This is the start of the stable review cycle for the 5.10.266 release. There are 235 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Responses should be made by Sat, 22 Aug 2026 14:51:11 +0000. Anything received after that time might be too late.

The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.266-rc... or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y and the diffstat can be found below.

thanks,

greg k-h

------------- Pseudo-Shortlog of commits:

Greg Kroah-Hartman gregkh@linuxfoundation.org Linux 5.10.266-rc1

Johan Hovold johan@kernel.org USB: serial: keyspan_pda: fix information leak

Zhang Changzhong zhangchangzhong@huawei.com net: ethernet: ti: am65-cpsw: fix error handling in am65_cpsw_nuss_probe()

Andy Shevchenko andriy.shevchenko@linux.intel.com i2c: smbus: Check for parent device before dereference

Robert Mader robert.mader@collabora.com udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf()

Christian Brauner brauner@kernel.org binfmt_misc: use exe_file_deny_write_access() for the interpreter clone

Daming Li d4n.for.sec@gmail.com net: smc: fix splice entry lifetime imbalance in smc_rx_splice

Guangguan Wang guangguan.wang@linux.alibaba.com net/smc: rdma write inline if qp has sufficient inline space

Siddharth Vadapalli s-vadapalli@ti.com net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG

Grygorii Strashko grygorii.strashko@ti.com net: ethernet: ti: am65-cpsw: add multi port support in mac-only mode

Grygorii Strashko grygorii.strashko@ti.com net: ethernet: ti: am65-cpsw: move free desc queue mode selection in pdata

Grygorii Strashko grygorii.strashko@ti.com net: ethernet: ti: am65-cpsw: move ale selection in pdata

Eric Dumazet edumazet@google.com af_packet: Don't send zero-byte data in tpacket_snd().

Rosen Penev rosenp@gmail.com ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers

Wei Fang wei.fang@nxp.com net: packet: fix wrong transport_header when sending VLAN-tagged frame

Florian Westphal fw@strlen.de netfilter: ipset: fix list type element drift bug

Jérémy Jean Jeremy.Jean@oss.cyber.gouv.fr netfilter: flowtable: publish GC-visible tuple last

Alexey Velichayshiy a.velichayshiy@ispras.ru netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path

Xiang Mei (Microsoft) xmei5@asu.edu netfilter: ipset: fix refcount race between list:set GC and swap

Herbert Xu herbert@gondor.apana.org.au crypto: ccm - Set rfc4309 maxauthsize from child

Jon Hunter jonathanh@nvidia.com arm64: tegra: Add EL2 virtual timer interrupt for Tegra194

Yangyu Chen cyy@cyyself.name net: atlantic: free stranded TX buffers on ring deinit

Lorenzo Stoakes (ARM) ljs@kernel.org mm/ptdump: always stabilise against page table freeing using init_mm

Hyunjung Ko hj351016@gmail.com net/sched: act_gact, act_police: range check the fallback control action

Tejun Heo tj@kernel.org sched/psi: Shut down rtpoll_timer in psi_cgroup_free()

Baul Lee baul.lee@xbow.com ALSA: usx2y: bound the hwdep mmap fault offset

Takashi Iwai tiwai@suse.de ALSA: usx2y: Fix potential leaks of uninitialized memory

Yang Wang kevinyang.wang@amd.com drm/amd/pm: fix torn gpu metrics reads

Hongyan Xu getshell@seu.edu.cn hwmon: (npcm750-pwm-fan): stop fan timer on device detach

Marc Kleine-Budde mkl@pengutronix.de can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure

Christian Brauner brauner@kernel.org binfmt_misc: restore write access when removing an entry

Amir Goldstein amir73il@gmail.com fs: don't block write during exec on pre-content watched files

Amir Goldstein amir73il@gmail.com fsnotify: opt-in for permission events at file open time

Jonas Gorski jonas.gorski@bisdn.de i2c: iproc: reset bus after timeout if START_BUSY is stuck

Wolfram Sang wsa+renesas@sang-engineering.com i2c: bcm-iproc: remove printout on handled timeouts

Dawei Feng dawei.feng@seu.edu.cn ice: fix memory leak in ice_lbtest_prepare_rings()

Dawid Osuchowski dawid.osuchowski@linux.intel.com ice: fix VF interrupts cleanup

Ibrahim Hashimov security@auditcode.ai scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write

Damien Le Moal damien.lemoal@opensource.wdc.com scsi: scsi_debug: Rename zone type constants

Damien Le Moal damien.lemoal@opensource.wdc.com scsi: sd: sd_zbc: Return early in sd_zbc_check_zoned_characteristics()

Damien Le Moal damien.lemoal@opensource.wdc.com scsi: sd: sd_zbc: Use logical blocks as unit when querying zones

Bart Van Assche bvanassche@acm.org scsi: sd: sd_zbc: Improve source code documentation

Chengfeng Ye nicoyip.dev@gmail.com net: pktgen: fix proc entry use-after-free

Peter Seiderer ps.report@gmx.net net: pktgen: fix code style (WARNING: Block comments)

Gregory Price gourry@gourry.net mm/vmstat: fold stranded per-cpu node stats when a node comes online

Sangho Lee kudo3228@gmail.com Bluetooth: HIDP: reject frames without a transaction header

Luiz Augusto von Dentz luiz.von.dentz@intel.com skbuff: introduce skb_pull_data

Tengda Wu wutengda@huaweicloud.com ftrace: Add global mutex to serialize trace_parser access

Christian Brauner brauner@kernel.org super: fix emergency thaw deadlock on frozen block devices

Shiming Cheng shiming.cheng@mediatek.com net: gro: fix double aggregation of flush-marked skbs

Aldo Ariel Panzardo qwe.aldo@gmail.com net/sched: serialize qdisc_rtab_list against concurrent get/put

Max Kellermann max.kellermann@ionos.com ceph: fix hanging __ceph_get_caps() with stale mds_wanted

Xiubo Li xiubli@redhat.com ceph: rename _to_client() to _to_fs_client()

Xiubo Li xiubli@redhat.com libceph: add doutc and *_client debug macros support

Pavitra Jha jhapavitra98@gmail.com libceph: fix two unsafe bare decodes in decode_lockers()

Xiang Mei xmei5@asu.edu libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE

Andy Shevchenko andriy.shevchenko@linux.intel.com libceph: Amend checking to fix `make W=1` build breakage

Max Kellermann max.kellermann@ionos.com ceph: avoid fs reclaim while using current->journal_info

Zhiling Zou roxy520tt@gmail.com sctp: avoid auth_enable sysctl UAF during netns teardown

Chenguang Zhao zhaochenguang@kylinos.cn mptcp: decrement subflows counter on failed passive join

Paolo Abeni pabeni@redhat.com mptcp: fix subflow accounting on close

Hugo Villeneuve hvilleneuve@dimonoff.com serial: sc16is7xx: implement gpio get_direction() callback

Hugo Villeneuve hvilleneuve@dimonoff.com serial: sc16is7xx: fix regression with GPIO configuration

Hugo Villeneuve hvilleneuve@dimonoff.com serial: sc16is7xx: remove obsolete out_thread label

Ilpo Järvinen ilpo.jarvinen@linux.intel.com serial: sc16is7xx: Fill in rs485_supported

Tomasz Moń tomasz.mon@camlingroup.com sc16is7xx: Properly resume TX after stop

Michael Bommarito michael.bommarito@gmail.com mptcp: only set DATA_FIN when a mapping is present

Jiangshan Yi yijiangshan@kylinos.cn serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms

Andy Shevchenko andriy.shevchenko@linux.intel.com serial: 8250_mid: Remove unneeded test for ->setup() presence

Norbert Szetei norbert@doyensec.com ALSA: seq: close a re-opened queue timer in the destructor

Fan Wu fanwu01@zju.edu.cn wifi: brcmfmac: drain bus_reset work on device removal

Mirela Rabulea mirela.rabulea@nxp.com media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor()

Sakari Ailus sakari.ailus@linux.intel.com media: v4l: async: Set owner for async sub-devices

Daniel Hodges git@danielhodges.dev wifi: ath6kl: fix use-after-free in aggr_reset_state()

Sakari Ailus sakari.ailus@linux.intel.com media: imx219: Fix maximum frame length in lines

Jai Luthra jai.luthra@ideasonboard.com media: i2c: imx219: Rename VTS to FRM_LENGTH

David Plowman david.plowman@raspberrypi.com media: i2c: imx219: Correct the minimum vblanking value

Laurent Pinchart laurent.pinchart@ideasonboard.com media: i2c: imx219: Drop IMX219_VTS_* macros

Guangshuo Li lgs201920130244@gmail.com media: marvell-cam: fix missing pci_disable_device() on remove

Jani Nikula jani.nikula@intel.com drm/i915/hdcp: require monotonically increasing seq_num_v

David Carlier devnexen@gmail.com media: aspeed: fix missing of_reserved_mem_device_release() on probe failure

Bryam Vargas hexlabsecurity@proton.me drm/virtio: bound EDID block reads to the response buffer

Dmitry Osipenko dmitry.osipenko@collabora.com drm/virtio: Return proper error codes instead of -1

Thomas Zimmermann tzimmermann@suse.de drm/tegra: fbdev: Remove offset into framebuffer memory

Jani Nikula jani.nikula@intel.com drm/displayid: fix Tiled Display Topology ID size

Deepanshu Kartikey kartikey406@gmail.com drm/virtio: use uninterruptible resv lock for plane updates

Christian König christian.koenig@amd.com dma-buf/drivers: make reserving a shared slot mandatory v4

Ashutosh Desai ashutoshdesai993@gmail.com drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers

Ashutosh Desai ashutoshdesai993@gmail.com drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers

Cen Zhang zzzccc427@gmail.com usb: gadget: f_tcm: synchronize delayed set_alt with teardown

Ashutosh Desai ashutoshdesai993@gmail.com drm/dp/mst: fix buffer overflows in sideband chunk accumulation

Venkatesh Srinivas venkateshs@chromium.org KVM: x86: Only reset TSC Deadline Timer in apic_timer_expired on KVM_RUN

David Matlack dmatlack@google.com KVM: Introduce vcpu->wants_to_run

Sean Christopherson seanjc@google.com KVM: x86: Move "apicv_active" into "struct kvm_lapic"

Sean Christopherson seanjc@google.com KVM: x86: Check for in-kernel xAPIC when querying APICv for directed yield

Sean Christopherson seanjc@google.com KVM: x86: Drop @vcpu parameter from kvm_x86_ops.hwapic_isr_update()

Johan Hovold johan@kernel.org USB: serial: keyspan_pda: fix data loss on receive throttling

Johan Hovold johan@kernel.org USB: serial: keyspan_pda: clean up comments and whitespace

Johan Hovold johan@kernel.org USB: serial: keyspan_pda: add write-fifo support

Johan Hovold johan@kernel.org USB: serial: keyspan_pda: fix write implementation

Johan Hovold johan@kernel.org USB: serial: keyspan_pda: refactor write-room handling

Fan Wu fanwu01@zju.edu.cn usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown

Chunfeng Yun chunfeng.yun@mediatek.com usb: gadget: bdc: fix checkpatch.pl spacing error

Reinette Chatre reinette.chatre@intel.com fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list

Dawei Feng dawei.feng@seu.edu.cn octeontx2-pf: fix SQB pointer leak on init failure

Haoxiang Li haoxiang_li2024@163.com net: ipa: fix SMEM state handle leaks in SMP2P init

Sabrina Dubroca sd@queasysnail.net espintcp: use sk_msg_free_partial to fix partial send

Breno Leitao leitao@debian.org bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline()

Breno Leitao leitao@debian.org bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c

Rasmus Villemoes linux@rasmusvillemoes.dk bootconfig: do not put quotes on cmdline items unless necessary

Runyu Xiao runyu.xiao@seu.edu.cn gpio: tegra: do not call pinctrl for GPIO direction

Bryam Vargas hexlabsecurity@proton.me net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked

Vladimir Oltean vladimir.oltean@nxp.com net/sched: taprio: avoid calling child->ops->dequeue(child) twice

Maoyi Xie maoyixie.tju@gmail.com net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink

Maoyi Xie maoyixie.tju@gmail.com net: ipip: require CAP_NET_ADMIN in the device netns for changelink

Liu Jian liujian56@huawei.com net: Add helper function to parse netlink msg of ip_tunnel_encap

Dmitry Torokhov dmitry.torokhov@gmail.com Input: ims-pcu - fix firmware leak in async update

Dmitry Torokhov dmitry.torokhov@gmail.com firmware_loader: introduce __free() cleanup hanler

Guangshuo Li lgs201920130244@gmail.com mmc: vub300: fix use-after-free on probe failure

Johan Hovold johan@kernel.org mmc: vub300: rename probe error labels

Johan Hovold johan@kernel.org mmc: vub300: fix use-after-free on disconnect

Maoyi Xie maoyixie.tju@gmail.com wifi: libertas_tf: fix use-after-free in lbtf_free_adapter()

Dmitry Torokhov dmitry.torokhov@gmail.com Input: ims-pcu - fix race condition in reset_device sysfs callback

Mikulas Patocka mpatocka@redhat.com dm-verity: make error counter atomic

Mikulas Patocka mpatocka@redhat.com dm-integrity: don't increment hash_offset twice

Bryam Vargas hexlabsecurity@proton.me scsi: target: Bound PR-OUT TransportID parsing to the received buffer

Maurizio Lombardi mlombard@redhat.com scsi: target: core: Generate correct identifiers for PR OUT transport IDs

Chaitanya Kulkarni chaitanya.kulkarni@wdc.com scsi: target: core: pr: Initialize arrays at declaration time

Souvik Banerjee souvik@amlalabs.com ovl: use linked upper dentry in copy-up tmpfile

Abdun Nihaal nihaal@cse.iitm.ac.in scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup()

Michael Bommarito michael.bommarito@gmail.com thunderbolt: Prevent XDomain delayed work use-after-free on disconnect

Mika Westerberg mika.westerberg@linux.intel.com thunderbolt: Remove XDomain from the bus without holding tb->lock

Mika Westerberg mika.westerberg@linux.intel.com thunderbolt: Keep XDomain reference during the lifetime of a service

Vincent Jardin vjardin@free.fr i2c: imx: fix locked bus on SMBus block-read of 0 (atomic)

Stefan Eichenberger stefan.eichenberger@toradex.com i2c: imx: separate atomic, dma and non-dma use case

Frank Li Frank.Li@nxp.com dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK

Frank Li Frank.Li@nxp.com dmaengine: dw-edma: Remove unused irq field in struct dw_edma_chip

Gustavo Pimentel Gustavo.Pimentel@synopsys.com dmaengine: dw-edma: Improve the linked list and data blocks definition

Gustavo Pimentel Gustavo.Pimentel@synopsys.com PCI: Add pci_find_vsec_capability() to find a specific VSEC

Jarkko Sakkinen jarkko@kernel.org tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat()

Fredric Cover fredric.cover.lkernel@gmail.com smb: client: use kvzalloc() for megabyte buffer in simple fallocate

Miquel Raynal miquel.raynal@bootlin.com mtd: spi-nor: swp: Improve locking user experience

Michael Walle mwalle@kernel.org mtd: spi-nor: Fix spi_nor_try_unlock_all()

Tudor Ambarus tudor.ambarus@microchip.com mtd: spi-nor: Move Software Write Protection logic out of the core

Michael Walle michael@walle.cc mtd: spi-nor: intel: remove global protection flag

Michael Walle michael@walle.cc mtd: spi-nor: sst: remove global protection flag

Yiyang Chen cyyzero16@gmail.com taskstats: retain dead thread stats in TGID queries

Oleg Nesterov oleg@redhat.com taskstats: fill_stats_for_tgid: use for_each_thread()

Maoyi Xie maoyixie.tju@gmail.com net: thunderbolt: Fix frags[] overflow by bounding frame_count

Florian Fuchs fuchsfl@gmail.com mtd: maps: vmu-flash: fix fault in unaligned fixup

Breno Leitao leitao@debian.org 9p: skip nlink update in cacheless mode to fix WARN_ON

Vasiliy Kovalev kovalev@altlinux.org net/9p: fix infinite loop in p9_client_rpc on fatal signal

Tristan Madani tristan@talencesecurity.com selinux: avoid sk_socket dereference in selinux_sctp_bind_connect()

Casey Schaufler casey@schaufler-ca.com lsm: infrastructure management of the sock security

Ondrej Mosnacek omosnace@redhat.com lsm: use default hook return value in call_int_hook()

Florian Westphal fw@strlen.de netfilter: nft_set_pipapo: don't leak bad clone into future transaction

Florian Westphal fw@strlen.de netfilter: nft_set_pipapo: move cloning of match info to insert/removal path

Florian Westphal fw@strlen.de netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone

Florian Westphal fw@strlen.de netfilter: nft_set_pipapo: merge deactivate helper into caller

Florian Westphal fw@strlen.de netfilter: nft_set_pipapo: prepare walk function for on-demand clone

Florian Westphal fw@strlen.de netfilter: nft_set_pipapo: make pipapo_clone helper return NULL

Florian Westphal fw@strlen.de netfilter: nft_set_pipapo: use GFP_KERNEL for insertions

Junrui Luo moonafterrain@outlook.com jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit()

Harshad Shirwadkar harshadshirwadkar@gmail.com jbd2: add a helper to find out number of fast commit blocks

Pablo Neira Ayuso pablo@netfilter.org netfilter: nf_conntrack_sip: validate skb_dst() before accessing it

Florian Westphal fw@strlen.de netfilter: nf_conntrack_sip: remove net variable shadowing

Runyu Xiao runyu.xiao@seu.edu.cn octeontx2-vf: clear stale mailbox IRQ state before request_irq()

Cássio Gabriel cassiogabrielcontato@gmail.com ASoC: mediatek: mt8183: Check runtime resume during probe

Runyu Xiao runyu.xiao@seu.edu.cn octeontx2-pf: clear stale mailbox IRQ state before request_irq()

Subbaraya Sundeep sbhatta@marvell.com octeontx2: Annotate mmio regions as __iomem

Wentao Liang vulab@iscas.ac.cn mlxsw: fix refcount leak in mlxsw_sp_port_lag_join()

Petr Machata petrm@nvidia.com mlxsw: spectrum: On port enslavement to a LAG, join upper's bridges

Ido Schimmel idosch@nvidia.com mlxsw: spectrum: Apply RIF configuration when joining a LAG

David Howells dhowells@redhat.com rxrpc: Fix socket notification race

David Howells dhowells@redhat.com rxrpc: Fix notification vs call-release vs recvmsg

David Howells dhowells@redhat.com rxrpc: Fix recv-recv race of completed call

Li Xiasong lixiasong1@huawei.com tipc: restrict socket queue dumps in enqueue tracepoints

Li Daming d4n.for.sec@gmail.com rxrpc: serialize kernel accept preallocation with socket teardown

Tapio Reijonen tapio.reijonen@vaisala.com serial: max310x: implement gpio_chip::get_direction()

Hugo Villeneuve hvilleneuve@dimonoff.com serial: max310x: replace bare use of 'unsigned' with 'unsigned int' (checkpatch)

Xu Rao raoxu@uniontech.com ALSA: hda: Fix cached processing coefficient verbs

Ricardo Robaina rrobaina@redhat.com audit: fix recursive locking deadlock in audit_dupe_exe()

Ricardo Robaina rrobaina@redhat.com audit: use 'unsigned int' instead of 'unsigned'

Jeff Layton jlayton@kernel.org audit: widen ino fields to u64

NeilBrown neil@brown.name VFS/audit: introduce kern_path_parent() for audit

Bryam Vargas hexlabsecurity@proton.me Input: mms114 - reject an oversized device packet size

Zhenhao Wan whi4ed0g@gmail.com RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg

Akhil R akhilrajeev@nvidia.com i2c: smbus: Use device_*() functions instead of of_*()

Akhil R akhilrajeev@nvidia.com device property: Add fwnode_irq_get_byname

Haoxiang Li haoxiang_li2024@163.com i2c: davinci: Unregister cpufreq notifier on probe failure

Sebastian Alba Vives sebasjosue84@gmail.com fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()

Mikhail Gavrilov mikhail.v.gavrilov@gmail.com dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning

Jason Gunthorpe jgg@ziepe.ca udmabuf: Do not create malformed scatterlists

Matt Bobrowski mattbobrowski@google.com bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized

Chao Yu chao@kernel.org f2fs: fix UAF issue in f2fs_merge_page_bio()

Xiang Mei xmei5@asu.edu net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot

Christoph Hellwig hch@lst.de xfs: check v5 superblock features early

David Rosca david.rosca@amd.com drm/amdgpu: Fix UVD decode image min size calculation

David Rosca david.rosca@amd.com drm/amdgpu: Implement insert_end for VCE 3

David Rosca david.rosca@amd.com drm/amdgpu: Reject UVD message with dimensions above 4096

Candice Li candice.li@amd.com drm/amdgpu: validate GEM_CREATE domain combinations

David Rosca david.rosca@amd.com drm/amdgpu: Reject UVD message with invalid number of h265 refs

Eric Farman farman@linux.ibm.com s390/vfio_ccw: Fix out of bounds check on CCW array

Guangshuo Li lgs201920130244@gmail.com drm/radeon: fix autosuspend cleanup during teardown

Pei Xiao xiaopei01@kylinos.cn mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition

Haibo Chen haibo.chen@nxp.com mmc: sdhci: make tuning_err a signed int

Myeonghun Pak mhun512@gmail.com mmc: sdhci: unmap the bounce buffer before device release

Zhan Xusheng zhanxusheng1024@gmail.com mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit

Yiming Zhu zhuyiming@kuaishou.com ceph: fix MDS random selection readiness predicate

Raphael Zimmer raphael.zimmer@tu-ilmenau.de libceph: Avoid using invalid osd indices from primary_temp

Dmitry Torokhov dmitry.torokhov@gmail.com Input: sur40 - fix V4L error path cleanup

Dmitry Torokhov dmitry.torokhov@gmail.com Input: sur40 - fix input device registration ordering

Ali Ahmet Memis ali@iusegentoo.com openrisc: signal: do not restore privileged SR bits on sigreturn

Josh Poimboeuf jpoimboe@kernel.org ftrace: Fix off-by-one fentry site disable in ftrace_free_mem()

Pavitra Jha jhapavitra98@gmail.com libceph: fix multiple unsafe decodes in decode_locker()

Thorsten Blum thorsten.blum@linux.dev crypto: qce - fix error path in devm_qce_register_algs

Dmitry Torokhov dmitry.torokhov@gmail.com Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue

Dmitry Torokhov dmitry.torokhov@gmail.com Input: synaptics-rmi4 - block s_input when F54 queue is busy

Bryam Vargas hexlabsecurity@proton.me Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer

Dmitry Torokhov dmitry.torokhov@gmail.com Input: synaptics-rmi4 - zero report size on F54 work error

George Wilson gcwilson@linux.ibm.com powerpc/pseries: lparcfg - fix kbuf[] underflow

Pengpeng Hou pengpeng@iscas.ac.cn Input: iforce - validate input packet lengths

Zhefu Zhang a723356@gmail.com Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard

Linmao Li lilinmao@kylinos.cn Input: psxpad-spi - set driver data before use

Richard Davies richard@arachsys.com Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet

Dmitry Torokhov dmitry.torokhov@gmail.com Input: synaptics-rmi4 - fix F55 transmitter electrode count typo

George Wilson gcwilson@linux.ibm.com powerpc/pseries: pci - logic bug

Peter Ujfalusi peter.ujfalusi@linux.intel.com ASoC: cs4265: sort the register default table

Hidayath Khan hidayath@linux.ibm.com s390/qeth: validate user buffer length in SNMP and ARP query ioctls

Matthieu Baerts (NGI0) matttbe@kernel.org mptcp: options: reset DSS fields in case of unexpected size

Bryam Vargas hexlabsecurity@proton.me selinux: do not cancel a policy conversion that never started

Bryam Vargas hexlabsecurity@proton.me selinux: reject a class permission count below its inherited common

Bryam Vargas hexlabsecurity@proton.me selinux: require every boolean value to be defined

Yizhou Zhao zhaoyz24@mails.tsinghua.edu.cn ipvs: separate destination availability state

Jiasheng Jiang jiashengjiangcool@gmail.com media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization

Fullway Wang fullwaywang@outlook.com media: mtk-vcodec: potential null pointer deference in SCP

-------------

Diffstat:

Makefile | 4 +- arch/arm64/boot/dts/nvidia/tegra194.dtsi | 2 + arch/arm64/kvm/arm.c | 2 +- arch/mips/kvm/mips.c | 2 +- arch/openrisc/include/asm/processor.h | 2 + arch/openrisc/kernel/signal.c | 5 +- arch/powerpc/kvm/powerpc.c | 2 +- arch/powerpc/platforms/pseries/lparcfg.c | 2 +- arch/powerpc/platforms/pseries/pci.c | 2 +- arch/s390/kvm/kvm-s390.c | 2 +- arch/x86/include/asm/kvm_host.h | 3 +- arch/x86/kernel/cpu/resctrl/rdtgroup.c | 12 +- arch/x86/kvm/lapic.c | 41 +- arch/x86/kvm/lapic.h | 3 +- arch/x86/kvm/svm/avic.c | 4 +- arch/x86/kvm/svm/svm.h | 2 +- arch/x86/kvm/vmx/vmx.c | 9 +- arch/x86/kvm/x86.c | 19 +- crypto/ccm.c | 2 +- drivers/base/property.c | 29 ++ drivers/char/tpm/tpm_tis_core.c | 38 +- drivers/crypto/qce/core.c | 2 +- drivers/dma-buf/dma-resv.c | 8 +- drivers/dma-buf/udmabuf.c | 21 +- drivers/dma/dw-edma/dw-edma-core.c | 77 ++-- drivers/dma/dw-edma/dw-edma-core.h | 20 +- drivers/dma/dw-edma/dw-edma-pcie.c | 180 ++++++-- drivers/dma/dw-edma/dw-edma-v0-core.c | 76 ++-- drivers/fpga/dfl-afu-main.c | 3 + drivers/gpio/gpio-tegra.c | 18 +- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 21 + drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 11 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 2 +- drivers/gpu/drm/amd/amdgpu/vce_v3_0.c | 26 +- drivers/gpu/drm/amd/pm/amdgpu_pm.c | 14 +- drivers/gpu/drm/drm_connector.c | 12 +- drivers/gpu/drm/drm_dp_mst_topology.c | 32 +- drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c | 2 +- drivers/gpu/drm/i915/display/intel_hdcp.c | 7 +- drivers/gpu/drm/i915/i915_vma.c | 2 +- drivers/gpu/drm/lima/lima_gem.c | 2 +- drivers/gpu/drm/msm/msm_gem_submit.c | 2 +- drivers/gpu/drm/nouveau/nouveau_fence.c | 2 +- drivers/gpu/drm/qxl/qxl_release.c | 2 +- drivers/gpu/drm/radeon/radeon_kms.c | 1 + drivers/gpu/drm/radeon/radeon_vm.c | 2 +- drivers/gpu/drm/tegra/fb.c | 8 +- drivers/gpu/drm/ttm/ttm_bo.c | 4 +- drivers/gpu/drm/ttm/ttm_execbuf_util.c | 4 +- drivers/gpu/drm/vc4/vc4_gem.c | 2 +- drivers/gpu/drm/vgem/vgem_fence.c | 2 +- drivers/gpu/drm/virtio/virtgpu_drv.h | 1 + drivers/gpu/drm/virtio/virtgpu_gem.c | 17 + drivers/gpu/drm/virtio/virtgpu_plane.c | 5 +- drivers/gpu/drm/virtio/virtgpu_vq.c | 9 +- drivers/hwmon/npcm750-pwm-fan.c | 11 + drivers/i2c/busses/i2c-bcm-iproc.c | 11 +- drivers/i2c/busses/i2c-davinci.c | 4 +- drivers/i2c/busses/i2c-imx.c | 126 +++-- drivers/i2c/i2c-core-base.c | 2 +- drivers/i2c/i2c-core-smbus.c | 15 +- drivers/i2c/i2c-smbus.c | 5 +- drivers/infiniband/ulp/rtrs/rtrs-srv.c | 5 +- drivers/input/joystick/iforce/iforce-packets.c | 11 +- drivers/input/joystick/iforce/iforce-usb.c | 3 + drivers/input/joystick/psxpad-spi.c | 1 + drivers/input/keyboard/atkbd.c | 8 + drivers/input/misc/ims-pcu.c | 7 +- drivers/input/mouse/focaltech.c | 2 +- drivers/input/rmi4/rmi_f54.c | 43 +- drivers/input/rmi4/rmi_f55.c | 4 +- drivers/input/touchscreen/mms114.c | 6 + drivers/input/touchscreen/sur40.c | 23 +- drivers/md/dm-integrity.c | 4 - drivers/md/dm-verity-target.c | 12 +- drivers/md/dm-verity.h | 2 +- drivers/media/i2c/imx219.c | 47 +- drivers/media/platform/aspeed-video.c | 1 + drivers/media/platform/marvell-ccic/cafe-driver.c | 1 + .../media/platform/mtk-vcodec/mtk_vcodec_fw_scp.c | 5 + drivers/media/v4l2-core/v4l2-async.c | 8 +- drivers/media/v4l2-core/v4l2-fwnode.c | 7 +- drivers/mmc/host/atmel-mci.c | 2 + drivers/mmc/host/omap_hsmmc.c | 2 +- drivers/mmc/host/sdhci.c | 16 + drivers/mmc/host/sdhci.h | 2 +- drivers/mmc/host/vub300.c | 36 +- drivers/mtd/maps/vmu-flash.c | 8 +- drivers/mtd/spi-nor/Makefile | 2 +- drivers/mtd/spi-nor/core.c | 406 +---------------- drivers/mtd/spi-nor/core.h | 5 + drivers/mtd/spi-nor/intel.c | 16 +- drivers/mtd/spi-nor/sst.c | 30 +- drivers/mtd/spi-nor/swp.c | 426 +++++++++++++++++ drivers/net/can/usb/gs_usb.c | 2 +- drivers/net/ethernet/aquantia/atlantic/aq_ring.c | 25 + drivers/net/ethernet/aquantia/atlantic/aq_ring.h | 1 + drivers/net/ethernet/aquantia/atlantic/aq_vec.c | 2 +- drivers/net/ethernet/intel/ice/ice_ethtool.c | 10 +- drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c | 48 ++ .../net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 13 +- .../net/ethernet/marvell/octeontx2/nic/otx2_vf.c | 8 +- drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 109 ++++- drivers/net/ethernet/mellanox/mlxsw/spectrum.h | 4 + .../net/ethernet/mellanox/mlxsw/spectrum_router.c | 31 +- drivers/net/ethernet/ti/am65-cpsw-nuss.c | 139 ++++-- drivers/net/ethernet/ti/am65-cpsw-nuss.h | 4 + drivers/net/ipa/ipa_smp2p.c | 30 +- drivers/net/thunderbolt.c | 8 +- drivers/net/wireless/ath/ath6kl/txrx.c | 2 +- .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 13 + .../net/wireless/broadcom/brcm80211/brcmfmac/bus.h | 6 + .../wireless/broadcom/brcm80211/brcmfmac/core.c | 45 +- .../wireless/broadcom/brcm80211/brcmfmac/pcie.c | 6 + .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 6 + .../wireless/broadcom/brcm80211/brcmfmac/sdio.h | 1 + .../net/wireless/broadcom/brcm80211/brcmfmac/usb.c | 3 + drivers/net/wireless/marvell/libertas_tf/main.c | 2 +- drivers/pci/pci.c | 30 ++ drivers/s390/cio/vfio_ccw_cp.c | 17 +- drivers/s390/net/qeth_core_main.c | 3 + drivers/s390/net/qeth_l3_main.c | 5 + drivers/scsi/lpfc/lpfc_init.c | 3 +- drivers/scsi/scsi_debug.c | 27 +- drivers/scsi/sd.h | 5 +- drivers/scsi/sd_zbc.c | 79 +++- drivers/target/target_core_fabric_lib.c | 146 ++++-- drivers/target/target_core_internal.h | 5 +- drivers/target/target_core_pr.c | 54 +-- drivers/thunderbolt/domain.c | 30 ++ drivers/thunderbolt/icm.c | 5 + drivers/thunderbolt/switch.c | 14 + drivers/thunderbolt/tb.c | 58 +-- drivers/thunderbolt/tb.h | 2 + drivers/thunderbolt/xdomain.c | 71 ++- drivers/tty/serial/8250/8250_mid.c | 6 +- drivers/tty/serial/max310x.c | 20 +- drivers/tty/serial/sc16is7xx.c | 192 ++++++-- drivers/usb/gadget/function/f_tcm.c | 192 ++++++-- drivers/usb/gadget/function/tcm.h | 13 + drivers/usb/gadget/udc/bdc/bdc_core.c | 20 + drivers/usb/gadget/udc/bdc/bdc_udc.c | 7 +- drivers/usb/serial/keyspan_pda.c | 471 ++++++++++--------- fs/9p/vfs_inode.c | 9 + fs/binfmt_elf.c | 4 +- fs/binfmt_elf_fdpic.c | 4 +- fs/binfmt_misc.c | 14 +- fs/ceph/addr.c | 24 +- fs/ceph/cache.c | 2 +- fs/ceph/caps.c | 53 ++- fs/ceph/dir.c | 20 +- fs/ceph/export.c | 10 +- fs/ceph/file.c | 33 +- fs/ceph/inode.c | 20 +- fs/ceph/ioctl.c | 8 +- fs/ceph/mds_client.c | 11 + fs/ceph/mds_client.h | 2 + fs/ceph/mdsmap.c | 2 +- fs/ceph/super.c | 22 +- fs/ceph/super.h | 8 +- fs/ceph/xattr.c | 8 +- fs/cifs/smb2ops.c | 4 +- fs/exec.c | 6 +- fs/f2fs/data.c | 2 +- fs/jbd2/journal.c | 10 +- fs/namei.c | 42 ++ fs/overlayfs/copy_up.c | 14 +- fs/super.c | 19 +- fs/xfs/libxfs/xfs_sb.c | 4 +- include/drm/drm_connector.h | 6 +- include/drm/drm_displayid.h | 2 +- include/linux/audit.h | 18 +- include/linux/bootconfig.h | 3 + include/linux/bpf_lsm.h | 4 + include/linux/ceph/ceph_debug.h | 38 ++ include/linux/dma-resv.h | 2 +- include/linux/dma/edma.h | 2 - include/linux/firmware.h | 3 + include/linux/fs.h | 28 ++ include/linux/i2c-smbus.h | 6 +- include/linux/jbd2.h | 9 +- include/linux/kvm_host.h | 1 + include/linux/lsm_hooks.h | 1 + include/linux/namei.h | 1 + include/linux/pci.h | 1 + include/linux/property.h | 1 + include/linux/skbuff.h | 2 + include/linux/thunderbolt.h | 3 + include/media/v4l2-async.h | 9 +- include/net/act_api.h | 20 + include/net/ip_tunnels.h | 3 + include/net/ip_vs.h | 7 + include/trace/events/rxrpc.h | 2 + include/uapi/linux/ip_vs.h | 6 - init/main.c | 39 -- kernel/audit.c | 2 +- kernel/audit.h | 32 +- kernel/audit_fsnotify.c | 39 +- kernel/audit_tree.c | 2 +- kernel/audit_watch.c | 42 +- kernel/auditfilter.c | 17 +- kernel/auditsc.c | 6 +- kernel/bpf/bpf_inode_storage.c | 10 + kernel/sched/psi.c | 6 + kernel/taskstats.c | 67 +-- kernel/trace/ftrace.c | 21 +- lib/bootconfig.c | 65 +++ lib/compat_audit.c | 12 +- mm/memory_hotplug.c | 15 +- mm/pagewalk.c | 8 + mm/ptdump.c | 7 + net/9p/client.c | 2 + net/bluetooth/hidp/core.c | 25 +- net/ceph/cls_lock_client.c | 21 +- net/ceph/osdmap.c | 9 +- net/core/pktgen.c | 43 +- net/core/skbuff.c | 28 +- net/ipv4/ip_tunnel_core.c | 35 ++ net/ipv4/ipip.c | 41 +- net/ipv6/ip6_tunnel.c | 40 +- net/ipv6/sit.c | 38 +- net/mptcp/options.c | 21 +- net/mptcp/protocol.c | 4 +- net/mptcp/protocol.h | 14 + net/mptcp/subflow.c | 12 +- net/netfilter/ipset/ip_set_core.c | 19 +- net/netfilter/ipset/ip_set_list_set.c | 7 +- net/netfilter/ipvs/ip_vs_conn.c | 4 +- net/netfilter/ipvs/ip_vs_core.c | 6 +- net/netfilter/ipvs/ip_vs_ctl.c | 4 +- net/netfilter/ipvs/ip_vs_dh.c | 4 +- net/netfilter/ipvs/ip_vs_lblc.c | 2 +- net/netfilter/ipvs/ip_vs_lblcr.c | 8 +- net/netfilter/nf_conntrack_sip.c | 10 +- net/netfilter/nf_flow_table_core.c | 7 +- net/netfilter/nf_tables_offload.c | 2 +- net/netfilter/nft_set_pipapo.c | 252 ++++++---- net/netfilter/nft_set_pipapo.h | 8 + net/packet/af_packet.c | 7 +- net/rxrpc/call_accept.c | 28 +- net/rxrpc/call_object.c | 27 +- net/rxrpc/recvmsg.c | 23 +- net/sched/act_gact.c | 5 + net/sched/act_police.c | 6 + net/sched/sch_api.c | 24 +- net/sched/sch_taprio.c | 12 +- net/sctp/protocol.c | 20 +- net/sctp/sysctl.c | 9 +- net/smc/af_smc.c | 3 +- net/smc/smc_rx.c | 12 +- net/smc/smc_tx.c | 17 +- net/tipc/socket.c | 6 +- net/xfrm/espintcp.c | 32 +- security/apparmor/include/net.h | 6 +- security/apparmor/lsm.c | 38 +- security/bpf/hooks.c | 3 + security/security.c | 506 +++++++++++++-------- security/selinux/hooks.c | 91 ++-- security/selinux/include/objsec.h | 5 + security/selinux/netlabel.c | 23 +- security/selinux/ss/policydb.c | 31 ++ security/selinux/ss/services.c | 4 +- security/smack/smack.h | 5 + security/smack/smack_lsm.c | 66 ++- security/smack/smack_netfilter.c | 8 +- sound/core/seq/seq_timer.c | 13 +- sound/hda/hdac_regmap.c | 4 +- sound/soc/codecs/cs4265.c | 4 +- sound/soc/mediatek/mt8183/mt8183-afe-pcm.c | 12 +- sound/soc/xilinx/xlnx_formatter_pcm.c | 10 +- sound/usb/usx2y/usX2Yhwdep.c | 10 +- sound/usb/usx2y/usbus428ctldefs.h | 2 + sound/usb/usx2y/usbusx2y.c | 2 +- sound/usb/usx2y/usx2yhwdeppcm.c | 15 +- virt/kvm/kvm_main.c | 3 + 276 files changed, 4340 insertions(+), 2447 deletions(-)