Changelog
in Linux kernel
6.1.189
9p:
invalidate readdir buffer on seek
9p:
use kvzalloc for readdir buffer
accel/habanalabs:
postpone mem_mgr IDR destruction to hpriv_release()
ACPI:
PCI: Clear _DEP dependencies after PCI root bridge attach
ACPICA:
add boundary checks in acpi_ps_get_next_field()
ACPICA:
add boundary checks in two places
ACPICA:
Add package limit checks in parser functions
ACPICA:
Add validation for node in acpi_ns_build_normalized_path()
ACPICA:
Enhance buffer validation in acpi_ut_walk_aml_resources()
ACPICA:
Enhance OEM ID and Table ID validation in acpi_ex_load_table_op()
ACPICA:
Fix condition check in acpi_ps_parse_loop()
ACPICA:
Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op)
ACPICA:
Fix NULL pointer dereference in acpi_ns_custom_package()
ACPICA:
Fix use-after-free in acpi_ds_terminate_control_method()
ACPICA:
Improve argument parsing in acpi_ps_get_next_simple_arg()
ACPICA:
Prevent adding invalid references
ACPICA:
validate byte_count in acpi_ps_get_next_package_length()
ACPICA:
validate handler object type in two places
af_packet:
Don't cast tpacket_hdr.tp_len to int in tpacket_parse_header().
af_packet:
fix integer overflow in prb_calc_retire_blk_tmo()
af_unix:
Drop all SCM attributes for SOCKMAP.
af_unix:
Unlink scc_entry in unix_del_edge().
affs:
handle set_blocksize failures
ALSA/ASoC:
hda: ext: add 'ext' prefix to snd_hdac_link_free_all
ALSA:
6fire: Clean ups with guard()
ALSA:
6fire: fix OOB write from device-reported iso length
ALSA:
bcd2000: Fix race between rawmidi and disconnect
ALSA:
caiaq: Decoupling ep1_in_urb in caiaq dev
ALSA:
caiaq: Fix potential double-free at error path
ALSA:
ctxfi: Fix CA20K2 S/PDIF passthrough
ALSA:
es18xx: check control allocation before private data setup
ALSA:
hda/common: Use cleanup macros for PM controls
ALSA:
hda/common: Use guard() for mutex locks
ALSA:
hda/conexant: Add pin config quirk for Lenovo IdeaPad Slim 5 16AKP10
ALSA:
hda/realtek: Add mute LED quirk for HP Laptop 14s-dr1xxx
ALSA:
hda/realtek: Add quirk for ASUS VivoBook X509DAP
ALSA:
hda/realtek: Add quirk for HP 255 15.6 inch G9 Notebook PC
ALSA:
hda/realtek: Add quirk for HP EliteBook 830 G8 (8AB8) to enable mute LEDs
ALSA:
hda/realtek: Add quirk for Lenovo Xiaoxin 14 GT
ALSA:
hda/realtek: Fix speakers on MECHREVO WUJIE Series
ALSA:
hda: Fix missing pointer check in hda_component_manager_init function
ALSA:
hda: Introduce auto cleanup macros for PM
ALSA:
hda: Report a change when only the channel status bytes move
ALSA:
hda: trace PCM open only after assigning a stream
ALSA:
pcm: Serialize PCM mmap with buffer reallocation to fix page UAF
ALSA:
pcm: set timer->private_data before registering the PCM timer
ALSA:
seq: oss: Reject reads that cannot fit the next event
ALSA:
us122l: Prevent write upgrades for read mappings
ALSA:
usb-audio: Add dB map quirk for Razer Barracuda X 2.4
ALSA:
usb-audio: Add FIXED_RATE quirk for JBL Quantum650 Wireless
ALSA:
usb-audio: Add quirk flags for SC13A
ALSA:
usb-audio: Add quirk for Corsair Virtuoso (later revision)
ALSA:
usb-audio: Add quirk for Novation Mininova
ALSA:
usb-audio: Add quirk for YAMAHA CDS3000
ALSA:
usb-audio: caiaq: validate EP1 reply lengths
ALSA:
usb-audio: Propagate write errors in generic mixer put callbacks
ALSA:
usb: 6fire: Avoid embedded URBs
ALSA:
usbusx2y: fix in04_last array size mismatch with in04_buf
ALSA:
usx2y: Drain pending US-428 pipe-4 output commands
ALSA:
virtio: reset device before deleting virtqueues
arm64/daifflags:
Make local_daif_*() helpers __always_inline
arm64:
dts: renesas: r8a779f0: Set UFS lane count
arm64:
fixmap: Allow 256K early_ioremap() at any offset
arm64:
hibernate: pass HVC_SET_VECTORS args to the resume hvc
arm64:
kprobes: Allow reentering kprobes while single-stepping
arm64:
percpu: Fix this_cpu_and() mask generation
arm64:
percpu: Fix this_cpu_write() casting
ARM:
9484/1: enable interrupts when unhandled user faults are triggered
ARM:
ensure interrupts are enabled in __do_user_fault()
arm:
Handle KCOV __init vs inline mismatches
ARM:
socfpga: select the PL310 erratum 753970 workaround
ASoC:
ab8500: Correct digital interface format setup
ASoC:
ab8500: Repair the DAPM capture graph
ASoC:
ab8500: Reset the audio block before configuring it
ASoC:
ab8500: Validate and program TDM slots correctly
ASoC:
amd: renoir: fix disable_pdm_interrupts() to clear mask bits
ASoC:
amd: yc: Add Alienware m15 R7 AMD to DMIC quirk table
ASoC:
amd: yc: fix memory leak in acp6x_pdm_dma_close()
ASoC:
bcm: bcm63xx: Publish the OF module aliases
ASoC:
codecs: pcm3168a: Drop CONFIG_PM-conditional preproc directive
ASoC:
codecs: rk3328: Use managed GPIO and clock helpers
ASoC:
hdmi-codec: Report a change when the channel status moves
ASoC:
Intel: avs: Clean up the bus when fetching ML caps fails
ASoC:
Intel: catpt: Complete coredump handling
ASoC:
Intel: SST: Publish the PCI module aliases
ASoC:
meson: aiu: Validate written enum values
ASoC:
mt6351: Publish the OF module alias
ASoC:
qcom: q6apm: return error code to consumers on failures
ASoC:
rockchip: rockchip_pdm: Handle runtime PM resume failures in set_fmt
ASoC:
rockchip: rockchip_pdm: Reorder clock enable sequence
ASoC:
rockchip: spdif: Restore regcache cache-only mode on sync failure
ASoC:
rt5645: Perform the initial jack detect at probe
ASoC:
SOF: avoid a NULL dereference with unsupported widgets
ASoC:
SOF: ipc4-topology: Clarify bind failure caused by missing fw_module
ASoC:
sprd: validate compress buffer sizes against fixed allocations
ASoC:
sti: initialize IRQ lock before requesting IRQ
ASoC:
ti: omap3pandora: update board check to use DT compatible
ASoC:
ux500: Correct MSP frame and bit clock setup
ASoC:
ux500: Fix MSP stream lifecycle handling
ASoC:
ux500: Parenthesize MSP_{RX,TX}_CLKPOL_BIT() arguments
ASoC:
ux500: Program the MSP FIFO watermarks
ASoC:
ux500: Propagate MSP setup errors
ASoC:
ux500: remove platform_data support
ASoC:
ux500: remove stedma40 references
ASoC:
ux500: Request the MSP MMIO resource
ASoC:
ux500: Validate MSP DAI configuration
ata:
ahci: fail probe if BAR too small for claimed ports
ata:
libahci: clear PxCLBU and PxFBU for AHCI_HFLAG_32BIT_ONLY
ata:
libata-pmp: add JMicron JMS562 quirk
autofs:
fix sbi->pipe file reference leak in autofs_kill_sb()
befs:
handle set_blocksize failures
bfs:
handle set_blocksize failures
bitfield:
wire __bf_shf to __builtin_ctzll
blk-cgroup:
fix leaks and online flag on radix_tree_insert failure
blk-cgroup:
protect iterating blkgs with blkcg->lock in blkcg_print_stat()
blk-mq:
fix tags leak when shrink nr_hw_queues
blk-mq:
fix tags UAF when shrinking q->nr_hw_queues
Bluetooth:
bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough
Bluetooth:
btmtksdio: Fix PM runtime reference leak in shutdown
Bluetooth:
btusb: Add Mercusys MA530 for Realtek RTL8761BUV
Bluetooth:
btusb: Add support for TP-Link TL-UB250
Bluetooth:
btusb: fix NXP IW610 composite device handling
Bluetooth:
btusb: Fix UAF of btusb_data by rx_work
Bluetooth:
eir: validate service data length before reading UUID
Bluetooth:
hci_codec: validate vendor codec count length
Bluetooth:
hci_mrvl: Fix wrong return value check of wait_on_bit_timeout()
Bluetooth:
hci_sock: reject out-of-range OCF values
Bluetooth:
hci_sock: validate event length before filtering
Bluetooth:
hci_sync: always check if connection is alive before deleting
Bluetooth:
hci_sync: Fix UAF in hci_disconnect_all_sync
Bluetooth:
hci_sync: Serialize local codec list cleanup
Bluetooth:
ISO: fix malformed ISO_END/CONT handling
Bluetooth:
L2CAP: clear FLAG_DEFER_SETUP only for same PID/PSM
Bluetooth:
L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan
Bluetooth:
L2CAP: validate connectionless PSM length
Bluetooth:
L2CAP: validate frame length before control and FCS access
Bluetooth:
mgmt: Dequeue pending mesh_send_sync entries on cancel
Bluetooth:
mgmt: hold reference for hci_conn in mgmt_pending_cmds
Bluetooth:
RFCOMM: avoid socket lock inversion in listener cleanup
Bluetooth:
RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO
Bluetooth:
RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame()
Bluetooth:
RFCOMM: validate skb length in rfcomm_recv_frame
Bluetooth:
SMP: reject Security Request over BR/EDR
bnxt_en:
Handle buffer allocation failure in bnxt_rx_ring_reset()
bnxt_en:
Only restore LRO if the device supports TPA
bnxt_en:
Propagate RX ring init failures in bnxt_init_nic()
bonding:
alb: fix uninitialized transport header access in alb_determine_nd()
bonding:
do not clear curr_active_slave prematurely when releasing all slaves
bonding:
use skb_cow_head() in bond_do_alb_xmit() and rlb_arp_xmit()
bpf, sockmap:
Fix self-redirect copied_seq double-counting
bpf, sockmap:
Reject max_entries > INT_MAX in sock_map_alloc
bpf:
Avoid soft lockup in __htab_map_lookup_and_delete_batch()
bpf:
bpf_sk_storage: Fix invalid wait context lockdep report
bpf:
bpf_sk_storage: Fix the missing uncharge in sk_omem_alloc
bpf:
Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL
bpf:
Fix bpf_skb_change_tail wrt csum partial skbs
bpf:
Fix bpf_sock context code generation
bpf:
Fix BSWAP 32 and 16 on MIPS64
bpf:
Fix divide-by-zero in btf_struct_walk()
bpf:
Fix immediate JMP JEQ/JNE on MIPS32
bpf:
Fix NULL-ptr-deref in btf_var_show()
bpf:
Fix NULL-ptr-deref when showing a void BTF type
bpf:
Fix out-of-bounds read of rtt_min in sock_ops
bpf:
Introduce might_sleep field in bpf_func_proto
bpf:
Mark bpf_btf_find_by_name_kind() as sleepable
bpf:
Mask pseudo pointer values in verifier logs
bpf:
NUL-terminate replaced sysctl value
bpf:
reject BPF_PSEUDO_FUNC reference to the main program
bpf:
Restrict CO-RE poisoning to relocatable instructions
bpf:
Skip unsettled links in link iterator
bpf:
support access variable length array of integer type
bpftool:
remove duplicate free_btf_vmlinux() definition
bridge:
check llc_mac_hdr_init() return value in br_send_bpdu()
bridge:
Do not suppress ARP probes and DAD NS unconditionally
btrfs:
balance: fix potential bg lookup failure in btrfs_may_alloc_data_chunk()
btrfs:
detach failed sprout device from transaction update list
btrfs:
do not force reloc root creation during qgroup_account_snapshot()
btrfs:
don't check PageError in __extent_writepage
btrfs:
fix reloc root cleanup in merge_reloc_roots()
btrfs:
fix use-after-free on reloc root after error in insert_dirty_subvol()
btrfs:
insert tree mod log move in push_node_left
btrfs:
only account delalloc bytes for regular file inodes in btrfs_getattr()
btrfs:
protect sb_write_pointer() with invalidate lock
btrfs:
restore active device pointers after failed sprout
btrfs:
tree-checker: print dev extent offset in error message
btrfs:
tree-checker: validate INODE_REF's namelen
btrfs:
tree-checker: validate names in ROOT_REF and ROOT_BACKREF
bus:
fsl-mc: wait for the MC firmware to complete its boot
cachefiles:
Fix double fput
char/nvram:
Remove redundant nvram_mutex
cifs:
validate idmap key payload length
clk:
at91: pmc: #undef field_{get,prep}() before definition
clk:
keystone: don't cache clock rate
clk:
renesas: cpg-mssr: Add number of clock cells check
clk:
samsung: exynos850: mark APM I3C clocks as critical
clk:
scpi: bound-check DVFS index in scpi_dvfs_recalc_rate
clk:
socfpga: agilex: implement l3_main_free_clk
configfs_depend_prep():
pass configfs_dirent instead of dentry
cpufreq:
initialize policy rwsem before sysfs publication
cpufreq:
zero-initialize policy cpumask before sysfs publication
crypto:
atmel-ecc - add support for atecc608b
crypto:
ecc - Unbreak the build on arm with CONFIG_KASAN_STACK=y
crypto:
ixp4xx - fix buffer chain unwind on allocation failure
crypto:
sun8i-ce - Remove crypto_rng interface
crypto:
sun8i-ss - Remove crypto_rng interface
dm/amdgpu:
fix malformed link_settings debugfs output
dma-coherent:
report a failed reserved memory assignment
dma-coherent:
Warn if OF reserved memory is beyond current coherent DMA mask
dmaengine:
dw-axi-dmac: fix PM for system sleep and channel alloc
dmaengine:
Fix device kref underflow in dma_chan_put()
dmaengine:
fix use-after-free in dma_chan_put() and dma_release_channel()
dmaengine:
mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg()
dmaengine:
sprd: Fix runtime PM reference leak in probe
dmaengine:
sun6i: fix non-atomic read of DMA position registers
dmaengine:
sun6i: fix undefined behaviour in sun6i_dma_tx_status
dmaengine:
ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn()
dmaengine:
wait for RCU readers before releasing dma_device
dmaengine:
xilinx_dma: Fix hardware buffer descriptor chain after cyclic DMA
dmaengine:
xilinx_dma: Fix hardware buffer descriptor reuse order
docs:
s390/pci: Improve and update PCI documentation
Documentation:
s390: correct spelling
dpaa2-switch:
fix handling of NAPI on the remove path
dpaa2-switch:
fix the error path in dpaa2_switch_rx()
dpaa2-switch:
rework FDB management on the bridge leave path
driver core:
Add device probe log helper dev_warn_probe()
driver core:
Better advertise dev_err_probe()
driver core:
Make dev_err_probe() silent for -ENOMEM
drm/amd/display:
Fix CRC open failure during active rendering
drm/amd/display:
set new_stream to NULL after release
drm/amd/pm/si:
Don't schedule thermal work when queue isn't initialized
drm/amd/pm/si:
Fix updating clock limits from power states
drm/amd/pm:
bound pp_dpm_set_pp_table() memcpy
drm/amdgpu/atom:
Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked()
drm/amdgpu:
Fix last_update fence leak in amdgpu_vm_init()
drm/amdgpu:
Fix runtime PM leak in amdgpu_debugfs_test_ib_show()
drm/amdgpu:
Fix vmid_wait fence leak in amdgpu_ring_init()
drm/amdkfd:
Check bounds for allocate_sdma_queue restore_sdma_id
drm/amdkfd:
Check bounds on allocate_doorbell
drm/arm/komeda:
fix error handling for clk_prepare_enable() and callers
drm/arm/malidp:
use clk_bulk API in runtime PM resume and suspend
drm/ast:
Remove little-endianism from I/O helpers
drm/ast:
Rework definition of I/O read and write helpers
drm/atomic-helper:
Add atomic_enable plane-helper callback
drm/bridge:
tc358768: Set pre_enable_prev_first for reverse order
drm/gem:
Consider GEM object reclaimable if shrinking fails
drm/gma500:
return errors from Oaktrail HDMI I2C reads
drm/gud:
Add RCade Display Adapter VID/PID pair
drm/gud:
fix out-of-bounds write in gud_plane_atomic_check()
drm/i915:
fix incorrect RCU teardown order
drm/i915:
Fix memory leak in query_perf_config_list()
drm/logicvc:
Drop the select of the nonexistent CONFIG_DRM_KMS_DMA_HELPER
drm/msm/adreno:
fix autosuspend cleanup during teardown
drm/msm/dp:
Drop aux devices together with DP controller
drm/msm/dsi:
correct byte intf clock rate for 14nm DSI PHY
drm/msm/dsi:
round the byte clock rate after reparenting to the PHY PLL
drm/msm/hdmi_phy:
fix runtime PM cleanup on probe failure
drm/nouveau/clk:
don't clobber reclock status when restoring volt/fan
drm/nouveau/clk:
fix list cursor use after loop in nvkm_clk_ustate_update
drm/nouveau:
don't bump pin count on failed re-pin in nouveau_bo_pin_locked()
drm/nouveau:
fix autosuspend cleanup during teardown
drm/nouveau:
Fix bridge reference leak in nv1a_ram_new()
drm/nouveau:
fix double-free in nvif_vmm_dtor
drm/nouveau:
Fix gem reference leak in validate_init()
drm/panel:
simple: Add AM-1280800W8TZQW-T00H
drm/virtio:
Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create()
drm/virtio:
fix object leak in virtio_gpu_resource_create_ioctl()
drm/virtio:
fix object leak when drm_gem_handle_create() fails
drm/virtio:
fix object leaks in virtio_gpu_resource_create_blob_ioctl()
drm/virtio:
release the GEM object on virtio_gpu_vram_create() errors
drm:
Fix drm_pending_vblank_event leak in error path for out_fence_ptr
drop_monitor:
fix out-of-bounds write in reset_per_cpu_data()
drop_monitor:
fix size calculations for 64-bit attributes
drop_monitor:
perform u64_stats updates under IRQ-disabled section
drop_monitor:
synchronize tracepoint unregistration on error path
e1000e:
limit endianness conversion to boundary words
EDAC/device_sysfs:
Use kstrtouint() for poll_msec to prevent truncation
EDAC/igen6:
Fix channel address decode for non-hash mode
EDAC/igen6:
Fix channel selection hash
EDAC/igen6:
Fix interleave boundary condition
erofs:
fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC
erofs:
Fix detection of atomic context
esp:
downgrade zerocopy managed frags before mutating skb frags
eth:
mlx5: fix macsec dependency
exec:
do_close_on_exec() before taking exec_update_lock
f2fs:
validate inline dentry name lengths before conversion
fbdev:
pm2fb: unwind WC setup on probe failure
fbdev:
vfb: defer cleanup until the last reference
firmware:
arm_scmi: Validate BASE_ERROR_EVENT payload size
firmware:
arm_scmi: Validate SENSOR_UPDATE payload size
firmware:
arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS
firmware:
stratix10-svc: change get provision data to async SMC call
firmware:
stratix10-svc: fix FCS SMC call kernel-doc
fou:
Fix use-after-free in fou_create()
fou:
reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT
freevxfs:
don't BUG() on unknown typed-extent type
fs/ntfs3:
preserve non-DOS attribute bits in system.dos_attrib
fs/ntfs3:
validate index entry key bounds
fsl/fman:
Fix clk reference leak in read_dts_node()
fuse:
set ff->flock only on success
gpio:
arizona: Fix runtime PM leak in arizona_gpio_direction_out()
gpio:
dwapb: Mask interrupts at hardware initialization
gpio:
pisosr: Read "ngpios" as u32
gpio:
zynq: fix runtime PM leak on request error path
hfs:
rework hfsplus_readdir() logic
hfsplus:
fix issue of direct writes beyond end-of-file
hfsplus:
rework hfsplus_readdir() logic
HID:
alps: fix use-after-free on input2 registration failure
HID:
amd_sfh: Validate PCI BAR size before mapping
HID:
bpf: Add Huion Inspiroy Frego M button quirk
HID:
elecom: fix bus type for M-XGL20DLBK
HID:
hidpp: fix potential UAF in hidpp_connect_event()
HID:
hyperv: streamline driver probe to avoid devres issues
HID:
logitech-hidpp: fix race condition when accessing stale stack pointer
HID:
quirks: add ALWAYS_POLL quirk for SDINNOVATION gaming keyboard
HID:
wacom: fix OOB read in wacom_wac_pen_serial_enforce()
host1x:
bus: Fix missing ops null check in error teardown
hpfs:
handle set_blocksize failures
hsr:
broadcast netlink notifications in the device's net namespace
hwmon:
(adt7462) Add of_match_table to support devicetree
hwmon:
(applesmc) fix key backlight workqueue leak on register failure
hwmon:
(aspeed-pwm-tacho) Propagate reset deassert errors
hwmon:
(gpio-fan) Fix use-after-free in alarm work
hwmon:
(gpio-fan) take fan_data->lock in gpio_fan_shutdown()
hwmon:
(pmbus) Clear generic status alarms with CLEAR_FAULTS
hwmon:
(pmbus/core) increase number of phases and add new mask
hwmon:
(pmbus/lm25066) Fix PMBus coefficients for LM5064/5066/5066i
hwmon:
(pmbus/tps53679) Fix TPS53676 phase page decoding
hwmon:
(pmbus/tps53679) Select page 0 for single-page TPS53676
hwmon:
(w83791d) remove fan/pwm 4-5 sysfs group on remove
hwmon:
(w83793) release probe data through kref
i2c:
at91: release DMA channels on remove and probe error
i2c:
imx: release DMA channels on probe error
i2c:
smbus: reject oversized block transfers in the common path
i3c:
mipi-i3c-hci: Tolerate i3c_master_add_i3c_dev_locked() failures in DAA
IB/IPoIB:
Avoid restoring OPER_UP after multicast flush
IB/iser:
reject a remote invalidation of an unregistered direction
IB/isert:
wait for deferred control PDU completions before releasing the connection
IB/mlx4:
Fix use-after-free on pkey sysfs registration failure
ice:
add missing xa_destroy for sched_node_ids
ice:
pass the return value of skb_checksum_help()
ieee802154:
6lowpan: fix NULL dereference in lowpan_newlink
iio:
accel: mma8452: switch to non-devm request_threaded_irq()
iio:
adc: qcom-spmi-iadc: balance enable_irq_wake() on driver unbind
iio:
light: stk3310: Deal with the ps interrupt issue in PM
ima:
return error early if file xattr cannot be changed
Input:
adp5588-keys - cache GPIO state before registering the gpiochip
Input:
atkbd - skip deactivate for Xiaomi Redmi Book Pro 16 2026
Input:
evdev - zero absinfo before partial copy in EVIOCSABS
Input:
i8042 - add quirk for Acer Aspire Go 15 AG15-42P
Input:
rmi_smbus - fix out-of-bounds read in rmi_smb_write_block()
Input:
soc_button_array - check btns_desc->package.count
Input:
soc_button_array - fix MS Surface Pro 11 probe failure
Input:
synaptics - disable InterTouch on ThinkPad T440p (board id 2722)
Input:
synaptics-rmi4 - fix GPF in suspend and resume when unbound
Input:
trackpoint - fix the inertia attribute name in the ABI document
Input:
xpad - add support for Azeron devices
Input:
xpad - add support for Victrix Pro BFG Controller
Input:
xpad - fix PDP Marvel Xbox 360 controller
Input:
zero ff_effect before compat copy in input_ff_effect_from_user
integrity:
Check for NULL returned by asymmetric_key_public_key
io_uring/io-wq:
Fix memory leak in io_wq_create() on success path
iommu/rockchip:
disable fetch dte time limit
ip6_gre:
Call ip6erspan_tunnel_unlink_md() in ip6erspan_changelink().
ip6_gre:
check tunnel info before xmit in ip6gre_tunnel_xmit
ip_gre:
Reject enabling collect metadata through changelink
ipmi:
si: Use platform_get_irq_optional() to retrieve interrupt
ipv4:
adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu]
ipv4:
fib: bound automatic table ID allocation
ipv4:
fib: Don't dump dying fib_info in fib_leaf_notify().
ipv4:
icmp: reject RTN_UNREACHABLE input routes in icmp_route_lookup
ipv4:
start using dst_dev_rcu()
ipv6:
addrconf: fix temp address generation after prefix deprecation
ipv6:
do not let ipv6_find_hdr() return an offset past the packet end
ipv6:
fix fib6 walker UAF on seq stop
ipv6:
Honor oif when choosing nexthop for locally generated traffic
ipv6:
mcast: extend RCU protection in igmp6_send()
ipv6:
Select best matching nexthop object in fib6_table_lookup()
ipv6:
sr: enforce exact attribute length for SEG6_ATTR_DST
ipv6:
sr: restore network header before routing and forwarding
ipv6:
tunnels: use DEV_STATS_INC()
ipv6:
xfrm: use full sockets in local error paths
ipvs:
fix reversed sequence option serialization
ipvs:
reject invalid states in connection template sync records
ipvs:
revalidate ihl before icmp_send
irqchip/gic-v4:
Don't advertise VLPIs if no ITS is probed
isofs:
handle set_blocksize failures
jfs:
handle set_blocksize failures
kcsan:
Silence -Wmaybe-uninitialized when calling __kcsan_check_access()
keys:
fix lost wakeup when reaping a dead key type
keys:
translate request_key_auth pid for the reading procfs instance
KEYS:
trusted: Fix tpm2_load_cmd() boundary check
kselftest/arm64:
Fix size of thread_data values for pthread_join()
ksmbd:
align SMB2 oplock break ack handling
ksmbd:
apply create security descriptor first
ksmbd:
break RH leases before delete-on-close
ksmbd:
find bound sessions during reauthentication
ksmbd:
Fix acl.sd_buf memory leak and invalid sd_size error handling
ksmbd:
fix credit charge calculation for SMB2 QUERY_INFO
ksmbd:
fix n.data memory leak in ksmbd_vfs_set_dos_attrib_xattr
ksmbd:
fix outstanding credit leak on abort and error paths
ksmbd:
fix sd_ndr.data memory leak in ksmbd_vfs_set_sd_xattr
ksmbd:
mark invalid session responses as signed
ksmbd:
prevent out-of-bounds reads in share config responses
ksmbd:
rate limit unmapped SID errors
ksmbd:
remove stale channels from all sessions on teardown
ksmbd:
start file id allocation at 1
ksmbd:
treat unnamed DATA stream as base file
ksmbd:
use connection ClientGUID for lease lookup
ksmbd:
use memcmp() to compare ClientGUIDs
ksmbd:
validate ACE size against SID sub-authorities
ksmbd:
validate SID namespace before mapping IDs
KVM:
PPC: Book3S HV: fix secure device page leak on uv_page_in() failure
KVM:
PPC: Book3S HV: fix use-after-free in kvmhv_emulate_tlbie_all_lpid()
KVM:
PPC: Book3S HV: Set irqfd->producer only on success
lan78xx:
Enable 125 MHz CLK configuration for LAN7801 if NO EEPROM is detected
lan78xx:
Enable Auto Speed and Auto Duplex configuration for LAN7801 if NO EEPROM is detected
landlock:
Fix handling of disconnected directories
leds:
pca9532: Don't stop blinking for non-zero brightness
leds:
uleds: Return -EFAULT on copy_to_user() failure
libbpf:
Add __NR_bpf definition for LoongArch
libbpf:
Also reset {insn,data}_cur on realloc failure
libbpf:
Reject truncated ldimm64 CO-RE relocations
Linux:
Linux 6.1.189
llc:
fix skb UAF and leaks on llc_mac_hdr_init() failure
llc:
reserve device headroom for allocated frames
lockdep:
Add lock_set_cmp_fn() annotation
locking/lockdep:
Improve the deadlock scenario print for sync and read lock
locking/lockdep:
Introduce lock_sync()
locking/lockdep:
Invalidate stale class_cache entries for zapped classes
mailbox:
Make mbox_send_message() return error code when tx fails
md/raid5:
account discard IO
md/raid5:
let stripe batch bm_seq comparison wrap-safe
media:
as102: do not rely on id table address comparison
media:
dm1105: fix missing error check for dma_alloc_coherent
media:
em28xx-video: fix missing res_free() on init_usb_xfer failure
media:
hevc: add bounded tile-count helpers
media:
imon: Add iMON VFD HID OEM v1.2 key mappings
media:
ipu-bridge: Fix null pointer deref on SSDB/PLD parsing warnings
media:
rc: mceusb: Add support for 04eb:e033
media:
v4l2-ctrls: validate HEVC tile counts
media:
v4l2-h264: Fix memcmp() size in B1 reference list comparison
media:
verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity
media:
video-i2c: fix buffer queue ordering
media:
video-i2c: use vb2_video_unregister_device on driver removal
memstick:
ms_block: destroy io_queue workqueue on removal
mfd:
db8500-prcmu: Fold dbx500 header into db8500
mfd:
db8500-prcmu: Remove needless return in three void APIs
mfd:
db8500-prcmu: Remove unused inline functions
mfd:
rsmu: Add 8a34002 support
minix:
handle set_blocksize failures
mips:
cps: Assemble jr.hb with an R2 ISA level
MIPS:
Octeon: apply USB FDT fixups also when USB is modular
mm/damon/core:
avoid infinite kdamond_merge_regions() internal loop
mmc:
core: Add validation for host-provided max_segs
mmc:
core: Cancel SDIO IRQ work before freeing host
mmc:
core: Fix OF node reference leak on card add failure
mmc:
davinci: avoid NULL deref of host->data in IRQ handler
mmc:
davinci: fix mmc_add_host order in probe
mmc:
mxcmmc: cancel data work and watchdog on remove
mmc:
renesas_sdhi: Add OF entry for RZ/G2E SoC
mmc:
renesas_sdhi: Add OF entry for RZ/G2N SoC
mmc:
rtsx_pci_sdmmc: ignore broken write-protect on ThinkPad X260
mmc:
sdhci-of-aspeed: Remove children before releasing SDC resources
mmc:
sdhci_am654: Reset command and data lines on failed tuning
mmc:
sdio_uart: fix xmit_fifo leak when the port table is full
mmc:
sh_mmcif: initialize IRQ-thread mutex before requesting interrupt
mmc:
spi: reset bytes_xfered before retrying CRC failures
mptcp:
avoid unneeded actions on subflow reset
mptcp:
close race between scheduler and state change
mptcp:
consolidate subflow cleanup
mptcp:
options: handle MPC data + csum reqd + no csum
mptcp:
return sk_wait_data() errors from recvmsg()
mptcp:
subflow: no need to copy thmac during ulp_clone
mptcp:
syncookies: remember the request backup flag
net/micrel:
Fix typos in micrel driver code comments
net/mlx5:
Bridge, don't fail unlink of untracked/unsupported peer ports
net/mlx5:
Bridge, pass net device when linking vport to bridge
net/mlx5:
E-Switch, prevent mc_list repopulation during vport disable
net/mlx5:
E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put
net/mlx5:
Fix rev_entry reference leak in mlx5_tc_ct_shared_counter_get()
net/mlx5e:
Fix ETS zero BW reporting when one TC holds 100%
net/mlx5e:
Fix setting RS FEC after remapping
net/mlx5e:
Fix use-after-free race in sample_restore_put()
net/mlx5e:
TC, Fix internal port memory leak
net/packet:
avoid truncating TPACKET_V3 private size
net/packet:
clear RX owner on VNET header error
net/rds:
acquire RDS_IN_XMIT in rds_tcp_reset_callbacks()
net/rds:
acquire the fastpath locks in rds_conn_shutdown()
net/rds:
clear cp_flags bits individually in rds_conn_path_reset()
net/rds:
don't let rds_conn_shutdown() consume a concurrent drop
net/rds:
Don't sleep inside rds_ib_conn_path_shutdown
net/rds:
fix tcp stream corruption with large pages
net/rds:
tcp: don't force RDS_CONN_RESETTING over a concurrent shutdown
net/rds:
use clear_bit_unlock() in release_refill()
net/rds:
use wq_has_sleeper() in release_in_xmit()
net/sched:
act_api: budget all shared attributes in notify skbs
net/sched:
act_api: conditional notification of events
net/sched:
act_api: don't open code max()
net/sched:
act_api: fix skb sizing and action leak on reoffload delete
net/sched:
act_api: size the RTM_GETACTION reply from the actions
net/sched:
act_csum: don't mangle UDP tunnel GSO packets
net/sched:
act_ct: don't WARN on benign flow_offload_alloc() failure
net/sched:
act_gate: budget the per-entry list in get_fill_size
net/sched:
cls_api: Don't replay RTM_GETCHAIN in tc_ctl_chain().
net/sched:
cls_route: free emptied bucket on filter move
net/sched:
cls_u32: fix duplicate handle when node ID pool is exhausted
net/sched:
cls_u32: fix manual hash table handle IDR aliasing
net/sched:
defer qdisc freeing after failed creation
net/sched:
drr: clamp quantum in change class
net/sched:
ets: clamp quantum in parse and fallback paths
net/sched:
fq_pie: clamp quantum in change path
net/sched:
hhf: cap hh_flows_limit at change time
net/sched:
hhf: clamp quantum in change and init paths
net/sched:
pie: clamp psched_mtu in pie_drop_early
net/sched:
reject IDR error pointers when deleting actions
net/sched:
sch_drr: make cl->quantum lockless
net/sched:
sch_hfsc: bound the classify inner-filter walk with a drift budget
net/sched:
sch_teql: fix shadowed err in __teql_resolve()
net/sched:
sfq: clamp quantum in change path
net/smc:
check v2_ext_offset/eid_cnt/ism_gid_cnt when receiving proposal msg
net/smc:
fix UAF on lgr list traversal in smcr_port_err()
net:
amd-xgbe: discard rx packets with bad FCS
net:
appletalk: fix NULL pointer dereference in aarp_send_ddp()
net:
arp: terminate device name before lookup
net:
atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read
net:
atl1c: fix soft lockup on out-of-range tpd_cons read
net:
atl1e: fix soft lockup on out-of-range hw_next_to_clean read
net:
au1000: move free_irq out of the close-time spinlocked section
net:
bcmgenet: allow return of power up status
net:
bcmgenet: do not skip WoL power up on GENET V1
net:
bcmgenet: fix 64-bit RTNL stats reading in ethtool on 32-bit systems
net:
bcmgenet: initialize u64 stats seq counter for all queues
net:
bcmgenet: mask DMA_TIMEOUT_MASK when reading DMA_RING0_TIMEOUT
net:
bcmgenet: move bcmgenet_power_up into resume_noirq
net:
bcmgenet: validate Ethernet address in bcmgenet_set_mac_addr
net:
bridge: mst: move switchdev call outside rcu
net:
bridge: remove stale rcu_barrier() in br_multicast_dev_del()
net:
cap tx_queue_len at S16_MAX to prevent oversized ring allocations
net:
convert dev->reg_state to u8
net:
cpsw_new: unregister devlink on port registration failure
net:
devlink: convert devlink port type-specific pointers to union
net:
devlink: move port_type_netdev_checks() call to __devlink_port_type_set()
net:
devlink: move port_type_warn_schedule() call to __devlink_port_type_set()
net:
devlink: take RTNL in port_fill() function only if it is not held
net:
drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD
net:
dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size
net:
dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size
net:
dsa: mv88e6xxx: define .pot_clear() for 6321
net:
dsa: mv88e6xxx: enable .rmu_disable() for 6320 family
net:
dsa: mv88e6xxx: fix number of g1 interrupts for 6320 family
net:
dsa: realtek: rtl8365mb: add support for RTL8367SB
net:
dsa: sja1105: flower: reject cross-chip redirect
net:
dst: add four helpers to annotate data-races around dst->dev
net:
dst: introduce dst->dev_rcu
net:
ethernet: cortina: Ack RX overrun interrupt correctly
net:
ethernet: cortina: Count dropped frames as NAPI work
net:
ethernet: cortina: Count RX descriptors for freeq refill
net:
ethernet: cortina: Count RX drops once per frame
net:
ethernet: cortina: Finish RX updates before NAPI completion
net:
ethernet: cortina: Fix budget accounting
net:
ethernet: cortina: No mapping is a dropped rx
net:
ethernet: stmmac: dwmac-rk: fix bulk clock leak when the PHY clock fails
net:
ethernet: ti: netcp: fix pm_runtime usage counter leak on error
net:
fddi: skfp: fix NULL deref when setting the MAC address while down
net:
gue: reject invalid REMCSUM offsets
net:
hinic: fix mailbox segment buffer overflow
net:
hisilicon: hns_dsaf_mac: fix mdio device leak in hns_mac_register_phy()
net:
hso: fix TIOCMIWAIT race
net:
hsr: require valid EOT supervision TLV
net:
ibm: emac: mal: fix potential system hang in mal_remove()
net:
ibm: emac: Reserve VLAN header in MJS limit
net:
icmp: avoid invalid transport header access in icmp_send tracepoint
net:
ipv6: Clamp to IP6_MAX_MTU in ip6_dst_mtu_maybe_forward
net:
ks8851: Fix receiver error in 100BASE-TX mode following software power-down
net:
lan743x: fix RX checksum use-after-free
net:
lock the socket in sock_gettstamp()
net:
macb: destroy the phylink instance on the probe error path
net:
macb: fix NULL pointer dereference on unbind with fixed-link
net:
macb: fix ordering around PTP timestamp read
net:
macb: rename bp->sgmii_phy field to bp->phy
net:
mpls: clear inner_protocol when the last label is popped
net:
mvpp2: prevent buffer overflow in page_pool allocation
net:
netsec: fix device_node reference leak on phy_np
net:
openvswitch: conntrack: avoid modifying shared unconfirmed ct entry
net:
openvswitch: fix use-after-free of the flow table mask array
net:
qrtr: fix node refcount leak on ctrl packet alloc failure
net:
skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6()
net:
stmmac: dwmac4: Use the correct bufzise when the len is exactly 8K
net:
stmmac: initialize ptp_lock at probe time
net:
stmmac: reconfigure RX packet parser table in stmmac_hw_setup() after reset
net:
stmmac: selftests: Capture all packets for vlan checks
net:
stmmac: selftests: Check the dev->features for S-TAG offload testing
net:
stmmac: selftests: Support running selftests on DSA conduits
net:
stmmac: xgmac2: disable RBUE in default RX interrupt mask
net:
sun4i-emac: fix missing of_node_put() for phy_node
net:
thunderx: fix PTP device ref leak in nicvf_probe()
net:
tls: fix silent data drop under pipe back-pressure
net:
usb: catc: bound the RX packet length in catc_rx_done()
net:
usb: cdc_mbim: add MeiG Smart SRM821 to ZLP whitelist
net:
usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow
net:
usb: lan78xx: Fix URB reference leak in lan78xx_submit_deferred_urbs()
net:
usb: pegasus: don't rely on id table pointer arithmetic
net:
usb: qmi_wwan: add MeiG SRM813Q
net:
usb: sr9700: include receive overhead in the length check
net:
wwan: mhi_wwan_mbim: check skb_copy_bits() return value
net:
wwan: mhi_wwan_mbim: guard against a cyclic NDP chain
net:
wwan: t7xx: Add delay between MD and SAP suspend
net:
wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb()
net:
xfrm: reject unrepresentable espintcp transport headers
net:
xps: reject an out of range traffic class
net_sched:
sch_fq_pie: implement lockless fq_pie_dump()
netfilter:
ctnetlink: fix suspicious RCU usage in expect_iter_name
netfilter:
flowtable: hold reference on ct until flow is released
netfilter:
flowtable: publish HW_DEAD after worker is done
netfilter:
ip6_tables: set F_PROTO when proto value is nonzero
netfilter:
ip6t_rpfilter: reject routes without inet6_dev
netfilter:
ip6t_rt: fix zero-address non-strict match out-of-bounds read
netfilter:
ipset: mark the rcu locked areas properly
netfilter:
nf_conntrack: use get_unaligned_be32() in tcp_sack()
netfilter:
nf_conntrack_expect: zero at allocation time
netfilter:
nf_conntrack_sip: fix OOB read in sip_skip_whitespace()
netfilter:
nf_log: unregister loggers before per-net teardown
netfilter:
nf_tables: join hook list via splice_list_rcu() in commit phase
netfilter:
nfnetlink_log: cope with concurrent instance destruction
netfilter:
nfnetlink_log: wait for rcu grace period before freeing pernet state
netfilter:
nfnetlink_queue: hold nfnl mutex in event notifier
netfilter:
nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation
netfilter:
nft_nat: fully initialise new_addr in netmap setup
netfilter:
nft_set_pipapo_avx2: add missing vzeroupper
netfilter:
nft_synproxy: use the family-aware checksum helper
netfilter:
report NLM_F_DUMP_FILTERED when all is filtered out
netlabel:
fix IPv6 unlabeled address add error handling
nexthop:
Initialize extack in remove_nh_grp_entry()
nfc:
fix use-after-free in nfc_get_local_general_bytes
nfc:
llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc()
nfc:
llcp: fix -ENOMEM on connect with zero-length service name
nfc:
llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm()
nfc:
llcp: Fix race condition in accept_queue lifecycle
nfc:
llcp: fix sdreq TLV list leak on parse/alloc/send failure
nfc:
llcp: fix slab-out-of-bounds reads when logging service names
nfc:
llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap()
nfc:
nfcmrvl: validate helper command length before pull
nfc:
pn533: fix OOB read in pn533_acr122_is_rx_frame_valid()
nfc:
port100: reject frames whose declared length exceeds the received data
nfc:
st21nfca: validate ISO15693 inventory length
nfc:
st21nfca: validate received frame size
nfc:
virtual_ncidev: Add missing ioctl compat handler
NFS:
fix eof updates after NFSv4.2 fallocate/zero-range
ntfs3:
fix out-of-bounds read in ntfs_dir_emit() and hdr_find_e()
nvme-core:
align fabrics_q teardown with admin_q in nvme_free_ctrl
nvme-rdma:
fix -EIO cleanup order in queue_rq
ocfs2:
make ocfs2_calc_xattr_init() return void
octeontx2-af:
fix PF/CGX debugfs PCI bus lookup
octeontx2-af:
mcs: Clear stale X2P calibration state before calibration
omfs:
handle set_blocksize failures
openvswitch:
avoid reallocating confirmed conntrack labels
openvswitch:
fix wrong flag value in get_ipv6_ext_hdrs()
OPP:
of: Fix potential multiplication overflow when calculating freq
PCI/proc:
Fix race between pci_proc_init() and pci_bus_add_device()
PCI/sysfs:
Use kstrtobool() to parse the ROM attribute input
PCI:
altera: Protect root bus removal with rescan lock
PCI:
Avoid SBR for Qualcomm WCN6855/WCN7850 WiFi, SDX62/SDX65 modems
PCI:
intel-gw: Enable clock before PHY init
PCI:
iproc: Protect root bus removal with rescan lock
PCI:
mediatek: Protect root bus removal with rescan lock
PCI:
rockchip: Protect root bus removal with rescan lock
PCI:
Stop setting cached power state to 'unknown' on unbind
PCI:
switchtec: Add Gen6 Device IDs
PCI:
Wait for device readiness after D3hot -> D0uninitialized transition
perf test:
Change all remaining #!/bin/sh to #!/bin/bash
perf/arm-cmn:
Fix wp_dev_sel2 setting for multi-DTM configurations
perf/core:
Skip empty AUX records with only format flags
perf/ftrace:
Fix WARNING in __unregister_ftrace_function
perf/x86/intel:
Don't write PEBS_ENABLED on host<=>guest xfers if CPU has PEBS isolation, to fix stuck PEBS_ENABLED
perf/x86/intel:
Ensure KVM guest PEBS path doesn't set unwanted PERF_GLOBAL_CTRL bits
phonet:
check register_netdevice_notifier() error in phonet_device_init()
pinctrl:
meson: Fix typo in s4 group name
pinctrl:
renesas: rzv2m: Use -ENOTSUPP instead of -EOPNOTSUPP
pinctrl:
single: free the IRQ on domain creation failure
platform/x86:
dell-laptop: add Inspiron N5110 to touchpad LED quirk table
platform/x86:
intel-hid: Add HP ProBook x360 440 G1 to button_array_table
powerpc/eeh:
Fix recursive locking on devices without EEH sensitive driver
powerpc/iommu:
Fix the overflow validation in iommu_tce_check_ioba
powerpc/kexec_file:
Use inclusive range checks in add_usable_mem()
powerpc/pseries:
Ensure vpa,slb_shadow & dtl are unregistered during crash
ppp:
ppp_async: simplify tty disc_data access
ppp_async:
drop the errored frame instead of resetting its headroom
ppp_synctty:
ensure a writeable skb header
pppoatm:
ensure a writable skb header and linear data
ptp:
ocp: add shutdown callback
qnx4:
handle set_blocksize failures
raw:
annotate disconnect-side IPv4 match writers
rculist:
add list_splice_rcu() for private lists
RDMA/core:
fix refcount bug in iwpm_get_nlmsg_request()
RDMA/core:
Reject unregistering netdevs in ib_get_eth_speed
RDMA/efa:
Keep admin queues alive while IRQ is registered
RDMA/efa:
Keep EQ resources alive while IRQ is registered
RDMA/irdma:
Enforce local fence for IB_WR_REG_MR
RDMA/irdma:
Fix typo in SQ completions generation
RDMA/mad:
Fix receive buffer leak when PKey enforcement fails
RDMA/mlx5:
Fix state and counter desync on loopback enable failure
RDMA/mlx5:
Use QP port when decoding responder CQEs
RDMA/rtrs-clt:
Fix CQ pool leak when connect is interrupted
RDMA/rtrs-srv:
Fix integer underflow in process_read and process_write
RDMA/rxe:
insert mcg into mcg_tree only after rxe_mcast_add() succeeds
RDMA/siw:
Bound fragmented header copies by the remaining length
RDMA/siw:
Cleanup siw_accept
RDMA/siw:
Clear association under lock if siw_qp_modify fails in siw_accept
RDMA/siw:
Introduce siw_cep_set_free_and_put
RDMA/ucma:
Serialize join and leave on copy_to_user failure
RDMA/umem:
Be careful about boundary conditions in ib_umem_find_best_pgsz()
rds:
annotate data-race around rs_seen_congestion
rds:
filter RDS_INFO_* getsockopt by caller's netns
rds:
ib: Clear the sg list when mapping an MR fails
rds:
ib: use rds_conn_drop() on protocol version mismatch
regulator:
core: clamp voltage constraints before applying apply_uV
regulator:
da9121: Use subvariant ids in the I2C table
Revert "alpha:
don't leak hardware-fabricated FP exception bits to user space"
Revert "alpha:
fix ieee_swcr_to_fpcr setting FPCR_DNOD unconditionally"
Revert "arm64:
dts: qcom: sdm845: Fix the PCIe iommu-map entries"
Revert "arm64:
dts: qcom: sm8150: Fix the PCIe iommu-map entries"
Revert "arm64:
dts: qcom: sm8250: Fix the PCIe iommu-map entries"
Revert "arm64:
dts: qcom: sm8350: Fix the PCIe iommu-map entries"
Revert "arm64:
dts: qcom: sm8450: Fix the PCIe iommu-map entries"
Revert "arm64:
dts: qcom: sm8550: Fix the PCIe iommu-map entries"
Revert "Bluetooth:
btusb: Add ASUS USB-BT540 for Realtek 8761CU"
Revert "Bluetooth:
btusb: Add ASUS USB-BT600 for Realtek 8761CU"
Revert "nvme-apple:
Drop the PRP null check chicken bit"
Revert "nvme-apple:
Prevent shared tags across queues on Apple A11"
Revert "nvme-apple:
Reset q->sq_tail during queue init"
Revert "nvme:
apple: Add Apple A11 support"
Revert "perf cs-etm:
Avoid truncating AUX buffer sizes to int"
Revert "perf cs-etm:
Flush thread stacks after decoder reset"
Revert "perf tests:
Fix flakiness in BPF counters test on hybrid systems"
ring-buffer:
Acquire the lock with irqsave in rb_wake_up_waiters()
RISC-V:
KVM: Synchronize hrtimer callback during teardown
rtc:
aspeed: add AST2700 compatible
rtc:
bq32000: add delay between RTC reads
rtnl:
add helper to send if skb is not null
s390/cio:
Check pmcw.dnv before pmcw.ena in I/O entry points
s390/cio:
Fix cio_update_schib() to not cache invalid schib
s390/cio:
Fix NULL pointer dereference in ccw_device_get_util_str()
s390/cio:
Purge based on the cdev's online status
s390/crypto:
Fix missing scrub of temp buffers with AES ctr and gcm algorithm
s390/debug:
Do not register views for failed static debug areas
s390/debug:
Fix NULL pointer dereference in debug_info_copy()
s390/pci/docs:
Fix sriov_numvfs attribute name
s390/qeth:
allow bridgeport queries despite OS_MISMATCH
s390/zcore:
Removed unused variables
sched/fair:
Move is_core_idle() out of CONFIG_NUMA
sched/fair:
Reject misfit pulls onto busy SMT siblings on asym-capacity
scripts:
modpost: detect and report truncated buf_printf() output
scsi:
bfa: Reduce kernel stack usage in bfa_fcs_lport_fdmi_build_portattr_block()
scsi:
core: Do not block on tag allocation in scsi_eh_lock_door()
scsi:
hisi_sas: Grab sas_dev lock when traversing the members of sas_dev.list
scsi:
libiscsi_tcp: Check the data direction of a Data-In PDU
scsi:
megaraid_sas: Protect megasas_get_ctrl_info() in megasas_resume()
scsi:
mpi3mr: Fix NULL pointer dereference in mpi3mr_sas_port_add()
scsi:
mpi3mr: Fix target device refcount leak in mpi3mr_sas_port_add()
scsi:
mpt3sas: Avoid out-of-bounds cpumask_of_node() call in _base_assign_reply_queues()
scsi:
pm8001: Reject firmware update in fatal error state
scsi:
pm8001: Reject non-fatal dump when controller is crashed
scsi:
qla2xxx: Fix the ql2xfc2target parameter description
scsi:
target: iscsi: Fix hang for aborted WRITE_PENDING commands
scsi:
target: iscsi: Handle abort for WRITE_PENDING cmds
sctp:
avoid livelock while updating retransmit path
sctp:
close UDP tunnel sockets during netns teardown
sctp:
discard the rest of the packet on a stale-cookie error
sctp:
fix a TOCTOU race in SCTP_CMD_TIMER_START
sctp:
fix err_chunk memory leaks in INIT handling
sctp:
fix soft lockup from unpadded ASCONF-ACK parameter iteration
sctp:
hold asoc or transport before mod_timer() in timer handlers
sctp:
Unwind address notifier registration on failure
seg6:
set IPSKB_L3SLAVE from IP6SKB_L3SLAVE on IPIP decapsulation
selftests/alsa:
Fix the step check for INTEGER controls
selftests/bpf:
Fix flaky bpf_nf test when random NAT port is 0
selftests/bpf:
Update tests for new ct zone opts for nf_conntrack kfuncs
selftests/cgroup:
Fix cg_run_in_subcgroups ignoring arg parameter
selftests/ftrace:
Fix unique symbol check in kprobe_non_uniq_symbol.tc
selftests/landlock:
Add disconnected leafs and branch test suites
selftests/landlock:
Add layout1.refer_mount_root
selftests/landlock:
Add tests for access through disconnected paths
selftests/landlock:
Add tests for whiteout object creation
selftests/nci:
Fix out-of-bounds store on thread join
selftests/powerpc/tm:
Fix tcheck() reading uninitialised CR value
selftests:
mptcp: fix an UAF in mptcp_connect.c
selftests:
nci: Correct pthread_create return value check
selftests:
nci: Fix uninitialized family ID on missing attribute
selinux:
always fill AVC decision in avc_has_perm_noaudit()
serial:
8250: fix possible ISR soft lockup
sh:
push-switch: Reorder cleanup operations to avoid use-after-free bug
smb/client:
mark file sparse before emulating insert range
smb:
client: avoid leaking refcount in cifs_queue_oplock_break()
smb:
client: avoid leaking refcount when cifs_sb_tlink() fails
smb:
client: bound dirent name against end of SMB response in cifs_filldir
smb:
client: fix missing lower-bound check on DFS referral string offsets
smb:
client: fix next_buffer UAF and NextCommand bounds in compound PDUs
smb:
client: fix potential OOB read in smb3_enum_snapshots()
smb:
client: fix server->total_read for compound encrypted PDUs
smb:
client: fix smbd_connection leak on cifs_get_tcp_session() error
smb:
client: reject short Next offsets in parse_server_interfaces()
smb:
client: reject userspace cifs.idmap descriptions
smb:
client: transport: Fix debug printing in __release_mid()
smb:
client: validate POSIX create context length
soundwire:
cadence_master: wait and cancel cdns->work before clock stop
soundwire:
dmi-quirks: Disable ghost Realtek devices
soundwire:
only handle alert events when the peripheral is attached
soundwire:
validate DT compatible before parsing it
sparc64:
uprobes: add missing break
sparc:
Disable compat support with LLD
spi:
Add NULL check for spi_get_device_id() in spi_get_device_match_data()
spi:
core: Abort active target transfer on controller suspend
spi:
dw-dma: Wait for controller idle before completing Tx
spi:
dw: fix wrong RX_SAMPLE_DLY setting after resume
spi:
spi-zynqmp-gqspi: stop the controller on shutdown
spi:
xilinx: let transfers timeout in case of no IRQ
spi:
zynqmp-gqspi: Use devm_spi_alloc_host()
squashfs:
Add dictionary size range check to prevent shift-out-of-bounds
staging:
fbtft: make dirty_lock IRQ-safe
start_kernel:
Add __no_stack_protector function attribute
sunvdc:
fix -EIO issue due to lack of retries
sunvdc:
unmap LDC cookies when the descriptor send fails
tcp:
do not let tcp_rmem be set below 4096
tcp:
Don't call skb_clone_and_charge_r() for close()d listener in tcp_v6_do_rcv().
tcp:
exclude old ACKs from tcp fast path
tcp:
fix use-after-free of retransmit_skb_hint in tcp_send_synack()
tee:
optee: Allow MT_NORMAL_TAGGED shared memory
tg3:
clean up PHYLIB resources on probe failure
tg3:
use random MAC address when tg3_get_device_address fails
thermal/drivers/tegra/soctherma:
Switch to devm cooling device registration
thunderbolt:
Don't create multiple DMA tunnels on firmware connection manager
thunderbolt:
Keep the domain reference while processing hotplug
thunderbolt:
Keep XDomain reference during the lifetime of a service
thunderbolt:
Release request if tb_cfg_request() fails in __tb_xdomain_response()
thunderbolt:
Set tb->root_switch to NULL when domain is stopped
tick/broadcast:
Plug clockevents replacement race
tipc:
Fix a data race on mon->peer_cnt in mon_timeout()
tipc:
fix integer overflow in tipc_recvmsg() and tipc_recvstream()
tipc:
fix NULL deref in tipc_named_node_up() on empty publication list
tipc:
reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow
tls:
reject the combination of TLS and sockmap
tools/thermal/tmon:
Fix compilation warning for wrong format
tracing/histograms:
Simplify last_cmd_set()
tracing/probes:
Fix use-after-free on field name/type of events with multiple probes
tracing:
Disable KCOV instrumentation for trace_irqsoff.o
tracing:
Free histogram the field rejected for a bad modifier
tracing:
Free histogram the var ref when its initialization fails
tracing:
Free histogram var refs regardless of how often they are referenced
tracing:
Keep the entry count when the histogram stats allocation fails
tracing:
Let histogram values keep the percent and graph modifiers
tunnels:
Drop stale dst when building an ICMP error for PMTUD
ufs:
create the root dentry after loading cylinder metadata
ufs:
validate cylinder group metadata before caching it
USB:
cdc-acm: start bulk-IN polling when ALWAYS_POLL_CTRL is set
usb:
core: hcd: fix possible deadlock in rh control transfers
usb:
gadget: aspeed_udc: avoid past-the-end iterator in dequeue
usb:
gadget: goku_udc: avoid NULL deref of dev->driver in INT_USBRESET log
usb:
gadget: udc: skip pullup() if already connected
usb:
host: add ARCH_AIROHA in XHCI MTK dependency
usb:
usbtmc: don't store usb_device_id
usb:
xusbatm: don't rely on id table pointer arithmetic
usbip:
vhci_hcd: fix NULL deref in status_show_vhci
vdpa/ifcvf:
handle dev_set_name() failure in ifcvf_vdpa_dev_add()
vdpa_sim_blk:
reject out-of-range sector starts
veth:
manage XDP program pointers during channel resize
vhost-scsi:
flush backend after device ioctls
vhost-vdpa:
don't install the eventfd_ctx_fdget() error in config_ctx
virtio-console:
call scheduler when we free unused buffs
virtio-pci:
return IRQ_HANDLED after non-zero ISR
virtio_console:
do not free control-out buffers on remove
virtio_input:
reset device if input_register_device() fails
virtio_input:
stop callbacks before unregistering input device
vlan:
ensure sufficient headroom in vlan_dev_hard_header()
vrf:
Stop corrupting skb->csum when capturing CHECKSUM_COMPLETE packets
vsock:
use sk_acceptq_is_full() helper in all transports
vxlan:
reject dynamic fdb entries that reference a nexthop id
watchdog:
da9063: fix suspend/resume handling of HW_RUNNING watchdog
watchdog:
digicolor: Avoid division by zero
watchdog:
fix hrtimer start when pretimeout is zero
watchdog:
msc313e: Avoid division by zero
watchdog:
msc313e: Enable clock before accessing hardware registers
watchdog:
msc313e: Fix clock leak and spurious timer in settimeout()
watchdog:
msc313e: Fix NULL pointer dereference in PM callbacks
watchdog:
msc313e: Fix premature reset during timeout update
watchdog:
msc313e: Fix spurious reset on suspend
watchdog:
msc313e: Fix undefined behavior
watchdog:
msc313e: Propagate error code in resume()
watchdog:
msc313e: Sync timeout value if WDT was running at boot
watchdog:
sp5100_tco: Fix pci_dev reference leak in sp5100_tco_init()
watchdog:
sunxi_wdt: preserve boot-enabled watchdog
wifi:
ath11k: fix invalid data access in ath11k_dp_rx_h_undecap_nwifi
wifi:
ath9k_htc: don't store usb_device_id
wifi:
brcmfmac: fix lost 802.1x TX completion wakeup
wifi:
brcmsmac: fix UAF in brcms_free_timer()
wifi:
cfg80211: check IP header size in cfg80211_classify8021d()
wifi:
cfg80211: don't filter by BSS type when removing stale entries
wifi:
cfg80211: make TDLS management link-aware
wifi:
cfg80211: only group hidden BSSes with beacon entries
wifi:
cfg80211: trace: remove MAC_PR_{FMT,ARG}
wifi:
cfg80211: validate assoc response length before status and IE access
wifi:
cfg80211: validate IEs in cfg80211_wext_siwgenie()
wifi:
cfg80211: validate rx/tx MLME callback frame lengths before access
wifi:
iwlegacy: fix broadcast stations deallocation
wifi:
iwlwifi: acpi: validate WGDS table revision index
wifi:
iwlwifi: bound aligned TLV advance in FW parser
wifi:
iwlwifi: mvm: fix an off-by-1 boundary check
wifi:
iwlwifi: mvm: fix sched scan IE sizing
wifi:
libertas: reject short monitor TX frames
wifi:
libertas_tf: fix UAF in lbtf_free_adapter()
wifi:
libipw: fix key index receive bound checks
wifi:
libipw: reject too-short association responses
wifi:
libipw: reject too-short beacon and probe responses
wifi:
mac80211: add HE 6 GHz capability in the scan elems len
wifi:
mac80211: always allow transmitting null-data on TXQs
wifi:
mac80211: avoid WARN in set_bitrate_mask when sdata not in driver
wifi:
mac80211: don't access the TSF of a down interface
wifi:
mac80211: don't allow link changes when iface is down
wifi:
mac80211: don't call ieee80211_handle_reconfig_failure when not needed
wifi:
mac80211: don't RCU-dereference the mesh CSA settings we just set
wifi:
mac80211: handle TDLS negotiation with MLO
wifi:
mac80211: mesh: release the channel if start fails
wifi:
mac80211: require a peer station for TDLS setup confirm
wifi:
mac80211: reset the AP_VLAN tailroom counter on ifdown
wifi:
mac80211: rework ack_frame_id handling a bit
wifi:
mac80211: set up the TX info early to fix failure paths
wifi:
mac80211: suppress chanctx warning for debugfs reset
wifi:
mac80211: unlist vifs when their netdev is unregistered
wifi:
mac80211: validate deauth frame length before reason access
wifi:
mac80211_hwsim: don't hand frames to mac80211 while stopping
wifi:
mac80211_hwsim: reject undersized HWSIM_ATTR_TX_INFO
wifi:
mt76: mt7921: skip unknown CLC firmware records
wifi:
mt76: mt7921: validate CLC firmware records
wifi:
mt76: transform aspm_conf for pci_disable_link_state
wifi:
mwifiex: bound the pairwise-cipher OUI walk to the IE length
wifi:
mwifiex: fix IRQ leak using wrong index in MSI-X error path
wifi:
mwifiex: replace one-element arrays with flexible array members
wifi:
mwifiex: validate action frame fixed fields
wifi:
mwifiex: validate scan response extents
wifi:
nl80211: Increase ie_len size to prevent truncated IEs in new peer notifications
wifi:
nl80211: reject beacons with bad HE operation
wifi:
p54: require a full exp_if record in PDR_INTERFACE_LIST
wifi:
p54: validate curve data length in the calibration curve converters
wifi:
ralink: RT2X00: init EEPROM properly
wifi:
rsi: avoid reading TKIP MIC keys for non-TKIP ciphers
wifi:
rsi: fix heap OOB write on key removal
wifi:
rsi: validate beacon length before fixed buffer copy
wifi:
rtw88: Add NULL check for chip->edcca_th in rtw_fw_adaptivity_result()
wifi:
rtw88: delete timer and free skb queue when unloading
wifi:
rtw89: pci: enable LTR based on pcie control register
wifi:
virt_wifi: don't transfer operstate before register
wifi:
virt_wifi: free skb when disconnected
wifi:
wilc1000: fix out-of-bounds read in P2P public action frames
wifi:
wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext()
wifi:
wlcore: release runtime PM ref on regdomain config failure
workqueue:
Fix NULL current_pwq deref in flush dependency check
workqueue:
Introduce from_work() helper for cleaner callback declarations
writeback:
bound cleanup_offline_cgwb() rescans by rotating scanned inodes
writeback:
report a Tasks-RCU quiescent state per cgwb drain pass
x86/PCI:
Disable enhanced atomics on AMD NBIO 7.7 and 7.11
xen/front-pgdir-shbuf:
free grant reference head on errors
xen/gntalloc:
validate grant count before allocation
xfrm:
add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject()
xfrm:
avoid RCU warnings around the per-netns netlink socket
xfrm:
fix compat ALLOCSPI request use-after-free
xfs:
fix blockgc group quota scanning when usrquota isn't enforced
xhci:
Prevent queuing new commands if xhci is inaccessible
xprtrdma:
Add request-pool slack for delayed recycling
xsk:
Use a 32-bit compare in xsk_map_gen_lookup