Lkft-triage

lkft-triage@lists.linaro.org

36 participants
33162 discussions

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.1.187 release. There are 92 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 02 Sep 2026 13:32:19 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.187-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.1.187-rc1 Miguel Peñaranda <mig.penaranda07(a)gmail.com> usb: usbfs: fix use-after-free of usb_device in usbdev_release() Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> USB: c67x00: fix use-after-free in c67x00_add_iso_urb() Johan Hovold <johan(a)kernel.org> USB: serial: spcp8x5: drop broken carrier detect support Jiale Yao <yaojiale02(a)163.com> USB: serial: option: fix slab OOB read in interrupt URB callback Will Porter <mrwillporter(a)gmail.com> ALSA: usb-audio: Complete cleanup after system-resume errors Marouane El Moufid <eun0us(a)espilon.net> ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() Griffin Kroah-Hartman <griffin(a)kroah.com> usb: core: Strengthen error handling in hub_hub_status() Griffin Kroah-Hartman <griffin(a)kroah.com> usb: core: Add lock to usb_wakeup_notification() Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_core: Fix hci_conn_hash_lookup_cis Christian Borntraeger <borntraeger(a)linux.ibm.com> KVM: s390: vsie: zero stale crypto bits Bartosz Golaszewski <bartosz.golaszewski(a)oss.qualcomm.com> crypto: qce - Remove unsafe/deprecated algorithms Thorsten Blum <thorsten.blum(a)linux.dev> crypto: mxs-dcp - fix source scatterlist length access Md Sadre Alam <md.alam(a)oss.qualcomm.com> crypto: qce - fix CCM AAD buffer underallocation Thorsten Blum <thorsten.blum(a)linux.dev> crypto: atmel-tdes - use scatterlist length before DMA mapping Eric Biggers <ebiggers(a)kernel.org> mm/swap: reject swapon() on filesystem-level encrypted files Kyle Zeng <kylebot(a)openai.com> ipv6: seg6: clear IPv4 control block on IPIP decapsulation Norbert Szetei <norbert(a)doyensec.com> net: bridge: mcast: fix use-after-free of a master VLAN's multicast context Zihan Xi <zihanx(a)nebusec.ai> xfrm: fix xfrm_state_construct() auth-trunc leak Asim Viladi Oglu Manizada <manizada(a)pm.me> xfrm: ah6: validate routing header segments_left Zhiling Zou <roxy520tt(a)gmail.com> xfrm: drop ESP-in-TCP packets with no ingress device Sabrina Dubroca <sd(a)queasysnail.net> xfrm: espintcp: fix UAF during close Jiayuan Chen <jiayuan.chen(a)linux.dev> tls: device: fix out-of-bounds write in tls_append_frag() Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> usb: gadget: f_tcm: keep port count until LUN teardown completes Aleksandr Nogikh <nogikh(a)google.com> usb: usbtest: disable dynamic ID support Baokun Li <libaokun(a)linux.alibaba.com> fuse: fix invalidate lock leak on open O_TRUNC DAX failure Baokun Li <libaokun(a)linux.alibaba.com> fuse: fix invalidate lock leak on setattr writeback failure Lucas De Marchi <ldemarchi(a)nvidia.com> xhci: dbgtty: Fix unregister on tty_alloc_driver() failure Lucas De Marchi <ldemarchi(a)nvidia.com> xhci: dbgtty: Fix unregister on tty_register_driver() failure Semih Baskan <strst.gs(a)gmail.com> usb: xhci: Handle USB3 port events when there is one roothub Haoxiang Li <lihaoxiang(a)isrc.iscas.ac.cn> accessibility: speakup: unregister tty ldisc on later init failures Griffin Kroah-Hartman <griffin(a)kroah.com> fpga: dfl: fme: add error handling Eric Dumazet <edumazet(a)google.com> ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() Laxman Acharya Padhya <acharyalaxman8848(a)gmail.com> Bluetooth: hci_event: validate LE Set CIG Parameters response Pauli Virtanen <pav(a)iki.fi> Bluetooth: hci_event: fix Set CIG Parameters error status handling Pauli Virtanen <pav(a)iki.fi> Bluetooth: ISO: use correct CIS order in Set CIG Parameters event Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: hci_conn: Fix not matching by CIS ID Chengfeng Ye <nicoyip.dev(a)gmail.com> Bluetooth: hci_sync: Fix accept list UAF during suspend Zijun Hu <zijun.hu(a)oss.qualcomm.com> Bluetooth: hci_sync: Use bt_dev_err() to log error message in hci_update_event_filter_sync() Raman Varabets <kernel-linux-20260610-80b7ab08(a)raman.v1.sg> HID: ft260: fix stack-use-after-return write in I2C read race Michael Zaidman <michael.zaidman(a)gmail.com> HID: ft260: validate i2c input report length Michael Zaidman <michael.zaidman(a)gmail.com> HID: ft260: missed NACK from busy device Michael Zaidman <michael.zaidman(a)gmail.com> HID: ft260: wake up device from power saving mode Michael Zaidman <michael.zaidman(a)gmail.com> HID: ft260: skip unexpected HID input reports Michael Zaidman <michael.zaidman(a)gmail.com> HID: ft260: improve i2c large reads performance Michael Zaidman <michael.zaidman(a)gmail.com> HID: ft260: improve i2c write performance Ibrahim Hashimov <security(a)auditcode.ai> HID: uclogic: fix use-after-free of inrange_timer on remove Jiangshan Yi <yijiangshan(a)kylinos.cn> HID: nintendo: stop device IO before hid_hw_stop on probe failure Ibrahim Hashimov <security(a)auditcode.ai> nvmet-tcp: bound SGL data length before allocating command buffers Weiwen Hu <huweiwen(a)linux.alibaba.com> nvme: rename CDR/MORE/DNR to NVME_STATUS_* Christopher Kodama <ckhordiasma(a)gmail.com> HID: magicmouse: re-enable multitouch after reset-resume Jose Villaseñor Montfort <pepemontfort(a)gmail.com> HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event() Andrei Fed <andfed.net(a)gmail.com> HID: magicmouse: fix battery reporting for Bluetooth Magic Trackpad USB-C Bryam Vargas <hexlabsecurity(a)proton.me> nfc: nci: add data_len bound checks to activation parameter extractors Ryusuke Konishi <konishi.ryusuke(a)gmail.com> nilfs2: reject invalid block index in GC ioctl Ryusuke Konishi <konishi.ryusuke(a)gmail.com> nilfs2: correct return value kernel-doc descriptions for ioctl functions Guanghui Yang <3497809730(a)qq.com> ext4: propagate errors from fast commit range replay Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: pm: fix memory leak from alloc-during-teardown race Christoph Hellwig <hch(a)lst.de> block: make bio_check_eod work for zero sized devices Jon Hunter <jonathanh(a)nvidia.com> ASoC: tegra: Fix Master Volume Control Sasha Levin <sashal(a)kernel.org> Revert "smb: client: use kvzalloc() for megabyte buffer in simple fallocate" Sasha Levin <sashal(a)kernel.org> Revert "mtd: maps: vmu-flash: fix fault in unaligned fixup" Stephen Smalley <stephen.smalley.work(a)gmail.com> selinux: switch two allocations to use kzalloc_objs() Kuniyuki Iwashima <kuniyu(a)google.com> smc: Use __sk_dst_get() and dst_dev_rcu() in smc_vlan_by_tcpsk(). Cristian Ciocaltea <cristian.ciocaltea(a)collabora.com> ASoC: nau8821: Cancel pending work before suspend Sasha Levin <sashal(a)kernel.org> Revert "PM: sleep: Use complete() in device_pm_sleep_init()" Michael Neuling <mikey(a)neuling.org> riscv: Fix register corruption from uninitialized cregs on error Jiayuan Chen <jiayuan.chen(a)linux.dev> bpf: Fix use-after-free in offloaded map/prog info fill Cristian Ciocaltea <cristian.ciocaltea(a)collabora.com> ASoC: nau8821: Cancel delayed work on component remove Kuniyuki Iwashima <kuniyu(a)google.com> smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). Kuniyuki Iwashima <kuniyu(a)google.com> smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set(). Oliver Upton <oliver.upton(a)linux.dev> KVM: arm64: Prevent access to vCPU events before init Kuniyuki Iwashima <kuniyu(a)google.com> smc: Fix use-after-free in __pnet_find_base_ndev(). Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> can: j1939: make j1939_sk_bind() fail if device is no longer registered Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> can: j1939: add missing calls in NETDEV_UNREGISTER notification handler Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> can: j1939: implement NETDEV_UNREGISTER notification handler Vladimir Riabchun <ferr.lambarginio(a)gmail.com> mISDN: hfcpci: Fix warning when deleting uninitialized timer Wentao Liang <vulab(a)iscas.ac.cn> media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode() Namjae Jeon <linkinjeon(a)kernel.org> exfat: fix double free in delayed_free Dylan Wolff <wolffd(a)comp.nus.edu.sg> jfs: Fix null-ptr-deref in jfs_ioc_trim Nick Child <nnac123(a)linux.ibm.com> ibmvnic: Use kernel helpers for hex dumps Vasiliy Kovalev <kovalev(a)altlinux.org> jfs: add check read-only before txBeginAnon() call Vasiliy Kovalev <kovalev(a)altlinux.org> jfs: add check read-only before truncation in jfs_truncate_nolock() Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> bpf: Remove tst_run from lwt_seg6local_prog_ops. Ben Skeggs <bskeggs(a)redhat.com> drm/nouveau/kms/nv50-: init hpd_irq_lock for PIOR DP Ziyang Huang <hzyitc(a)outlook.com> wifi: ath11k: Add missing hw_ops->get_ring_selector() for IPQ5018 Ralf Lici <ralf(a)mandelbit.com> Revert "usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal" Florian Westphal <fw(a)strlen.de> ipvs: reload ip header after head reallocation Vishnu Razdan <vrazdan(a)openai.com> io_uring/io-wq: fix worker accounting when canceling creation callbacks Eric Biggers <ebiggers(a)kernel.org> ext4: don't enable DAX on new encrypted files Jinu Kim <kimjw04271234(a)gmail.com> KVM: x86/mmu: Check write tracking in all address spaces Eric Dumazet <edumazet(a)google.com> inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP Peiyang He <peiyang_he(a)smail.nju.edu.cn> RDMA/rxe: Fix OOB in free_rd_atomic_resources() ------------- Diffstat: Documentation/filesystems/fscrypt.rst | 4 + Makefile | 4 +- arch/arm64/kvm/arm.c | 6 + arch/riscv/kernel/compat_signal.c | 2 + arch/riscv/kernel/ptrace.c | 4 +- arch/s390/kvm/vsie.c | 1 + arch/x86/kvm/mmu/page_track.c | 28 ++- block/blk-core.c | 2 +- drivers/accessibility/speakup/main.c | 1 + drivers/base/power/main.c | 6 +- drivers/crypto/atmel-tdes.c | 5 +- drivers/crypto/mxs-dcp.c | 2 +- drivers/crypto/qce/aead.c | 58 +---- drivers/crypto/qce/common.c | 55 +---- drivers/crypto/qce/common.h | 16 +- drivers/crypto/qce/regs-v5.h | 4 - drivers/crypto/qce/sha.c | 30 +-- drivers/crypto/qce/sha.h | 1 - drivers/crypto/qce/skcipher.c | 97 +------- drivers/fpga/dfl-fme-perf.c | 2 + drivers/gpu/drm/nouveau/dispnv50/disp.c | 4 + drivers/hid/hid-ft260.c | 157 ++++++++++--- drivers/hid/hid-input.c | 3 + drivers/hid/hid-magicmouse.c | 63 +++++- drivers/hid/hid-nintendo.c | 13 +- drivers/hid/hid-uclogic-core.c | 12 +- drivers/infiniband/sw/rxe/rxe_qp.c | 3 +- drivers/isdn/hardware/mISDN/hfcpci.c | 12 +- .../platform/samsung/exynos4-is/fimc-is-regs.c | 1 + drivers/mtd/maps/vmu-flash.c | 8 +- drivers/net/ethernet/ibm/ibmvnic.c | 30 ++- drivers/net/wireless/ath/ath11k/hw.c | 2 +- drivers/nvme/host/core.c | 18 +- drivers/nvme/host/fabrics.c | 8 +- drivers/nvme/host/fault_inject.c | 2 +- drivers/nvme/host/fc.c | 8 +- drivers/nvme/target/admin-cmd.c | 22 +- drivers/nvme/target/core.c | 46 ++-- drivers/nvme/target/discovery.c | 14 +- drivers/nvme/target/fabrics-cmd-auth.c | 16 +- drivers/nvme/target/fabrics-cmd.c | 36 +-- drivers/nvme/target/io-cmd-bdev.c | 12 +- drivers/nvme/target/nvmet.h | 2 +- drivers/nvme/target/passthru.c | 10 +- drivers/nvme/target/rdma.c | 10 +- drivers/nvme/target/tcp.c | 17 +- drivers/nvme/target/zns.c | 30 +-- drivers/target/target_core_fabric_configfs.c | 8 + drivers/usb/c67x00/c67x00-sched.c | 4 +- drivers/usb/core/devio.c | 2 +- drivers/usb/core/hub.c | 7 +- drivers/usb/gadget/function/f_tcm.c | 2 +- drivers/usb/host/xhci-dbgtty.c | 15 +- drivers/usb/host/xhci-ring.c | 2 +- drivers/usb/misc/usbtest.c | 1 + drivers/usb/phy/phy-fsl-usb.c | 1 - drivers/usb/serial/option.c | 20 +- drivers/usb/serial/spcp8x5.c | 13 -- fs/exfat/nls.c | 1 + fs/ext4/crypto.c | 40 ++-- fs/ext4/fast_commit.c | 10 +- fs/ext4/ialloc.c | 4 + fs/fuse/dir.c | 9 +- fs/fuse/file.c | 4 +- fs/jfs/inode.c | 2 +- fs/jfs/jfs_discard.c | 3 +- fs/jfs/jfs_extent.c | 10 + fs/nilfs2/ioctl.c | 251 ++++++++++----------- fs/smb/client/smb2ops.c | 4 +- include/linux/inetdevice.h | 5 + include/linux/nvme.h | 6 +- include/net/bluetooth/hci_core.h | 15 +- include/target/target_core_fabric.h | 2 + io_uring/io-wq.c | 9 +- kernel/bpf/offload.c | 10 +- mm/swapfile.c | 7 + net/bluetooth/hci_conn.c | 3 +- net/bluetooth/hci_event.c | 46 ++-- net/bluetooth/hci_sync.c | 48 +++- net/bridge/br_multicast.c | 4 +- net/can/j1939/j1939-priv.h | 1 + net/can/j1939/main.c | 5 + net/can/j1939/socket.c | 55 +++++ net/core/filter.c | 1 - net/ipv4/icmp.c | 14 +- net/ipv4/igmp.c | 14 +- net/ipv6/ah6.c | 29 ++- net/ipv6/icmp.c | 3 + net/ipv6/seg6_local.c | 7 + net/mptcp/pm_netlink.c | 3 + net/mptcp/pm_userspace.c | 10 +- net/mptcp/protocol.c | 5 + net/mptcp/protocol.h | 7 +- net/netfilter/ipvs/ip_vs_xmit.c | 6 +- net/nfc/nci/ntf.c | 26 ++- net/smc/smc_clc.c | 67 +++--- net/smc/smc_core.c | 27 +-- net/smc/smc_pnet.c | 43 ++-- net/tls/tls_device.c | 3 +- net/xfrm/espintcp.c | 9 +- net/xfrm/xfrm_user.c | 2 +- security/selinux/ss/conditional.c | 12 +- sound/soc/codecs/nau8821.c | 13 ++ sound/soc/tegra/tegra_pcm.c | 3 + sound/usb/card.c | 14 +- sound/usb/midi.c | 2 + 106 files changed, 1028 insertions(+), 808 deletions(-)

1 month, 4 weeks

[PATCH 7.1 000/101] 7.1.11-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 7.1.11 release. There are 101 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 27 Aug 2026 13:25:02 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.1.11-rc1… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.1.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 7.1.11-rc1 Laxman Acharya Padhya <acharyalaxman8848(a)gmail.com> Bluetooth: hci_aml: validate firmware segment lengths Ali Ahmet Memis <ali(a)iusegentoo.com> Bluetooth: MGMT: reject HCI_CMD_SYNC params_len above 255 Ali Ahmet Memis <ali(a)iusegentoo.com> Bluetooth: ISO: zero the sockaddr before returning it in getname Ali Ahmet Memis <ali(a)iusegentoo.com> Bluetooth: ISO: do not force BT_LISTEN after a failed BIG sync Chengfeng Ye <nicoyip.dev(a)gmail.com> Bluetooth: hci_sync: Fix accept list UAF during suspend Laxman Acharya Padhya <acharyalaxman8848(a)gmail.com> Bluetooth: hci_event: validate LE Set CIG Parameters response Chengfeng Ye <nicoyip.dev(a)gmail.com> Bluetooth: hci_event: fix LE list UAF on reset Linus Torvalds <torvalds(a)linux-foundation.org> drm/xe: Don't hand out the flat CCS storage as usable VRAM Jose Villaseñor Montfort <pepemontfort(a)gmail.com> HID: input: read battery capacity from its actual report offset Michael Bommarito <michael.bommarito(a)gmail.com> HID: hyperv: validate initial device info bounds Ibrahim Hashimov <security(a)auditcode.ai> HID: uclogic: fix use-after-free of inrange_timer on remove Haoxiang Li <haoxiang_li2024(a)163.com> HID: sensor: custom: Fix use-after-free in enable_sensor Raman Varabets <kernel-linux-20260610-80b7ab08(a)raman.v1.sg> HID: ft260: fix stack-use-after-return write in I2C read race Jann Horn <jannh(a)google.com> HID: core: fix number/pointer type confusion on long items Jann Horn <jannh(a)google.com> HID: rapoo: fix missing hid_is_usb() check Jiangshan Yi <yijiangshan(a)kylinos.cn> HID: nintendo: stop device IO before hid_hw_stop on probe failure Jiangshan Yi <yijiangshan(a)kylinos.cn> HID: nintendo: register input device after capabilities are set Ibrahim Hashimov <security(a)auditcode.ai> HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler() Jann Horn <jannh(a)google.com> HID: huawei: fix missing hid_is_usb() check Jann Horn <jannh(a)google.com> HID: asus: fix missing hid_is_usb() check Peter Zijlstra <peterz(a)infradead.org> futex: Fix might_sleep() warning in futex_pivot_pending() Hyunwoo Kim <imv4bel(a)gmail.com> futex: Fix race on the initial mm->futex.phash.ref allocation Yao Kai <yaokai34(a)huawei.com> futex: Fix race in futex_pivot_pending() during private hash resize Thomas Gleixner <tglx(a)kernel.org> futex/pi: Plug private futex exec() race Thomas Gleixner <tglx(a)kernel.org> futex: Sanitize and document task_struct::futex::state transitions Kyle Zeng <kylebot(a)openai.com> futex/pi: Reject cross-mm private futex owners Anand Khoje <anand.a.khoje(a)oracle.com> net/ionic: avoid OOB TX partner lookup for hwstamp RXQ Baul Lee <baul.lee(a)xbow.com> HID: pidff: fix OOB write when hid->inputs is empty Baul Lee <baul.lee(a)xbow.com> HID: core: fix OOB read of field->usage in hid_set_field() Jose Villaseñor Montfort <pepemontfort(a)gmail.com> HID: magicmouse: do not keep a stale msc->input if no input is claimed Christopher Kodama <ckhordiasma(a)gmail.com> HID: magicmouse: re-enable multitouch after reset-resume Jose Villaseñor Montfort <pepemontfort(a)gmail.com> HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event() Andrei Fed <andfed.net(a)gmail.com> HID: magicmouse: fix battery reporting for Bluetooth Magic Trackpad USB-C Bryam Vargas <hexlabsecurity(a)proton.me> selinux: require a class's permission values to cover its permission count Christian Göttsche <cgzones(a)googlemail.com> selinux: more strict policy parsing Christian Göttsche <cgzones(a)googlemail.com> selinux: use u16 for security classes Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: pm: fix memory leak from alloc-during-teardown race Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: uniform announced addresses helpers Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: rename add_entry structure to add_addr Lijo Lazar <lijo.lazar(a)amd.com> drm/amdgpu: Allocate coredump ring buffers per ring Mikhail Gavrilov <mikhail.v.gavrilov(a)gmail.com> drm/amdgpu: fix recursive ww_mutex acquire in amdgpu_devcoredump_format Melbin K Mathew <mlbnkm1(a)gmail.com> fbdev: serialize mode sysfs access with lock_fb_info() Thomas Zimmermann <tzimmermann(a)suse.de> fbdev: Wrap user-invoked calls to fb_set_var() in helper Yifei Gao <gyf161023(a)gmail.com> nvmet: pci-epf: put CQ ref on create_cq mapping failure Shin'ichiro Kawasaki <shinichiro.kawasaki(a)wdc.com> nvmet: pci-epf: fix use-after-free in nvmet_pci_epf_exec_iod_work() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations Ibrahim Hashimov <security(a)auditcode.ai> nvmet-tcp: bound SGL data length before allocating command buffers Jiang HongHui <jiang_hh2019(a)163.com> nvmet-fc: fix invalid free in LS IOD error path Bryam Vargas <hexlabsecurity(a)proton.me> nvmet-auth: zero the AUTH_RECEIVE response buffer Griffin Kroah-Hartman <griffin(a)kroah.com> dmaengine: fsl-edma: Add error handling for devm_kasprintf Griffin Kroah-Hartman <griffin(a)kroah.com> mailbox: mchp-ipc-sbi: Add null check for devm_kasprintf() Luxiao Xu <rakukuip(a)gmail.com> ipv6: fix use-after-free in ip6_finish_output2() Yong Wang <edragain(a)163.com> ipv4: reject undersized MTUs in ip_do_fragment() Linmao Li <lilinmao(a)kylinos.cn> nfc: nci: free destination parameters when closing a connection Samuel Page <sam(a)bynar.io> nfc: nci: fix uninit-value in the RF discover/activated NTF handlers Samuel Page <sam(a)bynar.io> nfc: nci: fix out-of-bounds write in nci_target_auto_activated() Bryam Vargas <hexlabsecurity(a)proton.me> nfc: nci: add data_len bound checks to activation parameter extractors Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: st21nfca: validate ATR_REQ length against the received frame Xu Rao <raoxu(a)uniontech.com> nfc: pn533: purge fragmented skbs during cleanup Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: llcp: reject PDUs shorter than the LLCP header Muhammad Bilal <meatuni001(a)gmail.com> nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: llcp: bound the connect_sn TLV walk to the skb Pengpeng Hou <pengpeng(a)iscas.ac.cn> nfc: microread: validate target discovery payload lengths Bryam Vargas <hexlabsecurity(a)proton.me> nfc: fdp: bound the device-reported read length and fix an skb leak Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: digital: clamp SENSF_RES length to the destination buffer Maarten Lankhorst <dev(a)lankhorst.se> drm/xe: Fix DPT allocation paths. Ville Syrjälä <ville.syrjala(a)linux.intel.com> drm/i915: Introduce struct intel_fb_pin_params Ville Syrjälä <ville.syrjala(a)linux.intel.com> drm/i915: Track fence region ID in plane state Jani Nikula <jani.nikula(a)intel.com> drm/i915/pin: s/dev_priv/i915/ and drop struct drm_device usage Yun Zhou <yun.zhou(a)windriver.com> xfs: restore nofs context unconditionally in xfs_trans_roll Hongling Zeng <zenghongling(a)kylinos.cn> xfs: validate attr entry pointer before field access Jiazi Liu <jiazi.liu1984(a)gmail.com> ext4: fix incorrect function call when initializing s_resgid Eric Biggers <ebiggers(a)kernel.org> ext4: don't enable DAX on new encrypted files Guanghui Yang <3497809730(a)qq.com> ext4: propagate errors from fast commit range replay Jia Zhu <zhujia.zj(a)bytedance.com> ext4: avoid tail write_begin walk for uptodate folios Guanghui Yang <3497809730(a)qq.com> ext4: clear error before retrying inode xattr space fallback Ryusuke Konishi <konishi.ryusuke(a)gmail.com> nilfs2: reject invalid block index in GC ioctl Matthias Goergens <matthias.goergens(a)gmail.com> ext4: stop retrying saturated xattr cache entries Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> kcov: fix data corruption and race conditions on PREEMPT_RT Rik van Riel <riel(a)surriel.com> null_blk: fix UBSAN shift-out-of-bounds when zone_size is 0 or overflows Ian Bridges <icb(a)fastmail.org> ocfs2: fix missing metadata reservation for large xattrs Jens Axboe <axboe(a)kernel.dk> io_uring: defer eventfd signaling when queued from a wakeup handler Jens Axboe <axboe(a)kernel.dk> io_uring/uring_cmd: don't skip completion for a synchronous multishot cmd Ali Ahmet Memis <ali(a)iusegentoo.com> io_uring/rsrc: fix folio size overflow in io_vec_fill_bvec() Vishnu Razdan <vrazdan(a)openai.com> io_uring/io-wq: fix worker accounting when canceling creation callbacks Woraphat Khiaodaeng <worapat.kd2(a)gmail.com> io_uring/cmd: fix iovec leak when the async cmd is not recycled Takashi Iwai <tiwai(a)suse.de> ALSA: dummy: Check card index validity at probe Jens Axboe <axboe(a)kernel.dk> io_uring/futex: only mark private futex waits as inflight Jens Axboe <axboe(a)kernel.dk> io_uring/futex: don't mark futex wake requests as inflight Guixin Liu <kanie(a)linux.alibaba.com> nvmet: fix NULL pointer dereference in nvmet_execute_identify_nslist() Griffin Kroah-Hartman <griffin(a)kroah.com> rndis_host: add overflow check in rndis_rx_fixup() Geoffrey D. Bennett <g(a)b4.vu> ALSA: scarlett2: Use a private URB for the notification endpoint Geoffrey D. Bennett <g(a)b4.vu> ALSA: FCP: Use a private URB for the notification endpoint Peiyang He <peiyang_he(a)smail.nju.edu.cn> iommu/iommufd: Fix NULL pointer deref in iommufd_ioas_change_process when racing with iopt_map_file_pages Shameer Kolothum <skolothumtho(a)nvidia.com> iommu/tegra241-cmdqv: Fix CMD_SYNC use-after-free on teardown Ali Ahmet Memis <ali(a)iusegentoo.com> Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept Steffen Persvold <spersvold(a)gmail.com> PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems Darrick J. Wong <djwong(a)kernel.org> xfs: rtsummary scrub should treat rtbitmap corruption errors as an xref error Christoph Hellwig <hch(a)lst.de> xfs: add a xchk_ip_set_corrupt helper Darrick J. Wong <djwong(a)kernel.org> xfs: don't livelock in scrub on a circular unlinked list Darrick J. Wong <djwong(a)kernel.org> xfs: hoist per-bucket unlinked list check to helper ------------- Diffstat: Makefile | 4 +- drivers/block/null_blk/zoned.c | 10 +- drivers/bluetooth/hci_aml.c | 18 +- drivers/dma/fsl-edma-main.c | 2 + drivers/gpu/drm/amd/amdgpu/amdgpu_dev_coredump.c | 265 ++++++++++++--------- drivers/gpu/drm/amd/amdgpu/amdgpu_dev_coredump.h | 3 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 91 ++++--- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h | 2 +- drivers/gpu/drm/i915/display/intel_display_types.h | 5 +- drivers/gpu/drm/i915/display/intel_fb_pin.c | 107 +++++---- drivers/gpu/drm/i915/display/intel_fb_pin.h | 17 +- drivers/gpu/drm/i915/display/intel_fbc.c | 11 +- drivers/gpu/drm/i915/display/intel_fbdev.c | 20 +- drivers/gpu/drm/i915/display/intel_plane.c | 3 +- drivers/gpu/drm/i915/i915_initial_plane.c | 2 +- drivers/gpu/drm/xe/display/xe_fb_pin.c | 74 +++--- drivers/gpu/drm/xe/display/xe_initial_plane.c | 6 +- drivers/gpu/drm/xe/xe_vram.c | 23 +- drivers/hid/Kconfig | 1 + drivers/hid/hid-asus.c | 2 +- drivers/hid/hid-core.c | 11 +- drivers/hid/hid-ft260.c | 25 +- drivers/hid/hid-huawei.c | 5 +- drivers/hid/hid-hyperv.c | 27 ++- drivers/hid/hid-input.c | 20 +- drivers/hid/hid-magicmouse.c | 73 +++++- drivers/hid/hid-nintendo.c | 22 +- drivers/hid/hid-rapoo.c | 2 +- drivers/hid/hid-sensor-custom.c | 21 +- drivers/hid/hid-uclogic-core.c | 12 +- drivers/hid/usbhid/hid-pidff.c | 13 +- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 2 + drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h | 1 + drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c | 15 +- drivers/iommu/iommufd/ioas.c | 4 + drivers/mailbox/mailbox-mchp-ipc-sbi.c | 2 + drivers/net/ethernet/pensando/ionic/ionic_lif.c | 17 +- drivers/net/ethernet/pensando/ionic/ionic_txrx.c | 7 +- drivers/net/usb/rndis_host.c | 6 +- drivers/nfc/fdp/i2c.c | 27 +++ drivers/nfc/microread/microread.c | 31 ++- drivers/nfc/pn533/pn533.c | 1 + drivers/nfc/st21nfca/dep.c | 3 + drivers/nvme/target/admin-cmd.c | 2 +- drivers/nvme/target/fabrics-cmd-auth.c | 2 +- drivers/nvme/target/fc.c | 2 +- drivers/nvme/target/pci-epf.c | 10 +- drivers/nvme/target/tcp.c | 19 +- drivers/pci/controller/pci-host-generic.c | 11 +- drivers/pci/ecam.c | 13 + drivers/video/fbdev/core/fb_chrdev.c | 6 +- drivers/video/fbdev/core/fbcon.c | 2 - drivers/video/fbdev/core/fbmem.c | 13 + drivers/video/fbdev/core/fbsysfs.c | 48 +++- drivers/video/fbdev/ps3fb.c | 5 +- drivers/video/fbdev/sh_mobile_lcdcfb.c | 5 +- fs/exec.c | 8 +- fs/ext4/crypto.c | 40 ++-- fs/ext4/fast_commit.c | 16 +- fs/ext4/ialloc.c | 4 + fs/ext4/inode.c | 11 +- fs/ext4/super.c | 2 +- fs/ext4/xattr.c | 7 +- fs/nilfs2/ioctl.c | 20 +- fs/ocfs2/xattr.c | 18 +- fs/xfs/libxfs/xfs_attr_leaf.c | 14 ++ fs/xfs/scrub/agheader.c | 94 ++++++-- fs/xfs/scrub/agheader_repair.c | 17 +- fs/xfs/scrub/bmap.c | 8 +- fs/xfs/scrub/common.c | 10 +- fs/xfs/scrub/common.h | 2 + fs/xfs/scrub/dir.c | 2 +- fs/xfs/scrub/dirtree.c | 4 +- fs/xfs/scrub/metapath.c | 6 +- fs/xfs/scrub/nlinks.c | 12 +- fs/xfs/scrub/parent.c | 6 +- fs/xfs/scrub/rtbitmap.c | 12 +- fs/xfs/scrub/rtsummary.c | 12 +- fs/xfs/xfs_trans.c | 16 +- include/linux/fb.h | 2 + include/linux/futex.h | 2 + include/linux/hid.h | 2 + include/linux/io_uring_types.h | 8 + include/linux/pci-ecam.h | 3 + include/linux/sched.h | 8 + include/linux/wait.h | 1 + include/linux/wait_bit.h | 1 + io_uring/eventfd.c | 8 +- io_uring/eventfd.h | 2 +- io_uring/futex.c | 32 ++- io_uring/futex.h | 1 + io_uring/io-wq.c | 9 +- io_uring/io_uring.c | 2 +- io_uring/opdef.c | 2 +- io_uring/poll.c | 23 +- io_uring/rsrc.c | 2 +- io_uring/tw.c | 2 +- io_uring/uring_cmd.c | 8 +- io_uring/waitid.c | 2 +- kernel/futex/core.c | 126 ++++++---- kernel/futex/futex.h | 9 + kernel/futex/pi.c | 125 +++++++--- kernel/kcov.c | 90 +++---- kernel/sched/wait.c | 15 ++ kernel/sched/wait_bit.c | 14 +- lib/Kconfig.debug | 5 +- net/bluetooth/hci_event.c | 8 +- net/bluetooth/hci_sync.c | 46 +++- net/bluetooth/iso.c | 32 ++- net/bluetooth/mgmt.c | 8 + net/bluetooth/rfcomm/core.c | 24 +- net/ipv4/ip_output.c | 4 + net/ipv6/ip6_output.c | 2 + net/mptcp/options.c | 2 +- net/mptcp/pm.c | 68 +++--- net/mptcp/pm_kernel.c | 10 +- net/mptcp/pm_userspace.c | 8 +- net/mptcp/protocol.h | 21 +- net/mptcp/subflow.c | 4 +- net/nfc/digital_technology.c | 2 + net/nfc/llcp_commands.c | 18 +- net/nfc/llcp_core.c | 15 +- net/nfc/nci/ntf.c | 36 ++- net/nfc/nci/rsp.c | 1 + security/selinux/include/security.h | 1 + security/selinux/ss/avtab.c | 35 ++- security/selinux/ss/avtab.h | 13 + security/selinux/ss/conditional.c | 18 +- security/selinux/ss/constraint.h | 1 + security/selinux/ss/policydb.c | 248 +++++++++++++++---- security/selinux/ss/policydb.h | 31 ++- security/selinux/ss/services.c | 8 +- sound/drivers/dummy.c | 6 + sound/usb/fcp.c | 38 +-- sound/usb/mixer.c | 6 + sound/usb/mixer.h | 2 + sound/usb/mixer_scarlett2.c | 98 +++++--- 137 files changed, 1957 insertions(+), 853 deletions(-)

2 months

Connect with Technology Decision-Makers

by Natalie Foster

Hi, Hope you are doing great! As I can see that you are one of the exhibitors at Integrated Systems Europe, would you like to get your hands on verified AV & Systems Integration Industry Contacts? We can help you connect with AV Professionals, System Integrators, AV Consultants, AV Designers, IT Specialists, Facilities Managers, Technology Decision-Makers, Corporate AV Teams, Education Institutions, Retailers, Hospitality Groups, and many more. Let me know if you are interested to see a sample, counts and pricing. please let me know your target audience and geography. Regards, Natalie Foster Sr. Marketing Manager To stop receiving future emails, reply with Omit.

2 months

[PATCH 6.18 00/94] 6.18.47-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.18.47 release. There are 94 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 27 Aug 2026 13:25:02 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.47-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.18.47-rc1 Laxman Acharya Padhya <acharyalaxman8848(a)gmail.com> Bluetooth: hci_aml: validate firmware segment lengths Ali Ahmet Memis <ali(a)iusegentoo.com> Bluetooth: MGMT: reject HCI_CMD_SYNC params_len above 255 Ali Ahmet Memis <ali(a)iusegentoo.com> Bluetooth: ISO: zero the sockaddr before returning it in getname Ali Ahmet Memis <ali(a)iusegentoo.com> Bluetooth: ISO: do not force BT_LISTEN after a failed BIG sync Chengfeng Ye <nicoyip.dev(a)gmail.com> Bluetooth: hci_sync: Fix accept list UAF during suspend Laxman Acharya Padhya <acharyalaxman8848(a)gmail.com> Bluetooth: hci_event: validate LE Set CIG Parameters response Chengfeng Ye <nicoyip.dev(a)gmail.com> Bluetooth: hci_event: fix LE list UAF on reset Linus Torvalds <torvalds(a)linux-foundation.org> drm/xe: Don't hand out the flat CCS storage as usable VRAM Michael Bommarito <michael.bommarito(a)gmail.com> HID: hyperv: validate initial device info bounds Ibrahim Hashimov <security(a)auditcode.ai> HID: uclogic: fix use-after-free of inrange_timer on remove Haoxiang Li <haoxiang_li2024(a)163.com> HID: sensor: custom: Fix use-after-free in enable_sensor Jann Horn <jannh(a)google.com> HID: core: fix number/pointer type confusion on long items Jiangshan Yi <yijiangshan(a)kylinos.cn> HID: nintendo: stop device IO before hid_hw_stop on probe failure Jiangshan Yi <yijiangshan(a)kylinos.cn> HID: nintendo: register input device after capabilities are set Ibrahim Hashimov <security(a)auditcode.ai> HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler() Peter Zijlstra <peterz(a)infradead.org> futex: Fix might_sleep() warning in futex_pivot_pending() Hyunwoo Kim <imv4bel(a)gmail.com> futex: Fix race on the initial mm->futex.phash.ref allocation Thomas Gleixner <tglx(a)kernel.org> futex/pi: Plug private futex exec() race Thomas Gleixner <tglx(a)kernel.org> futex: Sanitize and document task_struct::futex::state transitions Kyle Zeng <kylebot(a)openai.com> futex/pi: Reject cross-mm private futex owners Donglin Lyu <DongLin_Lyu(a)outlook.com> Input: atkbd - skip deactivate for HONOR ZQC-P Cryolitia PukNgae <cryolitia.pukngae(a)linux.dev> Input: atkbd - skip deactivate for HONOR FMB-P's internal keyboard Xiang Mei (Microsoft) <xmei5(a)asu.edu> xfrm: fix sk_dst_cache double-free in xfrm_user_policy() Anand Khoje <anand.a.khoje(a)oracle.com> net/ionic: avoid OOB TX partner lookup for hwstamp RXQ Baul Lee <baul.lee(a)xbow.com> HID: pidff: fix OOB write when hid->inputs is empty Baul Lee <baul.lee(a)xbow.com> HID: core: fix OOB read of field->usage in hid_set_field() Lee Jones <lee(a)kernel.org> HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID Jose Villaseñor Montfort <pepemontfort(a)gmail.com> HID: magicmouse: do not keep a stale msc->input if no input is claimed Christopher Kodama <ckhordiasma(a)gmail.com> HID: magicmouse: re-enable multitouch after reset-resume Andrei Fed <andfed.net(a)gmail.com> HID: magicmouse: fix battery reporting for Bluetooth Magic Trackpad USB-C Dawid Wróbel <me(a)dawidwrobel.com> ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses Bryam Vargas <hexlabsecurity(a)proton.me> selinux: require a class's permission values to cover its permission count Christian Göttsche <cgzones(a)googlemail.com> selinux: more strict policy parsing Christian Göttsche <cgzones(a)googlemail.com> selinux: use u16 for security classes Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: pm: fix memory leak from alloc-during-teardown race Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: uniform announced addresses helpers Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: rename add_entry structure to add_addr Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: use for_each_subflow helper Yifei Gao <gyf161023(a)gmail.com> nvmet: pci-epf: put CQ ref on create_cq mapping failure Shin'ichiro Kawasaki <shinichiro.kawasaki(a)wdc.com> nvmet: pci-epf: fix use-after-free in nvmet_pci_epf_exec_iod_work() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations Ibrahim Hashimov <security(a)auditcode.ai> nvmet-tcp: bound SGL data length before allocating command buffers Jiang HongHui <jiang_hh2019(a)163.com> nvmet-fc: fix invalid free in LS IOD error path Bryam Vargas <hexlabsecurity(a)proton.me> nvmet-auth: zero the AUTH_RECEIVE response buffer Griffin Kroah-Hartman <griffin(a)kroah.com> dmaengine: fsl-edma: Add error handling for devm_kasprintf Griffin Kroah-Hartman <griffin(a)kroah.com> mailbox: mchp-ipc-sbi: Add null check for devm_kasprintf() Luxiao Xu <rakukuip(a)gmail.com> ipv6: fix use-after-free in ip6_finish_output2() Yong Wang <edragain(a)163.com> ipv4: reject undersized MTUs in ip_do_fragment() Maarten Lankhorst <dev(a)lankhorst.se> drm/xe: Fix DPT allocation paths. Linmao Li <lilinmao(a)kylinos.cn> nfc: nci: free destination parameters when closing a connection Samuel Page <sam(a)bynar.io> nfc: nci: fix uninit-value in the RF discover/activated NTF handlers Samuel Page <sam(a)bynar.io> nfc: nci: fix out-of-bounds write in nci_target_auto_activated() Bryam Vargas <hexlabsecurity(a)proton.me> nfc: nci: add data_len bound checks to activation parameter extractors Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: st21nfca: validate ATR_REQ length against the received frame Xu Rao <raoxu(a)uniontech.com> nfc: pn533: purge fragmented skbs during cleanup Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: llcp: reject PDUs shorter than the LLCP header Muhammad Bilal <meatuni001(a)gmail.com> nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: llcp: bound the connect_sn TLV walk to the skb Pengpeng Hou <pengpeng(a)iscas.ac.cn> nfc: microread: validate target discovery payload lengths Bryam Vargas <hexlabsecurity(a)proton.me> nfc: fdp: bound the device-reported read length and fix an skb leak Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: digital: clamp SENSF_RES length to the destination buffer Pavitra Jha <jhapavitra98(a)gmail.com> libceph: fix OOB read in decode_watchers() via missing bounds check Hongling Zeng <zenghongling(a)kylinos.cn> xfs: validate attr entry pointer before field access Jiazi Liu <jiazi.liu1984(a)gmail.com> ext4: fix incorrect function call when initializing s_resgid Eric Biggers <ebiggers(a)kernel.org> ext4: don't enable DAX on new encrypted files Guanghui Yang <3497809730(a)qq.com> ext4: propagate errors from fast commit range replay Jia Zhu <zhujia.zj(a)bytedance.com> ext4: avoid tail write_begin walk for uptodate folios Guanghui Yang <3497809730(a)qq.com> ext4: clear error before retrying inode xattr space fallback Ryusuke Konishi <konishi.ryusuke(a)gmail.com> nilfs2: reject invalid block index in GC ioctl Matthias Goergens <matthias.goergens(a)gmail.com> ext4: stop retrying saturated xattr cache entries Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> kcov: fix data corruption and race conditions on PREEMPT_RT Rik van Riel <riel(a)surriel.com> null_blk: fix UBSAN shift-out-of-bounds when zone_size is 0 or overflows Ian Bridges <icb(a)fastmail.org> ocfs2: fix missing metadata reservation for large xattrs Jens Axboe <axboe(a)kernel.dk> io_uring/uring_cmd: don't skip completion for a synchronous multishot cmd Ali Ahmet Memis <ali(a)iusegentoo.com> io_uring/rsrc: fix folio size overflow in io_vec_fill_bvec() Vishnu Razdan <vrazdan(a)openai.com> io_uring/io-wq: fix worker accounting when canceling creation callbacks Woraphat Khiaodaeng <worapat.kd2(a)gmail.com> io_uring/cmd: fix iovec leak when the async cmd is not recycled Takashi Iwai <tiwai(a)suse.de> ALSA: dummy: Check card index validity at probe Jens Axboe <axboe(a)kernel.dk> io_uring/futex: don't mark futex wake requests as inflight Guixin Liu <kanie(a)linux.alibaba.com> nvmet: fix NULL pointer dereference in nvmet_execute_identify_nslist() Griffin Kroah-Hartman <griffin(a)kroah.com> rndis_host: add overflow check in rndis_rx_fixup() Geoffrey D. Bennett <g(a)b4.vu> ALSA: scarlett2: Use a private URB for the notification endpoint Geoffrey D. Bennett <g(a)b4.vu> ALSA: FCP: Use a private URB for the notification endpoint Peiyang He <peiyang_he(a)smail.nju.edu.cn> iommu/iommufd: Fix NULL pointer deref in iommufd_ioas_change_process when racing with iopt_map_file_pages Shameer Kolothum <skolothumtho(a)nvidia.com> iommu/tegra241-cmdqv: Fix CMD_SYNC use-after-free on teardown Ali Ahmet Memis <ali(a)iusegentoo.com> Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept Steffen Persvold <spersvold(a)gmail.com> PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems Darrick J. Wong <djwong(a)kernel.org> xfs: don't livelock in scrub on a circular unlinked list Darrick J. Wong <djwong(a)kernel.org> xfs: hoist per-bucket unlinked list check to helper Darrick J. Wong <djwong(a)kernel.org> xfs: rtsummary scrub should treat rtbitmap corruption errors as an xref error Christoph Hellwig <hch(a)lst.de> xfs: add a xchk_ip_set_corrupt helper Luca Fresi <luca.fresi(a)bithiatec.com> serial: sc16is7xx: enable THRI before filling TX FIFO Hugo Villeneuve <hvilleneuve(a)dimonoff.com> serial: sc16is7xx: use guards for simple mutex locks Hugo Villeneuve <hvilleneuve(a)dimonoff.com> serial: sc16is7xx: rename EFR mutex with generic name ------------- Diffstat: Makefile | 4 +- drivers/block/null_blk/zoned.c | 10 +- drivers/bluetooth/hci_aml.c | 18 +- drivers/dma/fsl-edma-main.c | 2 + drivers/gpu/drm/xe/display/xe_fb_pin.c | 32 +-- drivers/gpu/drm/xe/xe_vram.c | 23 ++- drivers/hid/hid-core.c | 11 +- drivers/hid/hid-hyperv.c | 27 ++- drivers/hid/hid-input.c | 3 + drivers/hid/hid-magicmouse.c | 64 +++++- drivers/hid/hid-nintendo.c | 22 +- drivers/hid/hid-sensor-custom.c | 21 +- drivers/hid/hid-uclogic-core.c | 12 +- drivers/hid/usbhid/hid-pidff.c | 13 +- drivers/input/keyboard/atkbd.c | 23 ++- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 2 + drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h | 1 + drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c | 15 +- drivers/iommu/iommufd/ioas.c | 4 + drivers/mailbox/mailbox-mchp-ipc-sbi.c | 2 + drivers/net/ethernet/pensando/ionic/ionic_lif.c | 17 +- drivers/net/ethernet/pensando/ionic/ionic_txrx.c | 7 +- drivers/net/usb/rndis_host.c | 6 +- drivers/nfc/fdp/i2c.c | 27 +++ drivers/nfc/microread/microread.c | 31 ++- drivers/nfc/pn533/pn533.c | 1 + drivers/nfc/st21nfca/dep.c | 3 + drivers/nvme/target/admin-cmd.c | 2 +- drivers/nvme/target/fabrics-cmd-auth.c | 2 +- drivers/nvme/target/fc.c | 2 +- drivers/nvme/target/pci-epf.c | 10 +- drivers/nvme/target/tcp.c | 18 +- drivers/pci/controller/pci-host-generic.c | 11 +- drivers/pci/ecam.c | 13 ++ drivers/tty/serial/sc16is7xx.c | 40 ++-- fs/exec.c | 8 +- fs/ext4/crypto.c | 40 ++-- fs/ext4/fast_commit.c | 16 +- fs/ext4/ialloc.c | 4 + fs/ext4/inode.c | 11 +- fs/ext4/super.c | 2 +- fs/ext4/xattr.c | 7 +- fs/nilfs2/ioctl.c | 20 +- fs/ocfs2/xattr.c | 18 +- fs/xfs/libxfs/xfs_attr_leaf.c | 14 ++ fs/xfs/scrub/agheader.c | 94 ++++++--- fs/xfs/scrub/agheader_repair.c | 17 +- fs/xfs/scrub/bmap.c | 8 +- fs/xfs/scrub/common.c | 10 +- fs/xfs/scrub/common.h | 2 + fs/xfs/scrub/dir.c | 2 +- fs/xfs/scrub/dirtree.c | 4 +- fs/xfs/scrub/metapath.c | 6 +- fs/xfs/scrub/nlinks.c | 12 +- fs/xfs/scrub/parent.c | 6 +- fs/xfs/scrub/rtbitmap.c | 12 +- fs/xfs/scrub/rtsummary.c | 12 +- include/linux/futex.h | 2 + include/linux/pci-ecam.h | 3 + include/linux/sched.h | 8 + include/linux/wait.h | 1 + include/linux/wait_bit.h | 1 + io_uring/futex.c | 11 + io_uring/futex.h | 1 + io_uring/io-wq.c | 9 +- io_uring/opdef.c | 2 +- io_uring/rsrc.c | 2 +- io_uring/uring_cmd.c | 8 +- kernel/futex/core.c | 122 +++++++---- kernel/futex/futex.h | 9 + kernel/futex/pi.c | 125 +++++++++--- kernel/kcov.c | 90 ++++---- kernel/sched/wait.c | 15 ++ kernel/sched/wait_bit.c | 14 +- lib/Kconfig.debug | 5 +- net/bluetooth/hci_event.c | 8 +- net/bluetooth/hci_sync.c | 46 ++++- net/bluetooth/iso.c | 32 ++- net/bluetooth/mgmt.c | 8 + net/bluetooth/rfcomm/core.c | 24 ++- net/ceph/osd_client.c | 5 +- net/ipv4/ip_output.c | 4 + net/ipv6/ip6_output.c | 2 + net/mptcp/options.c | 2 +- net/mptcp/pm.c | 74 ++++--- net/mptcp/pm_kernel.c | 22 +- net/mptcp/pm_userspace.c | 10 +- net/mptcp/protocol.h | 25 +-- net/mptcp/subflow.c | 4 +- net/nfc/digital_technology.c | 2 + net/nfc/llcp_commands.c | 18 +- net/nfc/llcp_core.c | 15 +- net/nfc/nci/ntf.c | 36 +++- net/nfc/nci/rsp.c | 1 + net/xfrm/xfrm_state.c | 4 +- security/selinux/include/security.h | 1 + security/selinux/ss/avtab.c | 35 +++- security/selinux/ss/avtab.h | 13 ++ security/selinux/ss/conditional.c | 18 +- security/selinux/ss/constraint.h | 1 + security/selinux/ss/policydb.c | 248 +++++++++++++++++++---- security/selinux/ss/policydb.h | 31 ++- security/selinux/ss/services.c | 8 +- sound/drivers/dummy.c | 6 + sound/soc/codecs/lpass-tx-macro.c | 4 +- sound/usb/fcp.c | 38 ++-- sound/usb/mixer.c | 6 + sound/usb/mixer.h | 2 + sound/usb/mixer_scarlett2.c | 98 +++++---- 109 files changed, 1533 insertions(+), 570 deletions(-)

2 months

[PATCH 7.2 00/82] 7.2.1-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 7.2.1 release. There are 82 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 27 Aug 2026 13:25:02 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.2.1-rc1.… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.2.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 7.2.1-rc1 Laxman Acharya Padhya <acharyalaxman8848(a)gmail.com> Bluetooth: hci_aml: validate firmware segment lengths Ali Ahmet Memis <ali(a)iusegentoo.com> Bluetooth: MGMT: reject HCI_CMD_SYNC params_len above 255 Ali Ahmet Memis <ali(a)iusegentoo.com> Bluetooth: ISO: zero the sockaddr before returning it in getname Ali Ahmet Memis <ali(a)iusegentoo.com> Bluetooth: ISO: do not force BT_LISTEN after a failed BIG sync Chengfeng Ye <nicoyip.dev(a)gmail.com> Bluetooth: hci_sync: Fix accept list UAF during suspend Laxman Acharya Padhya <acharyalaxman8848(a)gmail.com> Bluetooth: hci_event: validate LE Set CIG Parameters response Chengfeng Ye <nicoyip.dev(a)gmail.com> Bluetooth: hci_event: fix LE list UAF on reset Linus Torvalds <torvalds(a)linux-foundation.org> drm/xe: Don't hand out the flat CCS storage as usable VRAM Jose Villaseñor Montfort <pepemontfort(a)gmail.com> HID: input: read battery capacity from its actual report offset Michael Bommarito <michael.bommarito(a)gmail.com> HID: hyperv: validate initial device info bounds Ibrahim Hashimov <security(a)auditcode.ai> HID: uclogic: fix use-after-free of inrange_timer on remove Haoxiang Li <haoxiang_li2024(a)163.com> HID: sensor: custom: Fix use-after-free in enable_sensor Raman Varabets <kernel-linux-20260610-80b7ab08(a)raman.v1.sg> HID: ft260: fix stack-use-after-return write in I2C read race Jann Horn <jannh(a)google.com> HID: core: fix number/pointer type confusion on long items Jann Horn <jannh(a)google.com> HID: rapoo: fix missing hid_is_usb() check Jiangshan Yi <yijiangshan(a)kylinos.cn> HID: nintendo: stop device IO before hid_hw_stop on probe failure Jiangshan Yi <yijiangshan(a)kylinos.cn> HID: nintendo: register input device after capabilities are set Ibrahim Hashimov <security(a)auditcode.ai> HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler() Jann Horn <jannh(a)google.com> HID: huawei: fix missing hid_is_usb() check Jann Horn <jannh(a)google.com> HID: asus: fix missing hid_is_usb() check Anand Khoje <anand.a.khoje(a)oracle.com> net/ionic: avoid OOB TX partner lookup for hwstamp RXQ Baul Lee <baul.lee(a)xbow.com> HID: pidff: fix OOB write when hid->inputs is empty Baul Lee <baul.lee(a)xbow.com> HID: core: fix OOB read of field->usage in hid_set_field() Jose Villaseñor Montfort <pepemontfort(a)gmail.com> HID: magicmouse: do not keep a stale msc->input if no input is claimed Christopher Kodama <ckhordiasma(a)gmail.com> HID: magicmouse: re-enable multitouch after reset-resume Jose Villaseñor Montfort <pepemontfort(a)gmail.com> HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event() Andrei Fed <andfed.net(a)gmail.com> HID: magicmouse: fix battery reporting for Bluetooth Magic Trackpad USB-C Yifei Gao <gyf161023(a)gmail.com> nvmet: pci-epf: put CQ ref on create_cq mapping failure Shin'ichiro Kawasaki <shinichiro.kawasaki(a)wdc.com> nvmet: pci-epf: fix use-after-free in nvmet_pci_epf_exec_iod_work() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations Ibrahim Hashimov <security(a)auditcode.ai> nvmet-tcp: bound SGL data length before allocating command buffers Jiang HongHui <jiang_hh2019(a)163.com> nvmet-fc: fix invalid free in LS IOD error path Bryam Vargas <hexlabsecurity(a)proton.me> nvmet-auth: zero the AUTH_RECEIVE response buffer Griffin Kroah-Hartman <griffin(a)kroah.com> dmaengine: fsl-edma: Add error handling for devm_kasprintf Griffin Kroah-Hartman <griffin(a)kroah.com> mailbox: mchp-ipc-sbi: Add null check for devm_kasprintf() Luxiao Xu <rakukuip(a)gmail.com> ipv6: fix use-after-free in ip6_finish_output2() Yong Wang <edragain(a)163.com> ipv4: reject undersized MTUs in ip_do_fragment() Linmao Li <lilinmao(a)kylinos.cn> nfc: nci: free destination parameters when closing a connection Samuel Page <sam(a)bynar.io> nfc: nci: fix uninit-value in the RF discover/activated NTF handlers Samuel Page <sam(a)bynar.io> nfc: nci: fix out-of-bounds write in nci_target_auto_activated() Bryam Vargas <hexlabsecurity(a)proton.me> nfc: nci: add data_len bound checks to activation parameter extractors Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: st21nfca: validate ATR_REQ length against the received frame Xu Rao <raoxu(a)uniontech.com> nfc: pn533: purge fragmented skbs during cleanup Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: llcp: reject PDUs shorter than the LLCP header Muhammad Bilal <meatuni001(a)gmail.com> nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: llcp: bound the connect_sn TLV walk to the skb Pengpeng Hou <pengpeng(a)iscas.ac.cn> nfc: microread: validate target discovery payload lengths Bryam Vargas <hexlabsecurity(a)proton.me> nfc: fdp: bound the device-reported read length and fix an skb leak Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: digital: clamp SENSF_RES length to the destination buffer Yun Zhou <yun.zhou(a)windriver.com> xfs: restore nofs context unconditionally in xfs_trans_roll Hongling Zeng <zenghongling(a)kylinos.cn> xfs: validate attr entry pointer before field access Jiazi Liu <jiazi.liu1984(a)gmail.com> ext4: fix incorrect function call when initializing s_resgid Eric Biggers <ebiggers(a)kernel.org> ext4: don't enable DAX on new encrypted files Guanghui Yang <3497809730(a)qq.com> ext4: propagate errors from fast commit range replay Jia Zhu <zhujia.zj(a)bytedance.com> ext4: avoid tail write_begin walk for uptodate folios Guanghui Yang <3497809730(a)qq.com> ext4: clear error before retrying inode xattr space fallback Ryusuke Konishi <konishi.ryusuke(a)gmail.com> nilfs2: reject invalid block index in GC ioctl Matthias Goergens <matthias.goergens(a)gmail.com> ext4: stop retrying saturated xattr cache entries Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> kcov: fix data corruption and race conditions on PREEMPT_RT Rik van Riel <riel(a)surriel.com> null_blk: fix UBSAN shift-out-of-bounds when zone_size is 0 or overflows Ian Bridges <icb(a)fastmail.org> ocfs2: fix missing metadata reservation for large xattrs Jens Axboe <axboe(a)kernel.dk> io_uring: defer eventfd signaling when queued from a wakeup handler Jens Axboe <axboe(a)kernel.dk> io_uring/uring_cmd: don't skip completion for a synchronous multishot cmd Ali Ahmet Memis <ali(a)iusegentoo.com> io_uring/rsrc: fix folio size overflow in io_vec_fill_bvec() Vishnu Razdan <vrazdan(a)openai.com> io_uring/io-wq: fix worker accounting when canceling creation callbacks Woraphat Khiaodaeng <worapat.kd2(a)gmail.com> io_uring/cmd: fix iovec leak when the async cmd is not recycled Takashi Iwai <tiwai(a)suse.de> ALSA: dummy: Check card index validity at probe Jens Axboe <axboe(a)kernel.dk> io_uring/futex: only mark private futex waits as inflight Jens Axboe <axboe(a)kernel.dk> io_uring/futex: don't mark futex wake requests as inflight Hyunwoo Kim <imv4bel(a)gmail.com> futex: Fix race on the initial mm->futex.phash.ref allocation Felix Hoffmann <f3lix.dev(a)gmx.de> futex: Avoid private hash use-after-free on final put Thomas Gleixner <tglx(a)kernel.org> futex/pi: Plug private futex exec() race Thomas Gleixner <tglx(a)kernel.org> futex: Sanitize and document task_struct::futex::state transitions Kyle Zeng <kylebot(a)openai.com> futex/pi: Reject cross-mm private futex owners Guixin Liu <kanie(a)linux.alibaba.com> nvmet: fix NULL pointer dereference in nvmet_execute_identify_nslist() Griffin Kroah-Hartman <griffin(a)kroah.com> rndis_host: add overflow check in rndis_rx_fixup() Geoffrey D. Bennett <g(a)b4.vu> ALSA: scarlett2: Use a private URB for the notification endpoint Geoffrey D. Bennett <g(a)b4.vu> ALSA: FCP: Use a private URB for the notification endpoint Peiyang He <peiyang_he(a)smail.nju.edu.cn> iommu/iommufd: Fix NULL pointer deref in iommufd_ioas_change_process when racing with iopt_map_file_pages Shameer Kolothum <skolothumtho(a)nvidia.com> iommu/tegra241-cmdqv: Fix CMD_SYNC use-after-free on teardown Ali Ahmet Memis <ali(a)iusegentoo.com> Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept Steffen Persvold <spersvold(a)gmail.com> PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems ------------- Diffstat: Makefile | 4 +- drivers/block/null_blk/zoned.c | 10 +- drivers/bluetooth/hci_aml.c | 18 +++- drivers/dma/fsl-edma-main.c | 2 + drivers/gpu/drm/xe/xe_vram.c | 23 ++++- drivers/hid/Kconfig | 1 + drivers/hid/hid-asus.c | 2 +- drivers/hid/hid-core.c | 11 +- drivers/hid/hid-ft260.c | 25 ++++- drivers/hid/hid-huawei.c | 5 +- drivers/hid/hid-hyperv.c | 27 ++++- drivers/hid/hid-input.c | 20 +++- drivers/hid/hid-magicmouse.c | 73 +++++++++++-- drivers/hid/hid-nintendo.c | 22 ++-- drivers/hid/hid-rapoo.c | 2 +- drivers/hid/hid-sensor-custom.c | 21 ++-- drivers/hid/hid-uclogic-core.c | 12 ++- drivers/hid/usbhid/hid-pidff.c | 13 ++- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 2 + drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h | 1 + drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c | 15 ++- drivers/iommu/iommufd/ioas.c | 4 + drivers/mailbox/mailbox-mchp-ipc-sbi.c | 2 + drivers/net/ethernet/pensando/ionic/ionic_lif.c | 17 ++- drivers/net/ethernet/pensando/ionic/ionic_txrx.c | 7 +- drivers/net/usb/rndis_host.c | 6 +- drivers/nfc/fdp/i2c.c | 27 +++++ drivers/nfc/microread/microread.c | 31 +++++- drivers/nfc/pn533/pn533.c | 1 + drivers/nfc/st21nfca/dep.c | 3 + drivers/nvme/target/admin-cmd.c | 2 +- drivers/nvme/target/fabrics-cmd-auth.c | 2 +- drivers/nvme/target/fc.c | 2 +- drivers/nvme/target/pci-epf.c | 10 +- drivers/nvme/target/tcp.c | 19 +++- drivers/pci/controller/pci-host-generic.c | 11 +- drivers/pci/ecam.c | 13 +++ fs/exec.c | 7 +- fs/ext4/crypto.c | 40 ++++---- fs/ext4/fast_commit.c | 16 ++- fs/ext4/ialloc.c | 4 + fs/ext4/inode.c | 11 +- fs/ext4/super.c | 2 +- fs/ext4/xattr.c | 7 +- fs/nilfs2/ioctl.c | 20 +++- fs/ocfs2/xattr.c | 18 ++-- fs/xfs/libxfs/xfs_attr_leaf.c | 14 +++ fs/xfs/xfs_trans.c | 16 +-- include/linux/futex.h | 2 + include/linux/hid.h | 2 + include/linux/io_uring_types.h | 8 ++ include/linux/pci-ecam.h | 3 + include/linux/sched.h | 8 ++ io_uring/eventfd.c | 8 +- io_uring/eventfd.h | 2 +- io_uring/futex.c | 32 ++++-- io_uring/futex.h | 1 + io_uring/io-wq.c | 9 +- io_uring/io_uring.c | 2 +- io_uring/opdef.c | 2 +- io_uring/poll.c | 23 +++-- io_uring/rsrc.c | 2 +- io_uring/tw.c | 2 +- io_uring/uring_cmd.c | 8 +- io_uring/waitid.c | 2 +- kernel/futex/core.c | 96 +++++++++++------ kernel/futex/pi.c | 125 +++++++++++++++++------ kernel/kcov.c | 90 ++++++++-------- lib/Kconfig.debug | 5 +- net/bluetooth/hci_event.c | 8 +- net/bluetooth/hci_sync.c | 46 +++++++-- net/bluetooth/iso.c | 32 ++++-- net/bluetooth/mgmt.c | 8 ++ net/bluetooth/rfcomm/core.c | 24 ++++- net/ipv4/ip_output.c | 4 + net/ipv6/ip6_output.c | 2 + net/nfc/digital_technology.c | 2 + net/nfc/llcp_commands.c | 18 +++- net/nfc/llcp_core.c | 15 ++- net/nfc/nci/ntf.c | 36 +++++-- net/nfc/nci/rsp.c | 1 + sound/drivers/dummy.c | 6 ++ sound/usb/fcp.c | 38 ++++--- sound/usb/mixer.c | 6 ++ sound/usb/mixer.h | 2 + sound/usb/mixer_scarlett2.c | 98 +++++++++++------- 86 files changed, 1042 insertions(+), 357 deletions(-)

2 months

[PATCH 6.1 00/79] 6.1.185-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.1.185 release. There are 79 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 27 Aug 2026 13:25:02 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.185-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.1.185-rc1 Chengfeng Ye <nicoyip.dev(a)gmail.com> Bluetooth: hci_event: fix LE list UAF on reset Michael Bommarito <michael.bommarito(a)gmail.com> HID: hyperv: validate initial device info bounds Haoxiang Li <haoxiang_li2024(a)163.com> HID: sensor: custom: Fix use-after-free in enable_sensor Jann Horn <jannh(a)google.com> HID: core: fix number/pointer type confusion on long items Ibrahim Hashimov <security(a)auditcode.ai> HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler() Sukrut Bellary <sukrut.bellary(a)linux.com> misc: fastrpc: Fix double free of 'buf' in error path Oliver Hartkopp <socketcan(a)hartkopp.net> can: isotp: fix timer drain order, wakeup handling and tx_gen ordering Oliver Hartkopp <socketcan(a)hartkopp.net> can: use skb hash instead of private variable in headroom Donglin Lyu <DongLin_Lyu(a)outlook.com> Input: atkbd - skip deactivate for HONOR ZQC-P Cryolitia PukNgae <cryolitia.pukngae(a)linux.dev> Input: atkbd - skip deactivate for HONOR FMB-P's internal keyboard Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Free all memory if cp_init() fails Xiang Mei (Microsoft) <xmei5(a)asu.edu> xfrm: fix sk_dst_cache double-free in xfrm_user_policy() Baul Lee <baul.lee(a)xbow.com> HID: core: fix OOB read of field->usage in hid_set_field() Lee Jones <lee(a)kernel.org> HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID Jose Villaseñor Montfort <pepemontfort(a)gmail.com> HID: magicmouse: do not keep a stale msc->input if no input is claimed Qing Luo <luoqing(a)kylinos.cn> mptcp: pm: fix data race in add_addr timer callback Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: free sk if last Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: always decrease sk refcount Dawid Wróbel <me(a)dawidwrobel.com> ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses Linmao Li <lilinmao(a)kylinos.cn> Input: byd - synchronize timer deletion before freeing private data Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations Jiang HongHui <jiang_hh2019(a)163.com> nvmet-fc: fix invalid free in LS IOD error path Bryam Vargas <hexlabsecurity(a)proton.me> nvmet-auth: zero the AUTH_RECEIVE response buffer Luxiao Xu <rakukuip(a)gmail.com> ipv6: fix use-after-free in ip6_finish_output2() Yong Wang <edragain(a)163.com> ipv4: reject undersized MTUs in ip_do_fragment() Pavitra Jha <jhapavitra98(a)gmail.com> libceph: fix OOB read in decode_watchers() via missing bounds check Eric Dumazet <edumazet(a)google.com> ndisc: ndisc_send_redirect() cleanup Linmao Li <lilinmao(a)kylinos.cn> nfc: nci: free destination parameters when closing a connection Samuel Page <sam(a)bynar.io> nfc: nci: fix uninit-value in the RF discover/activated NTF handlers Samuel Page <sam(a)bynar.io> nfc: nci: fix out-of-bounds write in nci_target_auto_activated() Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: st21nfca: validate ATR_REQ length against the received frame Xu Rao <raoxu(a)uniontech.com> nfc: pn533: purge fragmented skbs during cleanup Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: llcp: reject PDUs shorter than the LLCP header Muhammad Bilal <meatuni001(a)gmail.com> nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: llcp: bound the connect_sn TLV walk to the skb Pengpeng Hou <pengpeng(a)iscas.ac.cn> nfc: microread: validate target discovery payload lengths Bryam Vargas <hexlabsecurity(a)proton.me> nfc: fdp: bound the device-reported read length and fix an skb leak Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: digital: clamp SENSF_RES length to the destination buffer Joanne Koong <joannelkoong(a)gmail.com> iomap: adjust read range correctly for non-block-aligned positions Jakub Kicinski <kuba(a)kernel.org> tls: handle data disappearing from under the TLS ULP Sabrina Dubroca <sd(a)queasysnail.net> tls: fix lockless read of strp->msg_ready in ->poll Junjie Cao <junjie.cao(a)intel.com> gpio: ml-ioh: use raw_spinlock_t for the register lock Yang Wang <kevinyang.wang(a)amd.com> drm/amdgpu: check ASPM on the dGPU host link Ibrahim Hashimov <security(a)auditcode.ai> xfs: bounds-check buffer log item's dirty bitmap Christoph Hellwig <hch(a)lst.de> xfs: don't use a xfs_log_iovec for ri_buf in log recovery Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Implement a crw lock Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Selectively expand io_mutex Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Move cp cleanup out of not operational Junrui Luo <moonafterrain(a)outlook.com> drm/amdgpu: disallow multiple FENCE chunks in one submit Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Cancel existing workqueues Pei Xiao <xiaopei01(a)kylinos.cn> mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition Zhiling Zou <zhilinz(a)nebusec.ai> inet: frags: publish queues before arming timer Zihan Xi <zihanx(a)nebusec.ai> packet: synchronize pressure clearing with ring reconfiguration Eric Dumazet <edumazet(a)google.com> net/packet: convert po->pressure to an atomic flag Luca Fresi <luca.fresi(a)bithiatec.com> serial: sc16is7xx: enable THRI before filling TX FIFO Hugo Villeneuve <hvilleneuve(a)dimonoff.com> serial: sc16is7xx: use guards for simple mutex locks Hugo Villeneuve <hvilleneuve(a)dimonoff.com> serial: sc16is7xx: rename EFR mutex with generic name Lech Perczak <lech.perczak(a)camlingroup.com> serial: sc16is7xx: convert bitmask definitions to use BIT() macro Lech Perczak <lech.perczak(a)camlingroup.com> serial: sc16is7xx: fix copy-paste errors in EFR_SWFLOWx_BIT constants Qihang Tang <q.h.hack.winter(a)gmail.com> packet: use consistent hard_header_len in TX_RING send path Qihang Tang <q.h.hack.winter(a)gmail.com> packet: use consistent hard_header_len in non-ring send paths Aditya Chillara <aditya.chillara(a)oss.qualcomm.com> perf/core: Fix group leader use-after-free after sibling detach Yeoreum Yun <yeoreum.yun(a)arm.com> perf: Fix dangling cgroup pointer in cpuctx Peter Zijlstra <peterz(a)infradead.org> perf: Fix cgroup state vs ERROR Yeoreum Yun <yeoreum.yun(a)arm.com> perf/core: Fix child_total_time_enabled accounting bug at task exit Fan Wu <fanwu01(a)zju.edu.cn> serial: amba-pl011: synchronize DMA teardown Koichiro Den <den(a)valinux.co.jp> NTB: ntb_netdev: Preserve RX queue depth on allocation failure Ekansh Gupta <ekansh.gupta(a)oss.qualcomm.com> misc: fastrpc: Remove buffer from list prior to unmap operation Abel Vesa <abel.vesa(a)linaro.org> misc: fastrpc: Rework fastrpc_req_munmap Hongling Zeng <zenghongling(a)kylinos.cn> xfs: validate attr entry pointer before field access Guanghui Yang <3497809730(a)qq.com> ext4: clear error before retrying inode xattr space fallback Matthias Goergens <matthias.goergens(a)gmail.com> ext4: stop retrying saturated xattr cache entries Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> kcov: fix data corruption and race conditions on PREEMPT_RT Rik van Riel <riel(a)surriel.com> null_blk: fix UBSAN shift-out-of-bounds when zone_size is 0 or overflows Ian Bridges <icb(a)fastmail.org> ocfs2: fix missing metadata reservation for large xattrs Takashi Iwai <tiwai(a)suse.de> ALSA: dummy: Check card index validity at probe Griffin Kroah-Hartman <griffin(a)kroah.com> rndis_host: add overflow check in rndis_rx_fixup() Ali Ahmet Memis <ali(a)iusegentoo.com> Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept Steffen Persvold <spersvold(a)gmail.com> PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems ------------- Diffstat: Makefile | 4 +- drivers/block/null_blk/zoned.c | 10 +- drivers/gpio/gpio-ml-ioh.c | 36 ++-- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 4 + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 50 ++++- drivers/hid/hid-core.c | 11 +- drivers/hid/hid-hyperv.c | 27 ++- drivers/hid/hid-magicmouse.c | 26 +++ drivers/hid/hid-nintendo.c | 7 +- drivers/hid/hid-sensor-custom.c | 21 +- drivers/input/keyboard/atkbd.c | 23 ++- drivers/input/mouse/byd.c | 2 +- drivers/misc/fastrpc.c | 64 +++--- drivers/mmc/host/atmel-mci.c | 2 + drivers/net/can/dev/skb.c | 2 - drivers/net/ntb_netdev.c | 15 +- drivers/net/usb/rndis_host.c | 6 +- drivers/nfc/fdp/i2c.c | 27 +++ drivers/nfc/microread/microread.c | 31 ++- drivers/nfc/pn533/pn533.c | 1 + drivers/nfc/st21nfca/dep.c | 3 + drivers/nvme/target/fabrics-cmd-auth.c | 2 +- drivers/nvme/target/fc.c | 2 +- drivers/nvme/target/tcp.c | 5 +- drivers/pci/controller/pci-host-generic.c | 11 +- drivers/pci/ecam.c | 13 ++ drivers/s390/cio/vfio_ccw_chp.c | 26 ++- drivers/s390/cio/vfio_ccw_cp.c | 30 ++- drivers/s390/cio/vfio_ccw_drv.c | 26 ++- drivers/s390/cio/vfio_ccw_fsm.c | 8 +- drivers/s390/cio/vfio_ccw_ops.c | 27 +++ drivers/s390/cio/vfio_ccw_private.h | 9 +- drivers/tty/serial/amba-pl011.c | 8 +- drivers/tty/serial/sc16is7xx.c | 222 ++++++++++---------- fs/ext4/xattr.c | 7 +- fs/iomap/buffered-io.c | 19 +- fs/ocfs2/xattr.c | 18 +- fs/xfs/libxfs/xfs_attr_leaf.c | 14 ++ fs/xfs/libxfs/xfs_log_recover.h | 4 +- fs/xfs/xfs_attr_item.c | 24 +-- fs/xfs/xfs_bmap_item.c | 18 +- fs/xfs/xfs_buf_item.c | 8 +- fs/xfs/xfs_buf_item.h | 2 +- fs/xfs/xfs_buf_item_recover.c | 91 +++++--- fs/xfs/xfs_dquot_item_recover.c | 20 +- fs/xfs/xfs_extfree_item.c | 43 ++-- fs/xfs/xfs_icreate_item.c | 2 +- fs/xfs/xfs_inode_item.c | 6 +- fs/xfs/xfs_inode_item.h | 4 +- fs/xfs/xfs_inode_item_recover.c | 26 +-- fs/xfs/xfs_log_recover.c | 16 +- fs/xfs/xfs_refcount_item.c | 16 +- fs/xfs/xfs_rmap_item.c | 16 +- fs/xfs/xfs_trans.h | 1 - include/linux/can/core.h | 1 + include/linux/can/skb.h | 2 - include/linux/netdevice.h | 6 +- include/linux/pci-ecam.h | 3 + include/linux/sched.h | 8 + include/net/tls.h | 3 +- kernel/events/core.c | 121 +++++------ kernel/kcov.c | 90 ++++---- lib/Kconfig.debug | 5 +- net/bluetooth/hci_event.c | 2 + net/bluetooth/rfcomm/core.c | 24 ++- net/can/af_can.c | 14 +- net/can/bcm.c | 2 - net/can/isotp.c | 320 +++++++++++++++++++++-------- net/can/j1939/socket.c | 1 - net/can/j1939/transport.c | 2 - net/can/raw.c | 7 +- net/ceph/osd_client.c | 5 +- net/ipv4/inet_fragment.c | 6 +- net/ipv4/ip_output.c | 4 + net/ipv6/ip6_output.c | 2 + net/ipv6/ndisc.c | 8 +- net/mptcp/pm_netlink.c | 36 ++-- net/nfc/digital_technology.c | 2 + net/nfc/llcp_commands.c | 18 +- net/nfc/llcp_core.c | 15 +- net/nfc/nci/ntf.c | 10 +- net/nfc/nci/rsp.c | 1 + net/packet/af_packet.c | 79 ++++--- net/packet/internal.h | 2 +- net/tls/tls.h | 4 +- net/tls/tls_strp.c | 17 +- net/tls/tls_sw.c | 3 +- net/xfrm/xfrm_state.c | 4 +- sound/drivers/dummy.c | 6 + sound/soc/codecs/lpass-tx-macro.c | 4 +- 90 files changed, 1283 insertions(+), 670 deletions(-)

2 months

[PATCH 6.12 00/77] 6.12.106-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.12.106 release. There are 77 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 27 Aug 2026 13:25:02 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.106-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.12.106-rc1 Laxman Acharya Padhya <acharyalaxman8848(a)gmail.com> Bluetooth: hci_aml: validate firmware segment lengths Ali Ahmet Memis <ali(a)iusegentoo.com> Bluetooth: ISO: do not force BT_LISTEN after a failed BIG sync Laxman Acharya Padhya <acharyalaxman8848(a)gmail.com> Bluetooth: hci_event: validate LE Set CIG Parameters response Chengfeng Ye <nicoyip.dev(a)gmail.com> Bluetooth: hci_event: fix LE list UAF on reset Michael Bommarito <michael.bommarito(a)gmail.com> HID: hyperv: validate initial device info bounds Haoxiang Li <haoxiang_li2024(a)163.com> HID: sensor: custom: Fix use-after-free in enable_sensor Jann Horn <jannh(a)google.com> HID: core: fix number/pointer type confusion on long items Jiangshan Yi <yijiangshan(a)kylinos.cn> HID: nintendo: stop device IO before hid_hw_stop on probe failure Jiangshan Yi <yijiangshan(a)kylinos.cn> HID: nintendo: register input device after capabilities are set Ibrahim Hashimov <security(a)auditcode.ai> HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler() Donglin Lyu <DongLin_Lyu(a)outlook.com> Input: atkbd - skip deactivate for HONOR ZQC-P Cryolitia PukNgae <cryolitia.pukngae(a)linux.dev> Input: atkbd - skip deactivate for HONOR FMB-P's internal keyboard Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: pm: fix memory leak from alloc-during-teardown race Eric Dumazet <edumazet(a)google.com> ipv4: start using dst_dev_rcu() Xiang Mei (Microsoft) <xmei5(a)asu.edu> xfrm: fix sk_dst_cache double-free in xfrm_user_policy() Anand Khoje <anand.a.khoje(a)oracle.com> net/ionic: avoid OOB TX partner lookup for hwstamp RXQ Baul Lee <baul.lee(a)xbow.com> HID: core: fix OOB read of field->usage in hid_set_field() Lee Jones <lee(a)kernel.org> HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID Jose Villaseñor Montfort <pepemontfort(a)gmail.com> HID: magicmouse: do not keep a stale msc->input if no input is claimed Christopher Kodama <ckhordiasma(a)gmail.com> HID: magicmouse: re-enable multitouch after reset-resume Andrei Fed <andfed.net(a)gmail.com> HID: magicmouse: fix battery reporting for Bluetooth Magic Trackpad USB-C Maarten Lankhorst <dev(a)lankhorst.se> drm/xe: Fix DPT allocation paths. Dawid Wróbel <me(a)dawidwrobel.com> ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses Qing Luo <luoqing(a)kylinos.cn> mptcp: pm: fix data race in add_addr timer callback Bryam Vargas <hexlabsecurity(a)proton.me> selinux: require a class's permission values to cover its permission count Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations Ibrahim Hashimov <security(a)auditcode.ai> nvmet-tcp: bound SGL data length before allocating command buffers Jiang HongHui <jiang_hh2019(a)163.com> nvmet-fc: fix invalid free in LS IOD error path Bryam Vargas <hexlabsecurity(a)proton.me> nvmet-auth: zero the AUTH_RECEIVE response buffer Luxiao Xu <rakukuip(a)gmail.com> ipv6: fix use-after-free in ip6_finish_output2() Yong Wang <edragain(a)163.com> ipv4: reject undersized MTUs in ip_do_fragment() Linmao Li <lilinmao(a)kylinos.cn> Input: byd - synchronize timer deletion before freeing private data Eric Dumazet <edumazet(a)google.com> ndisc: ndisc_send_redirect() cleanup Linmao Li <lilinmao(a)kylinos.cn> nfc: nci: free destination parameters when closing a connection Samuel Page <sam(a)bynar.io> nfc: nci: fix uninit-value in the RF discover/activated NTF handlers Samuel Page <sam(a)bynar.io> nfc: nci: fix out-of-bounds write in nci_target_auto_activated() Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: st21nfca: validate ATR_REQ length against the received frame Xu Rao <raoxu(a)uniontech.com> nfc: pn533: purge fragmented skbs during cleanup Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: llcp: reject PDUs shorter than the LLCP header Muhammad Bilal <meatuni001(a)gmail.com> nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: llcp: bound the connect_sn TLV walk to the skb Pengpeng Hou <pengpeng(a)iscas.ac.cn> nfc: microread: validate target discovery payload lengths Bryam Vargas <hexlabsecurity(a)proton.me> nfc: fdp: bound the device-reported read length and fix an skb leak Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: digital: clamp SENSF_RES length to the destination buffer Pavitra Jha <jhapavitra98(a)gmail.com> libceph: fix OOB read in decode_watchers() via missing bounds check Hongling Zeng <zenghongling(a)kylinos.cn> xfs: validate attr entry pointer before field access Guanghui Yang <3497809730(a)qq.com> ext4: propagate errors from fast commit range replay Guanghui Yang <3497809730(a)qq.com> ext4: clear error before retrying inode xattr space fallback Matthias Goergens <matthias.goergens(a)gmail.com> ext4: stop retrying saturated xattr cache entries Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> kcov: fix data corruption and race conditions on PREEMPT_RT Rik van Riel <riel(a)surriel.com> null_blk: fix UBSAN shift-out-of-bounds when zone_size is 0 or overflows Ian Bridges <icb(a)fastmail.org> ocfs2: fix missing metadata reservation for large xattrs Takashi Iwai <tiwai(a)suse.de> ALSA: dummy: Check card index validity at probe Darrick J. Wong <djwong(a)kernel.org> xfs: don't livelock in scrub on a circular unlinked list Darrick J. Wong <djwong(a)kernel.org> xfs: hoist per-bucket unlinked list check to helper Ibrahim Hashimov <security(a)auditcode.ai> xfs: bounds-check buffer log item's dirty bitmap Christoph Hellwig <hch(a)lst.de> xfs: don't use a xfs_log_iovec for ri_buf in log recovery Darrick J. Wong <djwong(a)kernel.org> xfs: namespace the maximum length/refcount symbols Luca Fresi <luca.fresi(a)bithiatec.com> serial: sc16is7xx: enable THRI before filling TX FIFO Hugo Villeneuve <hvilleneuve(a)dimonoff.com> serial: sc16is7xx: use guards for simple mutex locks Hugo Villeneuve <hvilleneuve(a)dimonoff.com> serial: sc16is7xx: rename EFR mutex with generic name Fan Wu <fanwu01(a)zju.edu.cn> serial: amba-pl011: synchronize DMA teardown Koichiro Den <den(a)valinux.co.jp> NTB: ntb_netdev: Preserve RX queue depth on allocation failure Ryan Wilbur <rwilbur633(a)gmail.com> serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx Zhiling Zou <zhilinz(a)nebusec.ai> inet: frags: publish queues before arming timer Eric Dumazet <edumazet(a)google.com> inet: frags: save a pair of atomic operations in reassembly Eric Dumazet <edumazet(a)google.com> inet: frags: change inet_frag_kill() to defer refcount updates Eric Dumazet <edumazet(a)google.com> ipv4: frags: remove ipq_put() Eric Dumazet <edumazet(a)google.com> inet: frags: add inet_frag_putn() helper David Howells <dhowells(a)redhat.com> netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages() Nobuhiro Iwamatsu <nobuhiro.iwamatsu.x90(a)mail.toshiba> hwmon: (ltc4286) Fix symbol namespace of MODULE_IMPORT_NS() Jordan Rhee <jordanrhee(a)google.com> gve: fix zero-length skb frag with header-split Junjie Cao <junjie.cao(a)intel.com> gpio: ml-ioh: use raw_spinlock_t for the register lock Griffin Kroah-Hartman <griffin(a)kroah.com> rndis_host: add overflow check in rndis_rx_fixup() Geoffrey D. Bennett <g(a)b4.vu> ALSA: scarlett2: Use a private URB for the notification endpoint Ali Ahmet Memis <ali(a)iusegentoo.com> Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept Steffen Persvold <spersvold(a)gmail.com> PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems ------------- Diffstat: Makefile | 4 +- drivers/block/null_blk/zoned.c | 10 ++- drivers/bluetooth/hci_aml.c | 18 ++++- drivers/gpio/gpio-ml-ioh.c | 36 ++++----- drivers/gpu/drm/xe/display/xe_fb_pin.c | 24 ++---- drivers/hid/hid-core.c | 11 ++- drivers/hid/hid-hyperv.c | 27 ++++++- drivers/hid/hid-input.c | 3 + drivers/hid/hid-magicmouse.c | 64 +++++++++++++++- drivers/hid/hid-nintendo.c | 22 ++++-- drivers/hid/hid-sensor-custom.c | 21 ++--- drivers/hwmon/pmbus/ltc4286.c | 2 +- drivers/input/keyboard/atkbd.c | 23 +++++- drivers/input/mouse/byd.c | 2 +- drivers/net/ethernet/google/gve/gve_rx_dqo.c | 6 ++ drivers/net/ethernet/pensando/ionic/ionic_lif.c | 17 +++- drivers/net/ethernet/pensando/ionic/ionic_txrx.c | 7 +- drivers/net/ntb_netdev.c | 15 ++-- drivers/net/usb/rndis_host.c | 6 +- drivers/nfc/fdp/i2c.c | 27 +++++++ drivers/nfc/microread/microread.c | 31 +++++++- drivers/nfc/pn533/pn533.c | 1 + drivers/nfc/st21nfca/dep.c | 3 + drivers/nvme/target/fabrics-cmd-auth.c | 2 +- drivers/nvme/target/fc.c | 2 +- drivers/nvme/target/tcp.c | 18 ++++- drivers/pci/controller/pci-host-generic.c | 11 +-- drivers/pci/ecam.c | 13 ++++ drivers/tty/serial/8250/8250_of.c | 41 ++++++++++ drivers/tty/serial/amba-pl011.c | 8 +- drivers/tty/serial/sc16is7xx.c | 40 +++++----- fs/ext4/fast_commit.c | 16 +++- fs/ext4/xattr.c | 7 +- fs/netfs/buffered_read.c | 4 +- fs/netfs/read_collect.c | 2 +- fs/netfs/read_retry.c | 2 +- fs/ocfs2/xattr.c | 18 +++-- fs/xfs/libxfs/xfs_attr_leaf.c | 14 ++++ fs/xfs/libxfs/xfs_format.h | 4 +- fs/xfs/libxfs/xfs_log_recover.h | 4 +- fs/xfs/libxfs/xfs_refcount.c | 18 ++--- fs/xfs/scrub/agheader.c | 94 +++++++++++++++++------ fs/xfs/scrub/agheader_repair.c | 17 +++- fs/xfs/scrub/refcount.c | 2 +- fs/xfs/scrub/refcount_repair.c | 4 +- fs/xfs/xfs_attr_item.c | 32 ++++---- fs/xfs/xfs_bmap_item.c | 18 ++--- fs/xfs/xfs_buf_item.c | 8 +- fs/xfs/xfs_buf_item.h | 2 +- fs/xfs/xfs_buf_item_recover.c | 95 ++++++++++++++--------- fs/xfs/xfs_dquot_item_recover.c | 20 ++--- fs/xfs/xfs_exchmaps_item.c | 8 +- fs/xfs/xfs_extfree_item.c | 43 ++++++----- fs/xfs/xfs_icreate_item.c | 2 +- fs/xfs/xfs_inode_item.c | 6 +- fs/xfs/xfs_inode_item.h | 4 +- fs/xfs/xfs_inode_item_recover.c | 26 +++---- fs/xfs/xfs_log_recover.c | 16 ++-- fs/xfs/xfs_refcount_item.c | 16 ++-- fs/xfs/xfs_rmap_item.c | 16 ++-- fs/xfs/xfs_trans.h | 1 - include/linux/netfs.h | 2 +- include/linux/pci-ecam.h | 3 + include/linux/sched.h | 8 ++ include/net/inet_frag.h | 6 +- include/net/ipv6_frag.h | 5 +- kernel/kcov.c | 90 +++++++++++----------- lib/Kconfig.debug | 5 +- net/bluetooth/hci_event.c | 8 +- net/bluetooth/iso.c | 30 ++++++-- net/bluetooth/rfcomm/core.c | 24 +++++- net/ceph/osd_client.c | 5 +- net/ieee802154/6lowpan/reassembly.c | 27 ++++--- net/ipv4/icmp.c | 6 +- net/ipv4/inet_fragment.c | 33 ++++---- net/ipv4/ip_fragment.c | 54 ++++++------- net/ipv4/ip_output.c | 4 + net/ipv4/ipmr.c | 2 +- net/ipv4/route.c | 4 +- net/ipv6/ip6_output.c | 2 + net/ipv6/ndisc.c | 8 +- net/ipv6/netfilter/nf_conntrack_reasm.c | 27 ++++--- net/ipv6/reassembly.c | 29 +++---- net/mptcp/pm_netlink.c | 9 ++- net/mptcp/pm_userspace.c | 7 +- net/mptcp/protocol.c | 9 +++ net/mptcp/protocol.h | 7 +- net/nfc/digital_technology.c | 2 + net/nfc/llcp_commands.c | 18 ++++- net/nfc/llcp_core.c | 15 +++- net/nfc/nci/ntf.c | 10 ++- net/nfc/nci/rsp.c | 1 + net/xfrm/xfrm_state.c | 4 +- security/selinux/ss/policydb.c | 57 ++++++++++++-- sound/drivers/dummy.c | 6 ++ sound/soc/codecs/lpass-tx-macro.c | 4 +- sound/usb/mixer.c | 6 ++ sound/usb/mixer.h | 2 + sound/usb/mixer_scarlett2.c | 98 +++++++++++++++--------- 99 files changed, 1128 insertions(+), 543 deletions(-)

2 months

[PATCH 6.6 00/87] 6.6.154-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.6.154 release. There are 87 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 27 Aug 2026 13:25:02 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.154-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.6.154-rc1 Laxman Acharya Padhya <acharyalaxman8848(a)gmail.com> Bluetooth: hci_event: validate LE Set CIG Parameters response Chengfeng Ye <nicoyip.dev(a)gmail.com> Bluetooth: hci_event: fix LE list UAF on reset Michael Bommarito <michael.bommarito(a)gmail.com> HID: hyperv: validate initial device info bounds Haoxiang Li <haoxiang_li2024(a)163.com> HID: sensor: custom: Fix use-after-free in enable_sensor Jann Horn <jannh(a)google.com> HID: core: fix number/pointer type confusion on long items Ibrahim Hashimov <security(a)auditcode.ai> HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler() Bryam Vargas <hexlabsecurity(a)proton.me> selinux: require a class's permission values to cover its permission count Bryam Vargas <hexlabsecurity(a)proton.me> selinux: reject a permission value exceeding the class permission count Christian Göttsche <cgzones(a)googlemail.com> selinux: more strict policy parsing Christian Göttsche <cgzones(a)googlemail.com> selinux: use u16 for security classes Christian Göttsche <cgzones(a)googlemail.com> selinux: make more use of str_read() when loading the policy Christian Göttsche <cgzones(a)googlemail.com> selinux: avoid unnecessary indirection in struct level_datum Christian Göttsche <cgzones(a)googlemail.com> selinux: use known type instead of void pointer Paul Moore <paul(a)paul-moore.com> selinux: fix style issues in security/selinux/ss/policydb.c Paul Moore <paul(a)paul-moore.com> selinux: fix style issues in security/selinux/ss/policydb.h Shardul Bankar <shardul.b(a)mpiricsoftware.com> mptcp: pm: fix memory leak from alloc-during-teardown race Donglin Lyu <DongLin_Lyu(a)outlook.com> Input: atkbd - skip deactivate for HONOR ZQC-P Cryolitia PukNgae <cryolitia.pukngae(a)linux.dev> Input: atkbd - skip deactivate for HONOR FMB-P's internal keyboard Chengfeng Ye <nicoyip.dev(a)gmail.com> Bluetooth: hci_sync: Fix advertising data UAFs Xiang Mei (Microsoft) <xmei5(a)asu.edu> xfrm: fix sk_dst_cache double-free in xfrm_user_policy() Baul Lee <baul.lee(a)xbow.com> HID: core: fix OOB read of field->usage in hid_set_field() Lee Jones <lee(a)kernel.org> HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID Jose Villaseñor Montfort <pepemontfort(a)gmail.com> HID: magicmouse: do not keep a stale msc->input if no input is claimed Andrei Fed <andfed.net(a)gmail.com> HID: magicmouse: fix battery reporting for Bluetooth Magic Trackpad USB-C Qing Luo <luoqing(a)kylinos.cn> mptcp: pm: fix data race in add_addr timer callback Dawid Wróbel <me(a)dawidwrobel.com> ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: SOF: ipc4-pcm: Continue the pipeline trigger in case of IPC timeout Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: SOF: pcm: Add snd_sof_pcm specific wrappers for dev_dbg() and dev_err() Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: SOF: pcm: Move period/buffer configuration print after platform open Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> ASoC: SOF: Relocate and rework functionality for PCM stream freeing Kuninori Morimoto <kuninori.morimoto.gx(a)renesas.com> ASoC: sof: pcm: use snd_pcm_direction_name() Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations Jiang HongHui <jiang_hh2019(a)163.com> nvmet-fc: fix invalid free in LS IOD error path Bryam Vargas <hexlabsecurity(a)proton.me> nvmet-auth: zero the AUTH_RECEIVE response buffer Luxiao Xu <rakukuip(a)gmail.com> ipv6: fix use-after-free in ip6_finish_output2() Yong Wang <edragain(a)163.com> ipv4: reject undersized MTUs in ip_do_fragment() Pavitra Jha <jhapavitra98(a)gmail.com> libceph: fix OOB read in decode_watchers() via missing bounds check Linmao Li <lilinmao(a)kylinos.cn> Input: byd - synchronize timer deletion before freeing private data Eric Dumazet <edumazet(a)google.com> ndisc: ndisc_send_redirect() cleanup Linmao Li <lilinmao(a)kylinos.cn> nfc: nci: free destination parameters when closing a connection Samuel Page <sam(a)bynar.io> nfc: nci: fix uninit-value in the RF discover/activated NTF handlers Samuel Page <sam(a)bynar.io> nfc: nci: fix out-of-bounds write in nci_target_auto_activated() Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: st21nfca: validate ATR_REQ length against the received frame Xu Rao <raoxu(a)uniontech.com> nfc: pn533: purge fragmented skbs during cleanup Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: llcp: reject PDUs shorter than the LLCP header Muhammad Bilal <meatuni001(a)gmail.com> nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: llcp: bound the connect_sn TLV walk to the skb Pengpeng Hou <pengpeng(a)iscas.ac.cn> nfc: microread: validate target discovery payload lengths Bryam Vargas <hexlabsecurity(a)proton.me> nfc: fdp: bound the device-reported read length and fix an skb leak Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: digital: clamp SENSF_RES length to the destination buffer Yang Wang <kevinyang.wang(a)amd.com> drm/amdgpu: check ASPM on the dGPU host link Nathan Lucas <nlucasgit(a)gmail.com> drm/amd/display: fix BT.2020 YCbCr limited output CSC matrix Ilya Bakoulin <Ilya.Bakoulin(a)amd.com> drm/amd/display: Fix BT2020 YCbCr limited/full range input Kenneth Feng <kenneth.feng(a)amd.com> drm/amd/amdgpu: disable ASPM in some situations Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Implement a crw lock Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Calculate idal length based on idaw type Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Ensure first IDAW remains constant Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Free all memory if cp_init() fails Junjie Cao <junjie.cao(a)intel.com> gpio: ml-ioh: use raw_spinlock_t for the register lock Hongling Zeng <zenghongling(a)kylinos.cn> xfs: validate attr entry pointer before field access Guanghui Yang <3497809730(a)qq.com> ext4: clear error before retrying inode xattr space fallback Matthias Goergens <matthias.goergens(a)gmail.com> ext4: stop retrying saturated xattr cache entries Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> kcov: fix data corruption and race conditions on PREEMPT_RT Rik van Riel <riel(a)surriel.com> null_blk: fix UBSAN shift-out-of-bounds when zone_size is 0 or overflows Ian Bridges <icb(a)fastmail.org> ocfs2: fix missing metadata reservation for large xattrs Takashi Iwai <tiwai(a)suse.de> ALSA: dummy: Check card index validity at probe Ibrahim Hashimov <security(a)auditcode.ai> xfs: bounds-check buffer log item's dirty bitmap Christoph Hellwig <hch(a)lst.de> xfs: don't use a xfs_log_iovec for ri_buf in log recovery Pei Xiao <xiaopei01(a)kylinos.cn> mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition Zhiling Zou <zhilinz(a)nebusec.ai> inet: frags: publish queues before arming timer Eric Dumazet <edumazet(a)google.com> inet: frags: save a pair of atomic operations in reassembly Eric Dumazet <edumazet(a)google.com> inet: frags: change inet_frag_kill() to defer refcount updates Eric Dumazet <edumazet(a)google.com> ipv4: frags: remove ipq_put() Eric Dumazet <edumazet(a)google.com> inet: frags: add inet_frag_putn() helper Luca Fresi <luca.fresi(a)bithiatec.com> serial: sc16is7xx: enable THRI before filling TX FIFO Hugo Villeneuve <hvilleneuve(a)dimonoff.com> serial: sc16is7xx: use guards for simple mutex locks Hugo Villeneuve <hvilleneuve(a)dimonoff.com> serial: sc16is7xx: rename EFR mutex with generic name Lech Perczak <lech.perczak(a)camlingroup.com> serial: sc16is7xx: convert bitmask definitions to use BIT() macro Lech Perczak <lech.perczak(a)camlingroup.com> serial: sc16is7xx: fix copy-paste errors in EFR_SWFLOWx_BIT constants Jan Sebastian Götte <linux(a)jaseg.de> serial: qcom-geni: fix TX DMA buffer flush Aditya Chillara <aditya.chillara(a)oss.qualcomm.com> perf/core: Fix group leader use-after-free after sibling detach Peter Zijlstra <peterz(a)infradead.org> perf: Unify perf_event_free_task() / perf_event_exit_task_context() Fan Wu <fanwu01(a)zju.edu.cn> serial: amba-pl011: synchronize DMA teardown Koichiro Den <den(a)valinux.co.jp> NTB: ntb_netdev: Preserve RX queue depth on allocation failure Griffin Kroah-Hartman <griffin(a)kroah.com> rndis_host: add overflow check in rndis_rx_fixup() Ali Ahmet Memis <ali(a)iusegentoo.com> Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept Steffen Persvold <spersvold(a)gmail.com> PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems ------------- Diffstat: Makefile | 4 +- drivers/block/null_blk/zoned.c | 10 +- drivers/gpio/gpio-ml-ioh.c | 36 +- drivers/gpu/drm/amd/amdgpu/amdgpu.h | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 100 ++- drivers/gpu/drm/amd/amdgpu/nv.c | 2 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 6 +- .../drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 2 +- drivers/gpu/drm/amd/display/dc/basics/dc_common.c | 3 +- .../gpu/drm/amd/display/dc/core/dc_hw_sequencer.c | 34 +- drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 4 +- drivers/gpu/drm/amd/display/dc/dc_hw_types.h | 4 +- .../drm/amd/display/dc/dce/dce_stream_encoder.c | 3 +- .../amd/display/dc/dcn10/dcn10_stream_encoder.c | 3 +- .../display/dc/dcn31/dcn31_hpo_dp_stream_encoder.c | 3 +- drivers/gpu/drm/amd/display/dc/inc/hw/dpp.h | 6 +- .../amd/display/modules/info_packet/info_packet.c | 4 +- drivers/hid/hid-core.c | 11 +- drivers/hid/hid-hyperv.c | 27 +- drivers/hid/hid-input.c | 3 + drivers/hid/hid-magicmouse.c | 45 +- drivers/hid/hid-nintendo.c | 7 +- drivers/hid/hid-sensor-custom.c | 21 +- drivers/input/keyboard/atkbd.c | 23 +- drivers/input/mouse/byd.c | 2 +- drivers/mmc/host/atmel-mci.c | 2 + drivers/net/ntb_netdev.c | 15 +- drivers/net/usb/rndis_host.c | 6 +- drivers/nfc/fdp/i2c.c | 27 + drivers/nfc/microread/microread.c | 31 +- drivers/nfc/pn533/pn533.c | 1 + drivers/nfc/st21nfca/dep.c | 3 + drivers/nvme/target/fabrics-cmd-auth.c | 2 +- drivers/nvme/target/fc.c | 2 +- drivers/nvme/target/tcp.c | 5 +- drivers/pci/controller/pci-host-generic.c | 11 +- drivers/pci/ecam.c | 13 + drivers/s390/cio/vfio_ccw_chp.c | 26 +- drivers/s390/cio/vfio_ccw_cp.c | 43 +- drivers/s390/cio/vfio_ccw_cp.h | 2 + drivers/s390/cio/vfio_ccw_drv.c | 6 + drivers/s390/cio/vfio_ccw_ops.c | 4 + drivers/s390/cio/vfio_ccw_private.h | 4 + drivers/tty/serial/amba-pl011.c | 8 +- drivers/tty/serial/qcom_geni_serial.c | 51 +- drivers/tty/serial/sc16is7xx.c | 222 +++--- fs/ext4/xattr.c | 7 +- fs/ocfs2/xattr.c | 18 +- fs/xfs/libxfs/xfs_attr_leaf.c | 14 + fs/xfs/libxfs/xfs_log_recover.h | 4 +- fs/xfs/xfs_attr_item.c | 24 +- fs/xfs/xfs_bmap_item.c | 18 +- fs/xfs/xfs_buf_item.c | 8 +- fs/xfs/xfs_buf_item.h | 2 +- fs/xfs/xfs_buf_item_recover.c | 95 ++- fs/xfs/xfs_dquot_item_recover.c | 20 +- fs/xfs/xfs_extfree_item.c | 43 +- fs/xfs/xfs_icreate_item.c | 2 +- fs/xfs/xfs_inode_item.c | 6 +- fs/xfs/xfs_inode_item.h | 4 +- fs/xfs/xfs_inode_item_recover.c | 26 +- fs/xfs/xfs_log_recover.c | 16 +- fs/xfs/xfs_refcount_item.c | 16 +- fs/xfs/xfs_rmap_item.c | 16 +- fs/xfs/xfs_trans.h | 1 - include/linux/pci-ecam.h | 3 + include/linux/sched.h | 8 + include/net/inet_frag.h | 6 +- include/net/ipv6_frag.h | 5 +- kernel/events/core.c | 161 ++--- kernel/kcov.c | 90 +-- lib/Kconfig.debug | 5 +- net/bluetooth/hci_event.c | 8 +- net/bluetooth/hci_sync.c | 137 +++- net/bluetooth/rfcomm/core.c | 24 +- net/ceph/osd_client.c | 5 +- net/ieee802154/6lowpan/reassembly.c | 27 +- net/ipv4/inet_fragment.c | 33 +- net/ipv4/ip_fragment.c | 48 +- net/ipv4/ip_output.c | 4 + net/ipv6/ip6_output.c | 2 + net/ipv6/ndisc.c | 8 +- net/ipv6/netfilter/nf_conntrack_reasm.c | 27 +- net/ipv6/reassembly.c | 29 +- net/mptcp/pm_netlink.c | 9 +- net/mptcp/pm_userspace.c | 7 +- net/mptcp/protocol.c | 9 + net/mptcp/protocol.h | 7 +- net/nfc/digital_technology.c | 2 + net/nfc/llcp_commands.c | 18 +- net/nfc/llcp_core.c | 15 +- net/nfc/nci/ntf.c | 10 +- net/nfc/nci/rsp.c | 1 + net/xfrm/xfrm_state.c | 4 +- security/selinux/include/security.h | 1 + security/selinux/ss/avtab.c | 45 +- security/selinux/ss/avtab.h | 23 +- security/selinux/ss/conditional.c | 40 +- security/selinux/ss/conditional.h | 6 +- security/selinux/ss/constraint.h | 1 + security/selinux/ss/ebitmap.c | 4 +- security/selinux/ss/ebitmap.h | 5 +- security/selinux/ss/mls.c | 6 +- security/selinux/ss/policydb.c | 743 +++++++++++++-------- security/selinux/ss/policydb.h | 249 +++---- security/selinux/ss/services.c | 8 +- sound/drivers/dummy.c | 6 + sound/soc/codecs/lpass-tx-macro.c | 4 +- sound/soc/sof/ipc3-pcm.c | 13 +- sound/soc/sof/ipc3-topology.c | 20 +- sound/soc/sof/ipc4-pcm.c | 35 +- sound/soc/sof/ipc4-topology.c | 18 +- sound/soc/sof/pcm.c | 157 +++-- sound/soc/sof/sof-audio.c | 36 - sound/soc/sof/sof-audio.h | 17 +- 115 files changed, 2047 insertions(+), 1291 deletions(-)

2 months

[PATCH 5.15 00/76] 5.15.218-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 5.15.218 release. There are 76 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 27 Aug 2026 13:25:02 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.218-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 5.15.218-rc1 Michael Bommarito <michael.bommarito(a)gmail.com> HID: hyperv: validate initial device info bounds Haoxiang Li <haoxiang_li2024(a)163.com> HID: sensor: custom: Fix use-after-free in enable_sensor Jann Horn <jannh(a)google.com> HID: core: fix number/pointer type confusion on long items Oliver Hartkopp <socketcan(a)hartkopp.net> can: isotp: fix timer drain order, wakeup handling and tx_gen ordering Oliver Hartkopp <socketcan(a)hartkopp.net> can: use skb hash instead of private variable in headroom Qing Luo <luoqing(a)kylinos.cn> mptcp: pm: fix data race in add_addr timer callback Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: free sk if last Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: always decrease sk refcount Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: pm: ADD_ADDR rtx: allow ID 0 Donglin Lyu <DongLin_Lyu(a)outlook.com> Input: atkbd - skip deactivate for HONOR ZQC-P Cryolitia PukNgae <cryolitia.pukngae(a)linux.dev> Input: atkbd - skip deactivate for HONOR FMB-P's internal keyboard Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Free all memory if cp_init() fails Joanne Koong <joannelkoong(a)gmail.com> iomap: adjust read range correctly for non-block-aligned positions Sean Christopherson <seanjc(a)google.com> KVM: x86: Retry page fault if MMU reload is pending and root has no sp Xiang Mei (Microsoft) <xmei5(a)asu.edu> xfrm: fix sk_dst_cache double-free in xfrm_user_policy() Baul Lee <baul.lee(a)xbow.com> HID: core: fix OOB read of field->usage in hid_set_field() Lee Jones <lee(a)kernel.org> HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID Jose Villaseñor Montfort <pepemontfort(a)gmail.com> HID: magicmouse: do not keep a stale msc->input if no input is claimed Sean Christopherson <seanjc(a)google.com> KVM: x86: Check for invalid/obsolete root *after* making MMU pages available David Matlack <dmatlack(a)google.com> KVM: x86/mmu: Rename __direct_map() to direct_map() David Matlack <dmatlack(a)google.com> KVM: x86/mmu: Split out TDP MMU page fault handling Chao Peng <chao.p.peng(a)linux.intel.com> KVM: Rename mmu_notifier_* to mmu_invalidate_* Sean Christopherson <seanjc(a)google.com> KVM: x86/mmu: Document the "rules" for using host_pfn_mapping_level() Sean Christopherson <seanjc(a)google.com> KVM: x86/mmu: Rename pte_list_{destroy,remove}() to show they zap SPTEs Sean Christopherson <seanjc(a)google.com> KVM: x86/mmu: Directly "destroy" PTE list when recycling rmaps Sean Christopherson <seanjc(a)google.com> KVM: x86/mmu: Retry page fault if root is invalidated by memslot update Dawid Wróbel <me(a)dawidwrobel.com> ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses Matthieu Baerts (NGI0) <matttbe(a)kernel.org> mptcp: avoid combining some incoming suboptions Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Implement a crw lock Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Selectively expand io_mutex Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Ensure index for read/write regions are within range Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations Jiang HongHui <jiang_hh2019(a)163.com> nvmet-fc: fix invalid free in LS IOD error path Luxiao Xu <rakukuip(a)gmail.com> ipv6: fix use-after-free in ip6_finish_output2() Yong Wang <edragain(a)163.com> ipv4: reject undersized MTUs in ip_do_fragment() Yang Wang <kevinyang.wang(a)amd.com> drm/amdgpu: check ASPM on the dGPU host link Pavitra Jha <jhapavitra98(a)gmail.com> libceph: fix OOB read in decode_watchers() via missing bounds check Linmao Li <lilinmao(a)kylinos.cn> nfc: nci: free destination parameters when closing a connection Samuel Page <sam(a)bynar.io> nfc: nci: fix uninit-value in the RF discover/activated NTF handlers Samuel Page <sam(a)bynar.io> nfc: nci: fix out-of-bounds write in nci_target_auto_activated() Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: st21nfca: validate ATR_REQ length against the received frame Xu Rao <raoxu(a)uniontech.com> nfc: pn533: purge fragmented skbs during cleanup Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: llcp: reject PDUs shorter than the LLCP header Muhammad Bilal <meatuni001(a)gmail.com> nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: llcp: bound the connect_sn TLV walk to the skb Pengpeng Hou <pengpeng(a)iscas.ac.cn> nfc: microread: validate target discovery payload lengths Bryam Vargas <hexlabsecurity(a)proton.me> nfc: fdp: bound the device-reported read length and fix an skb leak Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: digital: clamp SENSF_RES length to the destination buffer Ibrahim Hashimov <security(a)auditcode.ai> xfs: bounds-check buffer log item's dirty bitmap Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Cancel existing workqueues Pei Xiao <xiaopei01(a)kylinos.cn> mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition Zhiling Zou <zhilinz(a)nebusec.ai> inet: frags: publish queues before arming timer Zihan Xi <zihanx(a)nebusec.ai> packet: synchronize pressure clearing with ring reconfiguration Zijie Huang <milkory(a)outlook.com> net/sched: reject overly deep qdisc hierarchies Qihang Tang <q.h.hack.winter(a)gmail.com> packet: use consistent hard_header_len in TX_RING send path Qihang Tang <q.h.hack.winter(a)gmail.com> packet: use consistent hard_header_len in non-ring send paths Fan Wu <fanwu01(a)zju.edu.cn> serial: amba-pl011: synchronize DMA teardown Koichiro Den <den(a)valinux.co.jp> NTB: ntb_netdev: Preserve RX queue depth on allocation failure Aditya Chillara <aditya.chillara(a)oss.qualcomm.com> perf/core: Fix group leader use-after-free after sibling detach Yeoreum Yun <yeoreum.yun(a)arm.com> perf: Fix dangling cgroup pointer in cpuctx Peter Zijlstra <peterz(a)infradead.org> perf: Fix cgroup state vs ERROR Yeoreum Yun <yeoreum.yun(a)arm.com> perf/core: Fix child_total_time_enabled accounting bug at task exit Ekansh Gupta <ekansh.gupta(a)oss.qualcomm.com> misc: fastrpc: Remove buffer from list prior to unmap operation Abel Vesa <abel.vesa(a)linaro.org> misc: fastrpc: Rework fastrpc_req_munmap Srinivas Kandagatla <srinivas.kandagatla(a)linaro.org> misc: fastrpc: separate fastrpc device from channel context Lorenzo Stoakes (ARM) <ljs(a)kernel.org> mm/huge_memory: fix huge_zero_pfn race Junjie Cao <junjie.cao(a)intel.com> gpio: ml-ioh: use raw_spinlock_t for the register lock Hongling Zeng <zenghongling(a)kylinos.cn> xfs: validate attr entry pointer before field access Guanghui Yang <3497809730(a)qq.com> ext4: clear error before retrying inode xattr space fallback Matthias Goergens <matthias.goergens(a)gmail.com> ext4: stop retrying saturated xattr cache entries Rik van Riel <riel(a)surriel.com> null_blk: fix UBSAN shift-out-of-bounds when zone_size is 0 or overflows Ian Bridges <icb(a)fastmail.org> ocfs2: fix missing metadata reservation for large xattrs Takashi Iwai <tiwai(a)suse.de> ALSA: dummy: Check card index validity at probe Griffin Kroah-Hartman <griffin(a)kroah.com> rndis_host: add overflow check in rndis_rx_fixup() Ali Ahmet Memis <ali(a)iusegentoo.com> Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept Steffen Persvold <spersvold(a)gmail.com> PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems ------------- Diffstat: Makefile | 4 +- arch/arm64/kvm/mmu.c | 10 +- arch/mips/kvm/mmu.c | 12 +- arch/powerpc/include/asm/kvm_book3s_64.h | 2 +- arch/powerpc/kvm/book3s_64_mmu_host.c | 4 +- arch/powerpc/kvm/book3s_64_mmu_hv.c | 4 +- arch/powerpc/kvm/book3s_64_mmu_radix.c | 6 +- arch/powerpc/kvm/book3s_64_vio_hv.c | 2 +- arch/powerpc/kvm/book3s_hv_nested.c | 2 +- arch/powerpc/kvm/book3s_hv_rm_mmu.c | 8 +- arch/powerpc/kvm/e500_mmu_host.c | 4 +- arch/x86/kvm/mmu/mmu.c | 189 +++++++++++++---- arch/x86/kvm/mmu/paging_tmpl.h | 13 +- drivers/block/null_blk/zoned.c | 10 +- drivers/gpio/gpio-ml-ioh.c | 36 ++-- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 50 ++++- drivers/hid/hid-core.c | 11 +- drivers/hid/hid-hyperv.c | 27 ++- drivers/hid/hid-magicmouse.c | 26 +++ drivers/hid/hid-sensor-custom.c | 21 +- drivers/input/keyboard/atkbd.c | 23 ++- drivers/misc/fastrpc.c | 110 ++++++---- drivers/mmc/host/atmel-mci.c | 2 + drivers/net/can/dev/skb.c | 2 - drivers/net/can/slcan.c | 1 - drivers/net/ntb_netdev.c | 15 +- drivers/net/usb/rndis_host.c | 6 +- drivers/nfc/fdp/i2c.c | 27 +++ drivers/nfc/microread/microread.c | 31 ++- drivers/nfc/pn533/pn533.c | 1 + drivers/nfc/st21nfca/dep.c | 3 + drivers/nvme/target/fc.c | 2 +- drivers/nvme/target/tcp.c | 5 +- drivers/pci/controller/pci-host-generic.c | 11 +- drivers/pci/ecam.c | 13 ++ drivers/s390/cio/vfio_ccw_async.c | 16 ++ drivers/s390/cio/vfio_ccw_chp.c | 31 ++- drivers/s390/cio/vfio_ccw_cp.c | 31 ++- drivers/s390/cio/vfio_ccw_drv.c | 14 +- drivers/s390/cio/vfio_ccw_ops.c | 15 +- drivers/s390/cio/vfio_ccw_private.h | 7 +- drivers/tty/serial/amba-pl011.c | 8 +- fs/ext4/xattr.c | 7 +- fs/iomap/buffered-io.c | 19 +- fs/ocfs2/xattr.c | 18 +- fs/xfs/libxfs/xfs_attr_leaf.c | 14 ++ fs/xfs/xfs_buf_item_recover.c | 53 +++-- include/linux/can/core.h | 1 + include/linux/can/skb.h | 3 - include/linux/kvm_host.h | 60 +++--- include/linux/netdevice.h | 6 +- include/linux/pci-ecam.h | 3 + include/net/sch_generic.h | 1 + kernel/events/core.c | 121 +++++------ mm/huge_memory.c | 52 +++-- net/bluetooth/rfcomm/core.c | 24 ++- net/can/af_can.c | 14 +- net/can/bcm.c | 2 - net/can/isotp.c | 320 +++++++++++++++++++++-------- net/can/j1939/socket.c | 1 - net/can/j1939/transport.c | 2 - net/can/raw.c | 7 +- net/ceph/osd_client.c | 5 +- net/ipv4/inet_fragment.c | 6 +- net/ipv4/ip_output.c | 4 + net/ipv6/ip6_output.c | 2 + net/mptcp/options.c | 57 +++++ net/mptcp/pm_netlink.c | 39 ++-- net/mptcp/protocol.h | 1 + net/nfc/digital_technology.c | 2 + net/nfc/llcp_commands.c | 18 +- net/nfc/llcp_core.c | 15 +- net/nfc/nci/ntf.c | 10 +- net/nfc/nci/rsp.c | 1 + net/packet/af_packet.c | 65 ++++-- net/sched/sch_api.c | 9 + net/xfrm/xfrm_state.c | 4 +- sound/drivers/dummy.c | 6 + sound/soc/codecs/lpass-tx-macro.c | 4 +- virt/kvm/kvm_main.c | 49 ++--- 80 files changed, 1314 insertions(+), 526 deletions(-)

2 months

[PATCH 5.10 00/57] 5.10.267-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 5.10.267 release. There are 57 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 27 Aug 2026 13:25:02 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.267-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 5.10.267-rc1 Michael Bommarito <michael.bommarito(a)gmail.com> HID: hyperv: validate initial device info bounds Haoxiang Li <haoxiang_li2024(a)163.com> HID: sensor: custom: Fix use-after-free in enable_sensor Jann Horn <jannh(a)google.com> HID: core: fix number/pointer type confusion on long items Oliver Hartkopp <socketcan(a)hartkopp.net> can: isotp: fix timer drain order, wakeup handling and tx_gen ordering Oliver Hartkopp <socketcan(a)hartkopp.net> can: use skb hash instead of private variable in headroom Weiming Shi <bestswngs(a)gmail.com> bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Free all memory if cp_init() fails Joanne Koong <joannelkoong(a)gmail.com> iomap: adjust read range correctly for non-block-aligned positions Xiang Mei (Microsoft) <xmei5(a)asu.edu> xfrm: fix sk_dst_cache double-free in xfrm_user_policy() Sasha Levin <sashal(a)kernel.org> Revert "Input: ims-pcu - fix race condition in reset_device sysfs callback" Baul Lee <baul.lee(a)xbow.com> HID: core: fix OOB read of field->usage in hid_set_field() Lee Jones <lee(a)kernel.org> HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID Pavitra Jha <jhapavitra98(a)gmail.com> libceph: fix OOB read in decode_watchers() via missing bounds check Junjie Cao <junjie.cao(a)intel.com> gpio: ml-ioh: use raw_spinlock_t for the register lock Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations Jiang HongHui <jiang_hh2019(a)163.com> nvmet-fc: fix invalid free in LS IOD error path Luxiao Xu <rakukuip(a)gmail.com> ipv6: fix use-after-free in ip6_finish_output2() Yong Wang <edragain(a)163.com> ipv4: reject undersized MTUs in ip_do_fragment() Ibrahim Hashimov <security(a)auditcode.ai> xfs: bounds-check buffer log item's dirty bitmap Linmao Li <lilinmao(a)kylinos.cn> nfc: nci: free destination parameters when closing a connection Samuel Page <sam(a)bynar.io> nfc: nci: fix out-of-bounds write in nci_target_auto_activated() Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: st21nfca: validate ATR_REQ length against the received frame Xu Rao <raoxu(a)uniontech.com> nfc: pn533: purge fragmented skbs during cleanup Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: llcp: reject PDUs shorter than the LLCP header Muhammad Bilal <meatuni001(a)gmail.com> nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: llcp: bound the connect_sn TLV walk to the skb Pengpeng Hou <pengpeng(a)iscas.ac.cn> nfc: microread: validate target discovery payload lengths Bryam Vargas <hexlabsecurity(a)proton.me> nfc: fdp: bound the device-reported read length and fix an skb leak Doruk Tan Ozturk <doruk(a)0sec.ai> nfc: digital: clamp SENSF_RES length to the destination buffer David Matlack <dmatlack(a)google.com> KVM: arm64: Retry fault if vma_lookup() results become invalid Eric Farman <farman(a)linux.ibm.com> s390/vfio_ccw: Cancel existing workqueues Pei Xiao <xiaopei01(a)kylinos.cn> mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition Long Li <leo.lilong(a)huawei.com> xfs: fix ilock leak on error in xfs_dq_get_next_id Zhiling Zou <zhilinz(a)nebusec.ai> inet: frags: publish queues before arming timer Zihan Xi <zihanx(a)nebusec.ai> packet: synchronize pressure clearing with ring reconfiguration Zijie Huang <milkory(a)outlook.com> net/sched: reject overly deep qdisc hierarchies Qihang Tang <q.h.hack.winter(a)gmail.com> packet: use consistent hard_header_len in TX_RING send path Qihang Tang <q.h.hack.winter(a)gmail.com> packet: use consistent hard_header_len in non-ring send paths Aditya Chillara <aditya.chillara(a)oss.qualcomm.com> perf/core: Fix group leader use-after-free after sibling detach Yeoreum Yun <yeoreum.yun(a)arm.com> perf: Fix dangling cgroup pointer in cpuctx Peter Zijlstra <peterz(a)infradead.org> perf: Fix cgroup state vs ERROR Fan Wu <fanwu01(a)zju.edu.cn> serial: amba-pl011: synchronize DMA teardown Koichiro Den <den(a)valinux.co.jp> NTB: ntb_netdev: Preserve RX queue depth on allocation failure Zihan Xi <zihanx(a)nebusec.ai> ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops Amit Cohen <amcohen(a)nvidia.com> net: ipv4: Publish fib_nlmsg_size() Ekansh Gupta <ekansh.gupta(a)oss.qualcomm.com> misc: fastrpc: Remove buffer from list prior to unmap operation Abel Vesa <abel.vesa(a)linaro.org> misc: fastrpc: Rework fastrpc_req_munmap Srinivas Kandagatla <srinivas.kandagatla(a)linaro.org> misc: fastrpc: separate fastrpc device from channel context Muhammad Bilal <meatuni001(a)gmail.com> staging: rtl8723bs: fix OOB read in WMM_param_handler() Lorenzo Stoakes (ARM) <ljs(a)kernel.org> mm/huge_memory: fix huge_zero_pfn race Baul Lee <baul.lee(a)xbow.com> net/x25: fix use-after-free of the socket by its timers Hongling Zeng <zenghongling(a)kylinos.cn> xfs: validate attr entry pointer before field access Guanghui Yang <3497809730(a)qq.com> ext4: clear error before retrying inode xattr space fallback Matthias Goergens <matthias.goergens(a)gmail.com> ext4: stop retrying saturated xattr cache entries Ian Bridges <icb(a)fastmail.org> ocfs2: fix missing metadata reservation for large xattrs Griffin Kroah-Hartman <griffin(a)kroah.com> rndis_host: add overflow check in rndis_rx_fixup() Ali Ahmet Memis <ali(a)iusegentoo.com> Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept ------------- Diffstat: Makefile | 4 +- arch/arm64/kvm/mmu.c | 42 ++-- drivers/gpio/gpio-ml-ioh.c | 36 +-- drivers/hid/hid-core.c | 11 +- drivers/hid/hid-hyperv.c | 27 ++- drivers/hid/hid-magicmouse.c | 16 ++ drivers/hid/hid-sensor-custom.c | 21 +- drivers/input/misc/ims-pcu.c | 2 - drivers/misc/fastrpc.c | 110 ++++++--- drivers/mmc/host/atmel-mci.c | 2 + drivers/net/can/dev/dev.c | 2 - drivers/net/can/slcan.c | 1 - drivers/net/ntb_netdev.c | 15 +- drivers/net/usb/rndis_host.c | 6 +- drivers/nfc/fdp/i2c.c | 27 +++ drivers/nfc/microread/microread.c | 31 ++- drivers/nfc/pn533/pn533.c | 1 + drivers/nfc/st21nfca/dep.c | 3 + drivers/nvme/target/fc.c | 2 +- drivers/nvme/target/tcp.c | 5 +- drivers/s390/cio/vfio_ccw_cp.c | 22 +- drivers/s390/cio/vfio_ccw_drv.c | 7 + drivers/s390/cio/vfio_ccw_ops.c | 8 + drivers/staging/rtl8723bs/core/rtw_wlan_util.c | 3 + drivers/tty/serial/amba-pl011.c | 8 +- fs/ext4/xattr.c | 7 +- fs/iomap/buffered-io.c | 19 +- fs/ocfs2/xattr.c | 18 +- fs/xfs/libxfs/xfs_attr_leaf.c | 14 ++ fs/xfs/xfs_buf_item_recover.c | 53 ++-- fs/xfs/xfs_dquot.c | 3 +- include/linux/can/core.h | 1 + include/linux/can/dev.h | 1 - include/linux/can/skb.h | 2 - include/linux/netdevice.h | 6 +- include/net/sch_generic.h | 1 + kernel/events/core.c | 104 ++++---- mm/huge_memory.c | 52 ++-- net/bluetooth/rfcomm/core.c | 24 +- net/can/af_can.c | 14 +- net/can/bcm.c | 2 - net/can/isotp.c | 320 ++++++++++++++++++------- net/can/j1939/socket.c | 1 - net/can/j1939/transport.c | 2 - net/can/raw.c | 7 +- net/ceph/osd_client.c | 5 +- net/ipv4/fib_lookup.h | 1 + net/ipv4/fib_semantics.c | 69 ++++-- net/ipv4/inet_fragment.c | 6 +- net/ipv4/ip_output.c | 4 + net/ipv6/ip6_output.c | 2 + net/nfc/digital_technology.c | 2 + net/nfc/llcp_commands.c | 18 +- net/nfc/llcp_core.c | 15 +- net/nfc/nci/ntf.c | 6 + net/nfc/nci/rsp.c | 1 + net/packet/af_packet.c | 65 +++-- net/sched/sch_api.c | 9 + net/x25/af_x25.c | 4 +- net/x25/x25_timer.c | 25 +- net/xfrm/xfrm_state.c | 4 +- tools/lib/bpf/libbpf.c | 2 + 62 files changed, 909 insertions(+), 392 deletions(-)

2 months

← Newer
1
...
5
6
7
8
9
10
11
...
3317
Older →

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

Lkft-triage