ip6_tunnel.c | 3 + net/ipv6/route.c | 8 +- net/mac802154/scan.c | 4 + net/ncsi/ncsi-netlink.c | 4 + net/netfilter/ipset/ip_set_bitmap_gen.h | 4 +- net/netfilter/ipset/ip_set_core.c | 6 +- net/netfilter/ipset/ip_set_hash_gen.h | 2 +- net/netfilter/ipset/ip_set_list_set.c | 4 +- net/netfilter/ipvs/ip_vs_conn.c | 41 +-- net/netfilter/ipvs/ip_vs_core.c | 70 ++--- net/netfilter/ipvs/ip_vs_ctl.c | 77 ++++- net/netfilter/ipvs/ip_vs_est.c | 10 +- net/netfilter/ipvs/ip_vs_lc.c | 4 +- net/netfilter/ipvs/ip_vs_proto_sctp.c | 4 +- net/netfilter/ipvs/ip_vs_proto_tcp.c | 2 - net/netfilter/ipvs/ip_vs_sync.c | 7 +- net/netfilter/ipvs/ip_vs_xmit.c | 2 +- net/netfilter/nf_conntrack_proto.c | 6 + net/netfilter/nf_conntrack_proto_sctp.c | 12 +- net/netfilter/nf_conntrack_proto_tcp.c | 132 +++++--- net/netfilter/nf_flow_table_core.c | 1 + net/netfilter/nf_flow_table_ip.c | 95 ++++-- net/netfilter/nf_flow_table_path.c | 9 +- net/netfilter/nf_tables_api.c | 4 +- net/openvswitch/datapath.c | 29 +- net/openvswitch/flow.c | 11 +- net/packet/af_packet.c | 72 +++-- net/sched/act_ct.c | 29 +- net/sched/act_gact.c | 5 + net/sched/act_police.c | 6 + net/sched/cls_api.c | 17 +- net/sched/cls_route.c | 35 ++- net/sched/sch_api.c | 9 + net/sched/sch_cake.c | 1 - net/sctp/associola.c | 11 +- net/sctp/outqueue.c | 1 + net/sctp/sm_make_chunk.c | 3 +- net/sctp/sm_statefuns.c | 6 +- net/smc/af_smc.c | 3 +- net/smc/smc_llc.c | 3 +- net/smc/smc_rx.c | 19 +- net/tipc/node.c | 15 +- net/tls/tls_sw.c | 18 +- net/vmw_vsock/virtio_transport.c | 14 +- net/x25/af_x25.c | 4 +- net/x25/x25_timer.c | 25 +- net/xdp/xdp_umem.c | 2 + net/xdp/xsk.c | 11 +- net/xdp/xsk_buff_pool.c | 6 +- samples/damon/mtier.c | 3 + security/integrity/ima/ima_appraise.c | 9 +- security/integrity/ima/ima_main.c | 39 +++ sound/hda/codecs/side-codecs/tas2781_hda_spi.c | 3 +- sound/usb/endpoint.c | 6 +- sound/usb/fcp.c | 10 +- sound/usb/midi2.c | 9 + sound/usb/usx2y/us144mkii_capture.c | 1 + sound/usb/usx2y/usX2Yhwdep.c | 2 + sound/usb/usx2y/usx2yhwdeppcm.c | 2 + .../selftests/bpf/prog_tests/sockmap_basic.c | 6 +- .../selftests/bpf/prog_tests/sockmap_listen.c | 21 +- tools/testing/selftests/bpf/test_maps.c | 13 +- .../ftrace/test.d/dynevent/add_remove_eprobe.tc | 16 +- tools/testing/selftests/net/tls.c | 57 ++++ tools/testing/selftests/sched_ext/numa.bpf.c | 13 +- 281 files changed, 3279 insertions(+), 1604 deletions(-)

2 weeks, 3 days

[PATCH 6.6 000/156] 6.6.152-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.6.152 release. There are 156 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 19 Aug 2026 13:23:44 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.152-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.6.152-rc1 David Lechner <dlechner(a)baylibre.com> regulator: devres: fix devm_regulator_get_enable_read_voltage() return Dmitry Safonov <0x7f454c46(a)gmail.com> net/tcp_sigpool: Use kref_get_unless_zero() Dan Carpenter <dan.carpenter(a)linaro.org> net/tcp_sigpool: Fix some off by one bugs Xiang Mei (Microsoft) <xmei5(a)asu.edu> bpf: tcp: fix double sock release on batch realloc Bryam Vargas <hexlabsecurity(a)proton.me> thunderbolt: Bound the DROM dual link port number before indexing sw->ports Qing Ming <a0yami(a)mailbox.org> sctp: clear new_transport when removing a peer Yuxiang Yang <yangyx22(a)mails.tsinghua.edu.cn> sctp: fix use-after-free of cached ASCONF chunk Baul Lee <baul.lee(a)xbow.com> sctp: keep chunk->transport in step with the list it is queued on Xu Rao <raoxu(a)uniontech.com> scsi: scsi_debug: Negate wrapped memcmp() result Chengfeng Ye <nicoyip.dev(a)gmail.com> bpf, sockmap: Fix sk_redir use-after-free in send verdict Tejun Heo <tj(a)kernel.org> sched/psi: Shut down rtpoll_timer in psi_cgroup_free() Zhan Xusheng <zhanxusheng(a)xiaomi.com> fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() Zhiling Zou <zhilinz(a)nebusec.ai> ip6_tunnel: clear skb2->cb[] in ip6ip6_err() Yuejie Shi <syjcnss(a)gmail.com> ipv6: fix Route Information option length validation Tengda Wu <wutengda(a)huaweicloud.com> ring-buffer: Use current_context for safe per-CPU buffer swap Ahmad Byagowi <ahmadexp(a)gmail.com> ptp: ocp: Fix board ID over-read Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Revert "thermal/drivers/hwmon: Cleanup coding style a bit" Steven Rostedt <rostedt(a)goodmis.org> eventfs: Use children field for rcu head and add memory barriers Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> eventfs: Fix use-after-free in eventfs_remove_rec() Sean Christopherson <seanjc(a)google.com> KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> smb: client: Fix use-after-free in cifs_try_adding_channels() Jun Yang <junvyyang(a)tencent.com> tipc: read le->link under the node lock in tipc_node_link_down() chanyoung <ppoo1220(a)gmail.com> tls: don't leave a full plaintext sk_msg ring unpushed Jun Yang <junvyyang(a)tencent.com> vhost: reset the vring metadata cache on vring reconfiguration Sun Jian <sun.jian.kdev(a)gmail.com> veth: fix skb length accounting after XDP frag adjustment Weiming Shi <bestswngs(a)gmail.com> vsock/virtio: avoid refilling the RX queue after teardown Weiming Shi <bestswngs(a)gmail.com> vsock/virtio: read virtqueues under worker locks Baul Lee <baul.lee(a)xbow.com> vxlan: do not arm the ageing timer on a device that is down Zhiling Zou <zhilinz(a)nebusec.ai> xdp: reject clones that overrun skb_shared_info tailroom Asad Kamal <asad.kamal(a)amd.com> Revert "drm/amdgpu: fix aperture mapping leak" Christian Brauner <brauner(a)kernel.org> ovl: don't warn when the mount is completed from another user namespace Hyunjung Ko <hj351016(a)gmail.com> net/sched: act_gact, act_police: range check the fallback control action Hyunjung Ko <hj351016(a)gmail.com> net/sched: act_ct: fix sk_buff leak when the header checks reject a packet Yangyu Chen <cyy(a)cyyself.name> net: atlantic: free RX pages of consumed but not refilled buffers Yangyu Chen <cyy(a)cyyself.name> net: atlantic: free stranded TX buffers on ring deinit Zihan Xi <zihanx(a)nebusec.ai> netfilter: nf_conntrack: defer invalid log until after unlock Zhiling Zou <zhilinz(a)nebusec.ai> netfilter: bridge: release template ct on non-IP path Kyle Zeng <kylebot(a)openai.com> ipv6: prevent in6_dev_get() from resurrecting inet6_dev Daming Li <d4n.for.sec(a)gmail.com> net: smc: fix splice entry lifetime imbalance in smc_rx_splice Rik van Riel <riel(a)surriel.com> fbdev: bitblit: bound-check glyph index in bit_cursor() Michael Wu <michael(a)allwinnertech.com> tracing: Fix race between update_event_fields and, event_define_fields Baul Lee <baul.lee(a)xbow.com> ALSA: usx2y: bound the hwdep mmap fault offset Takashi Iwai <tiwai(a)suse.de> ALSA: usb: Fix UAF at delayed release of MIDI2 EPs Hui Su <sh_def(a)163.com> ring-buffer: Fix crash passing ERR_PTR to kthread_stop() Eddie Lin <eddie.lin(a)oss.qualcomm.com> misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free Junrui Luo <moonafterrain(a)outlook.com> misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke Ekansh Gupta <ekansh.gupta(a)oss.qualcomm.com> misc: fastrpc: Remove buffer from list prior to unmap operation Anandu Krishnan E <anandu.e(a)oss.qualcomm.com> misc: fastrpc: fix channel ctx ref leak when session alloc fails Mariano Baragiola <mbaragiola(a)linux.com> staging: rtl8723bs: validate monitor transmit frame lengths Panagiotis Petrakopoulos <npetrakopoulos2003(a)gmail.com> staging: rtl8723bs: fix missing shared-key auth challenge length check Muhammad Bilal <meatuni001(a)gmail.com> staging: rtl8723bs: fix OOB read in WMM_param_handler() Muhammad Bilal <meatuni001(a)gmail.com> staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() Cunhao Lu <1579567540(a)qq.com> serial: 8250_dma: Clear stale RX state on shutdown Alexander Usyskin <alexander.usyskin(a)intel.com> mei: pull kvfree out of spinlock Chengfeng Ye <nicoyip.dev(a)gmail.com> ipv4: fix use-after-free in fib_nhc_update_mtu() Zihan Xi <zihanx(a)nebusec.ai> ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops Michal Luczaj <mhal(a)rbox.co> selftests/bpf: Adapt sockmap update error handling Eric Biggers <ebiggers(a)kernel.org> fscrypt: Replace mk_users keyring with simple list Claudiu Beznea <claudiu.beznea.uj(a)bp.renesas.com> pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP Nathan Chancellor <nathan(a)kernel.org> fortify: Disable -Wstringop-overread in tests Masahiro Yamada <masahiroy(a)kernel.org> fortify: refactor test_fortify Makefile to fix some build problems Keno Fischer <keno(a)juliacomputing.com> futex: Prevent robust futex exit race some more Harshal Dev <harshal.dev(a)oss.qualcomm.com> dt-bindings: crypto: qcom,ice: Fix missing power-domain and iface clk Matthew Rosato <mjrosato(a)linux.ibm.com> KVM: s390: pci: Fix aisb calculation Farhan Ali <alifm(a)linux.ibm.com> KVM: s390: pci: Fix resource leak on IRQ registration failure Farhan Ali <alifm(a)linux.ibm.com> KVM: s390: pci: Fix missing error codes and memory unaccounting Farhan Ali <alifm(a)linux.ibm.com> KVM: s390: pci: Fix memory accounting for pinned/unpinned pages Baul Lee <baul.lee(a)xbow.com> net: bridge: mrp: fix uninitialised bytes on the wire Chengfeng Ye <nicoyip.dev(a)gmail.com> netfilter: ebt_nflog: pin the NFLOG backend Zihan Xi <zihanx(a)nebusec.ai> mac802154: fix netdev use-after-free in beacon worker Qihang Tang <q.h.hack.winter(a)gmail.com> net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header Sergey V. Frolov <Sergey.V.Frolov(a)kaspersky.com> net: octeontx2-pf: Fix UB in shift operation Zijie Huang <milkory(a)outlook.com> net/sched: reject overly deep qdisc hierarchies Zhiling Zou <zhilinz(a)nebusec.ai> net: openvswitch: reallocate update replies for mismatched IDs Zihan Xi <zihanx(a)nebusec.ai> packet: synchronize pressure clearing with ring reconfiguration Doruk Tan Ozturk <doruk(a)0sec.ai> net/packet: reset the MAC header on the packet-socket transmit path Qihang Tang <q.h.hack.winter(a)gmail.com> packet: use consistent hard_header_len in TX_RING send path Qihang Tang <q.h.hack.winter(a)gmail.com> packet: use consistent hard_header_len in non-ring send paths Kyle Zeng <kylebot(a)openai.com> ipvs: clear IPv4 options after rebasing tunnel ICMP errors Julian Anastasov <ja(a)ssi.bg> ipvs: properly update the overload flag on dest edit Julian Anastasov <ja(a)ssi.bg> ipvs: add totalconns for dest Zhiling Zou <zhilinz(a)nebusec.ai> ipvs: stop estimator after disabled calc phase Lincoln Wallace <locnnil0(a)gmail.com> ima: fix out-of-bounds read in xattr_verify() Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: evdev - fix information leak in evdev_pass_values() Joshua Rogers <linux(a)joshua.hu> vt: stabilize tty reference in kbd_keycode with tty_port_tty_get Joshua Rogers <linux(a)joshua.hu> vt: add permission check for KDSKBMETA ioctl Yi Cong <yicong(a)kylinos.cn> net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup() Sonali Pradhan <sonalipradhan(a)google.com> usb: gadget: f_ncm: Use unsigned int for ndp_index Pawel Laszczak <pawell(a)cadence.com> usb: cdnsp: fix incorrect endian conversions for APB timeout register Xu Rao <raoxu(a)uniontech.com> thunderbolt: icm: Preserve USB4 proxy data-valid bit Aleksandr Nogikh <nogikh(a)google.com> usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() Baul Lee <baul.lee(a)xbow.com> ALSA: usb-audio: fix OOB write on Type II inbound URBs Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: evdev - sanitize event type index when fetching event masks Larisa Grigore <larisa.grigore(a)nxp.com> spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers Mehmet Fide <mehmet.fide(a)screeningeagle.com> net: fec: do not release NULL pages when RX buffer allocation fails Qingshuang Fu <fuqingshuang(a)kylinos.cn> hwmon: (ads7828) Fix external VREF regulator handling David Lechner <dlechner(a)baylibre.com> regulator: devres: add API for reference voltage supplies Wilken Gottwalt <wilken.gottwalt(a)posteo.net> hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination Maximilian Immanuel Brandtner <maxbr(a)linux.ibm.com> tls: don't abort the connection on signal-interrupted sends Xin Long <lucien.xin(a)gmail.com> sctp: clear control chunk transport if it is being removed Eric Dumazet <edumazet(a)google.com> net/atm: fix slab-out-of-bounds read in vcc_setsockopt() Dmitry Safonov <0x7f454c46(a)gmail.com> net/tcp: Add TCP-AO config and structures Dmitry Safonov <0x7f454c46(a)gmail.com> net/tcp: Prepare tcp_md5sig_pool for TCP-AO Hongyan Xu <getshell(a)seu.edu.cn> ata: pata_sl82c105: fix bridge revision use-after-free Fan XinRan <shinjiangjiang(a)gmail.com> net: thunderbolt: Tear down DMA paths before stopping the rings Sidraya Jayagond <sidraya(a)linux.ibm.com> net/smc: fix TOCTOU race between smc_listen_out() and listener close Eric Dumazet <edumazet(a)google.com> net: remove WARN_ON_ONCE() from sk_mc_loop() Pengpeng Hou <pengpeng(a)iscas.ac.cn> net: prestera: validate firmware header length Henry Martin <bsdhenrymartin(a)gmail.com> net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length Jiayuan Chen <jiayuan.chen(a)linux.dev> tcp: fix TFO max_qlen accounting across reuseport migration Qing Luo <luoqing(a)kylinos.cn> sctp: fix addip_serial increment on ASCONF_ACK allocation failure Keegan Freyhof <keegan.freyhof(a)broadcom.com> bnxt_en: Fix PTP PPS setting bug Michael Chan <michael.chan(a)broadcom.com> bnxt_en: Disable EOP for TPA on all chips to prevent data corruption Michael Chan <michael.chan(a)broadcom.com> bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips Martin Kaiser <martin(a)kaiser.cx> selftests/ftrace: refactor eprobes test to fix argument checks Guenter Roeck <linux(a)roeck-us.net> hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations Rob Herring <robh(a)kernel.org> hwmon: (lm25066) Use i2c_get_match_data() Qingshuang Fu <fuqingshuang(a)kylinos.cn> hwmon: (nzxt-smart2) Check return value of init_device() in probe Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers Xin Long <lucien.xin(a)gmail.com> net: sched: refine software bypass handling in tc_run Jianbo Liu <jianbol(a)nvidia.com> net: sched: cls_api: fix slab-use-after-free in fl_dump_key Asbjørn Sloth Tønnesen <ast(a)fiberby.net> net: sched: make skip_sw actually skip software Asbjørn Sloth Tønnesen <ast(a)fiberby.net> net: sched: cls_api: add filter counter Asbjørn Sloth Tønnesen <ast(a)fiberby.net> net: sched: cls_api: add skip_sw counter Cen Zhang (Microsoft) <blbllhy(a)gmail.com> net/openvswitch: check Ethernet header length in key_extract() Toke Høiland-Jørgensen <toke(a)toke.dk> net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter Xuanqiang Luo <luoxuanqiang(a)kylinos.cn> udp: fix potential use-after-free in tunnel segmentation Nathan Gao <zcgao(a)amazon.com> tcp: do not change rcv_ssthresh in tcp_measure_rcv_mss() Yousef Alhouseen <alhouseenyousef(a)gmail.com> vhost/vdpa: reject overflowing PA map page counts on 32-bit Jose Fernandez (Anthropic) <jose.fernandez(a)linux.dev> bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch() Jordan Rife <jordan(a)jrife.io> bpf: tcp: Avoid socket skips and repeats during iteration Jordan Rife <jordan(a)jrife.io> bpf: tcp: Use bpf_tcp_iter_batch_item for bpf_tcp_iter_state batch items Jordan Rife <jordan(a)jrife.io> bpf: tcp: Get rid of st_bucket_done Jordan Rife <jordan(a)jrife.io> bpf: tcp: Make sure iter->batch always contains a full bucket snapshot Jordan Rife <jordan(a)jrife.io> bpf: tcp: Make mem flags configurable through bpf_iter_tcp_realloc_batch Babanpreet Singh <bbnpreetsingh(a)gmail.com> counter: microchip-tcb-capture: Fix DT channel validation Michael Guralnik <michaelgur(a)nvidia.com> net/mlx5: fw_tracer, return NULL on create error Or Har-Toov <ohartoov(a)nvidia.com> devlink: fix net namespace reference leak in reload Jiawen Liu <1298662399(a)qq.com> net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched: cls_route: fix fastmap use-after-free on filter Mahanta Jambigi <mjambigi(a)linux.ibm.com> net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler() Yiyang Chen <chenyy23(a)mails.tsinghua.edu.cn> bpf: Preserve pointer state for commuted arithmetic Dmitry Antipov <dmantipov(a)yandex.ru> btrfs: fix memory leak in btrfs_do_encoded_write() Julian Anastasov <ja(a)ssi.bg> ipvs: return the csum validation for forward hook Julian Anastasov <ja(a)ssi.bg> ipvs: avoid out-of-bounds write in ip_vs_nat_icmp Jozsef Kadlecsik <kadlec(a)netfilter.org> netfilter: ipset: switch ext_size to atomic64_t Shay Drory <shayd(a)nvidia.com> net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock Xiang Mei (Microsoft) <xmei5(a)asu.edu> bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor Fan Ye <fy15309206903(a)gmail.com> Revert "net: thunderbolt: Enable end-to-end flow control also in transmit" Pengpeng Hou <pengpeng(a)iscas.ac.cn> drm/bridge: ps8640: propagate AUX transfer register errors Rosen Penev <rosenp(a)gmail.com> ARM: dts: BCM5301X: fix PCIe controller 2 second interrupt Yuho Choi <dbgh9129(a)gmail.com> ARM: npcm: Fix OF node refcount leaks in SMP setup Anna Schumaker <anna.schumaker(a)hammerspace.com> NFS: Pin the 'struct nfs_server' during a FREE_STATEID call Harald Freudenberger <freude(a)linux.ibm.com> s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey() Michal Luczaj <mhal(a)rbox.co> selftests/bpf: Fail unbound UDP on sockmap update Al Viro <viro(a)zeniv.linux.org.uk> mount: honour SB_NOUSER in the new mount API ------------- Diffstat: .../bindings/crypto/qcom,inline-crypto-engine.yaml | 16 +- Documentation/driver-api/driver-model/devres.rst | 1 + Makefile | 4 +- arch/arm/boot/dts/broadcom/bcm-ns.dtsi | 2 +- arch/arm/mach-npcm/platsmp.c | 2 + arch/s390/kvm/pci.c | 86 +++-- arch/s390/kvm/pci.h | 2 + arch/x86/kvm/mmu/mmu.c | 3 + drivers/ata/pata_sl82c105.c | 4 +- drivers/counter/microchip-tcb-capture.c | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 2 + drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 35 +- drivers/gpu/drm/bridge/parade-ps8640.c | 27 +- drivers/hwmon/ads7828.c | 11 +- drivers/hwmon/corsair-psu.c | 4 +- drivers/hwmon/nzxt-smart2.c | 6 +- drivers/hwmon/pmbus/lm25066.c | 19 +- drivers/input/evdev.c | 27 +- drivers/misc/fastrpc.c | 19 +- drivers/misc/mei/client.c | 25 +- drivers/net/bonding/bond_alb.c | 10 +- drivers/net/ethernet/aquantia/atlantic/aq_ring.c | 51 ++- drivers/net/ethernet/aquantia/atlantic/aq_ring.h | 1 + drivers/net/ethernet/aquantia/atlantic/aq_vec.c | 2 +- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 12 +- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 1 + drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c | 7 +- drivers/net/ethernet/freescale/fec_main.c | 11 +- drivers/net/ethernet/hisilicon/hix5hd2_gmac.c | 1 - .../net/ethernet/marvell/octeontx2/nic/otx2_tc.c | 6 +- .../net/ethernet/marvell/prestera/prestera_pci.c | 3 + .../ethernet/mellanox/mlx5/core/diag/fw_tracer.c | 16 +- .../net/ethernet/mellanox/mlx5/core/en/tc_priv.h | 1 + drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 4 +- drivers/net/thunderbolt/main.c | 33 +- drivers/net/usb/ax88179_178a.c | 4 +- drivers/net/veth.c | 22 +- drivers/net/vxlan/vxlan_core.c | 2 +- drivers/pinctrl/renesas/pinctrl-rzg2l.c | 4 +- drivers/ptp/ptp_ocp.c | 4 +- drivers/regulator/devres.c | 59 ++++ drivers/s390/crypto/zcrypt_ccamisc.c | 20 +- drivers/scsi/scsi_debug.c | 4 +- drivers/spi/spi-fsl-dspi.c | 13 +- drivers/staging/rtl8723bs/core/rtw_ieee80211.c | 3 + drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 2 +- drivers/staging/rtl8723bs/core/rtw_wlan_util.c | 3 + drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 4 + drivers/thermal/thermal_hwmon.c | 3 +- drivers/thunderbolt/eeprom.c | 9 +- drivers/thunderbolt/icm.c | 2 +- drivers/tty/serial/8250/8250_dma.c | 12 +- drivers/tty/vt/keyboard.c | 5 +- drivers/tty/vt/vt_ioctl.c | 2 + drivers/usb/atm/cxacru.c | 2 + drivers/usb/cdns3/cdnsp-gadget.c | 4 +- drivers/usb/gadget/function/f_ncm.c | 2 +- drivers/vhost/vdpa.c | 9 +- drivers/vhost/vhost.c | 8 + drivers/video/fbdev/core/bitblit.c | 9 +- fs/btrfs/inode.c | 1 + fs/crypto/fscrypt_private.h | 32 +- fs/crypto/keyring.c | 212 +++++------ fs/crypto/policy.c | 2 +- fs/namespace.c | 5 + fs/nfs/nfs4proc.c | 5 + fs/overlayfs/super.c | 3 +- fs/smb/client/sess.c | 2 +- fs/tracefs/event_inode.c | 28 +- fs/tracefs/internal.h | 4 +- include/linux/netdevice.h | 11 +- include/linux/netfilter/ipset/ip_set.h | 2 +- include/linux/regulator/consumer.h | 7 + include/linux/tcp.h | 9 +- include/net/act_api.h | 19 + include/net/addrconf.h | 4 +- include/net/ip_vs.h | 41 +-- include/net/pkt_cls.h | 18 + include/net/route.h | 2 + include/net/sch_generic.h | 4 + include/net/tcp.h | 58 +-- include/net/tcp_ao.h | 90 +++++ include/uapi/linux/tcp.h | 2 + kernel/bpf/verifier.c | 15 +- kernel/futex/core.c | 82 +++-- kernel/sched/psi.c | 6 + kernel/trace/ring_buffer.c | 10 +- kernel/trace/trace_events.c | 2 + lib/.gitignore | 2 - lib/Makefile | 34 +- lib/test_fortify/.gitignore | 2 + lib/test_fortify/Makefile | 29 ++ net/atm/common.c | 14 +- net/bridge/br_mrp.c | 6 +- net/bridge/netfilter/ebt_nflog.c | 17 +- net/bridge/netfilter/nf_conntrack_bridge.c | 1 + net/core/dev.c | 13 + net/core/sock.c | 1 - net/core/xdp.c | 2 +- net/devlink/dev.c | 1 + net/ipv4/Kconfig | 17 + net/ipv4/Makefile | 1 + net/ipv4/fib_semantics.c | 101 +++--- net/ipv4/inet_connection_sock.c | 20 +- net/ipv4/route.c | 29 ++ net/ipv4/tcp.c | 145 ++------ net/ipv4/tcp_bpf.c | 2 + net/ipv4/tcp_input.c | 2 +- net/ipv4/tcp_ipv4.c | 390 ++++++++++++++------- net/ipv4/tcp_minisocks.c | 21 +- net/ipv4/tcp_sigpool.c | 357 +++++++++++++++++++ net/ipv4/udp_offload.c | 4 +- net/ipv6/ip6_tunnel.c | 3 + net/ipv6/route.c | 8 +- net/ipv6/tcp_ipv6.c | 60 ++-- net/mac802154/scan.c | 4 + net/ncsi/ncsi-netlink.c | 4 + net/netfilter/ipset/ip_set_bitmap_gen.h | 4 +- net/netfilter/ipset/ip_set_core.c | 6 +- net/netfilter/ipset/ip_set_hash_gen.h | 2 +- net/netfilter/ipset/ip_set_list_set.c | 4 +- net/netfilter/ipvs/ip_vs_conn.c | 41 +-- net/netfilter/ipvs/ip_vs_core.c | 70 ++-- net/netfilter/ipvs/ip_vs_ctl.c | 77 +++- net/netfilter/ipvs/ip_vs_est.c | 10 +- net/netfilter/ipvs/ip_vs_lc.c | 4 +- net/netfilter/ipvs/ip_vs_proto_sctp.c | 4 +- net/netfilter/ipvs/ip_vs_proto_tcp.c | 2 - net/netfilter/ipvs/ip_vs_sync.c | 7 +- net/netfilter/ipvs/ip_vs_xmit.c | 2 +- net/netfilter/nf_conntrack_proto.c | 6 + net/netfilter/nf_conntrack_proto_sctp.c | 12 +- net/netfilter/nf_conntrack_proto_tcp.c | 132 ++++--- net/openvswitch/datapath.c | 29 +- net/openvswitch/flow.c | 11 +- net/packet/af_packet.c | 72 ++-- net/sched/act_ct.c | 29 +- net/sched/act_gact.c | 5 + net/sched/act_police.c | 6 + net/sched/cls_api.c | 47 ++- net/sched/cls_bpf.c | 2 + net/sched/cls_flower.c | 2 + net/sched/cls_matchall.c | 2 + net/sched/cls_route.c | 35 +- net/sched/cls_u32.c | 4 + net/sched/sch_api.c | 9 + net/sched/sch_cake.c | 1 - net/sctp/associola.c | 11 +- net/sctp/outqueue.c | 1 + net/sctp/sm_make_chunk.c | 3 +- net/sctp/sm_statefuns.c | 6 +- net/smc/af_smc.c | 3 +- net/smc/smc_llc.c | 3 +- net/smc/smc_rx.c | 19 +- net/tipc/node.c | 15 +- net/tls/tls_sw.c | 16 +- net/vmw_vsock/virtio_transport.c | 14 +- scripts/remove-stale-files | 2 + security/integrity/ima/ima_appraise.c | 9 +- sound/usb/endpoint.c | 6 +- sound/usb/midi2.c | 9 + sound/usb/usx2y/usX2Yhwdep.c | 2 + sound/usb/usx2y/usx2yhwdeppcm.c | 2 + .../selftests/bpf/prog_tests/sockmap_listen.c | 21 +- tools/testing/selftests/bpf/test_maps.c | 13 +- .../ftrace/test.d/dynevent/add_remove_eprobe.tc | 16 +- 166 files changed, 2407 insertions(+), 1036 deletions(-)

2 weeks, 3 days

← Newer
1
2
3
4
5
6
7
...
3425
Older →

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

Lkft-triage