Changelog
in Linux kernel
6.12.114
accel/ivpu:
Allow to import single buffer into multiple contexts
accel/ivpu:
Fix page fault in ivpu_bo_unbind_all_bos_from_context()
accel/ivpu:
Fix race condition when mapping dmabuf
accel/ivpu:
Rework bind/unbind of imported buffers
accel/qaic:
Add config structs for supported cards
ACPI:
bus: Introduce acpi_bus_get_primary_device()
ACPI:
platform: Use acpi_bus_get_primary_device()
afs:
Fix reinitialisation of the inode, in particular ->lock_work
afs:
Fix UAF when sending a message
ALSA:
mtpav: shut down output timer before card teardown
ALSA:
seq: avoid stale FIFO cells during resize
ALSA:
seq: Clean up fifo locking with guard
ALSA:
seq: oss: Fix UAF at handling events with embedded SysEx data
ALSA:
seq: oss: Serialize readq reset state with q->lock
ALSA:
usb-audio: Prevent excessive number of frames
amd/amdkfd:
enhance kfd process check in switch partition
amt:
Don't support cross-netns setup.
apparmor:
fix deadlock in complain-mode change_hat
apparmor:
fix unconfined user namespace restriction forced stack
arm64:
ptrace: Keep 'orig_x0' in-sync with x0 on syscall entry
ASoC:
amd: acp-mach-common: Add missing error check for clock acquisition
ASoC:
Intel: avs: Do not share the name pointer between components
ASoC:
Intel: avs: Refactor and fix init_config access
ASoC:
Intel: avs: Use topology information for endpoint numbers
ASoC:
qcom: q6asm: drop DSP responses for closed data streams
ASoC:
qcom: q6asm: handle the responses after closing
ASoC:
SOF: ipc4-pcm: Continue the pipeline trigger in case of IPC timeout
ASoC:
SOF: pcm: Add snd_sof_pcm specific wrappers for dev_dbg() and dev_err()
ASoC:
SOF: pcm: Move period/buffer configuration print after platform open
ASoC:
SOF: Relocate and rework functionality for PCM stream freeing
ata:
libata-core: Add NOLPM quirk for PNY CS900 1TB SSD
ata:
libata-core: Disable LPM on Silicon Motion MD619{H,G}XCLDE3TC
ata:
libata-scsi: do not lose CHECK CONDITION for failed ATAPI commands
ax25:
Remove broken autobind
blk-cgroup:
delay freeing policy data after rcu grace period
blk-cgroup:
fix race between policy activation and blkg destruction
blk-iocost:
clear delay state when freeing policy data
blk-iolatency:
clear delay state when freeing policy data
block:
zero non-PI portion of auto integrity buffer
Bluetooth:
6lowpan: avoid untracked enable work
Bluetooth:
do not leak an hci_conn when a second LE connect is rejected
Bluetooth:
hci_event: move wake reason storage into validated event handlers
Bluetooth:
hci_sync: extend conn_hash lookup critical sections
Bluetooth:
hci_sync: Fix command skb lifetime during scan setup
Bluetooth:
hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists
Bluetooth:
hci_sync: hold conn in hci_connect_acl/le_sync() callbacks
Bluetooth:
hci_sync: hold conn in hci_connect_big_sync() callback
Bluetooth:
hci_sync: hold conn in hci_connect_pa_sync() callback
Bluetooth:
hci_sysfs: Fix NULL pointer dereference in device_del()
Bluetooth:
ISO: fix race of kfree vs kref_get_unless_zero
Bluetooth:
ISO: hold sk properly in iso_conn_ready
Bluetooth:
ISO: lock sk in iso_connect_ind
Bluetooth:
ISO: zero the sockaddr before returning it in getname
Bluetooth:
L2CAP: access chan->conn safely in get/setsockopt
Bluetooth:
L2CAP: convert to getsockopt_iter
Bluetooth:
L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind
Bluetooth:
RFCOMM: connect the session socket without rfcomm_mutex
bnxt:
fix head underflow on XDP head-grow
bnxt_en:
Disable EOP for TPA on all chips to prevent data corruption
bnxt_en:
Handle partially initialized auxiliary devices
bnxt_en:
set backing store type from query type
bnxt_en:
Update firmware interface spec to 1.10.3.85
bpf, sockmap:
Account for receive queue in FIONREAD without a verdict program
bpf, xdp:
move offload check into dev_xdp_install()
bpf:
backtrack_insn(): Handle ld_{abs,ind} subprog exit edge
bpf:
backtracking shouldn't clear outer frame R1-R5 for callbacks
bpf:
Check ancestor frames for rbtree callbacks
bpf:
Check pointer type for all atomic RMW paths
bpf:
Check sk_state before sk_protocol in bpf_tcp_*_syncookie
bpf:
check_cond_jmp_op(): properly infer if register is null
bpf:
Clear buf on error in __bpf_get_task_stack
bpf:
Clear rb node linkage when freeing bpf_rb_root
bpf:
Compare iterator types during state pruning
bpf:
Disable migration when cloning sock storage
bpf:
Disable migration when destroying sock storage
bpf:
Don't infer non-NULL from a pointer with an unbounded offset
bpf:
don't rewrite bpf_fastcall patterns entered by a jump
bpf:
Factor callchain_finalize function from __bpf_get_stack
bpf:
Factor callchain_store function from __bpf_get_stack
bpf:
Factor out atomic_ptr_type_ok()
bpf:
Factor out check_atomic_rmw()
bpf:
Factor out check_load_mem() and check_store_reg()
bpf:
Fix exception exit lock checking for subprogs
bpf:
Fix incorrect pruning due to atomic fetch precision tracking
bpf:
Fix mmap_lock leak in irq_work path
bpf:
Fix netns reference imbalance in conntrack kfuncs
bpf:
Fix tcx/netkit detach permissions when prog fd isn't given
bpf:
Fix UAF in sock clone early bailouts
bpf:
Fix WARNING in bpf_tracing_link_release
bpf:
Guard conntrack opts error writes
bpf:
Keep refcount_acquire nullable for borrowed RCU kptrs
bpf:
mark a NULL call argument precise
bpf:
Mark bpf_refcount field as unique
bpf:
Mark NULL kptr stores precise
bpf:
Mark signal tracepoint siginfo arguments as scalar
bpf:
Mark syscall helpers as sleepable
bpf:
Preserve inner map identity in callback frames
bpf:
Reject >8 byte return values on return-reading trampoline paths
bpf:
Reject legacy packet loads from callbacks
bpf:
Reject MEM_ALLOC BTF accesses past object bounds
bpf:
Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max
bpf:
Reject sleepable BPF_LSM_CGROUP programs at load time
bpf:
Reject writes through untrusted BTF pointers
bpf:
Remove migrate_{disable|enable} in bpf_obj_free_fields()
bpf:
Remove trace_in argument from __bpf_get_stack
bpf:
Use rcu_read_lock_dont_migrate in bpf_sk_storage.c
bpf:
zero extend the result of an arena 32-bit cmpxchg
bpf:
Zero queue and stack outputs on lock failure
btrfs:
always wait for ordered extents to avoid OE races
btrfs:
check if root is readonly when setting posix acl
btrfs:
defrag: fix deadlock between defrag and delalloc space reservation
btrfs:
do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure()
btrfs:
don't BUG() on unexpected delayed ref type in run_one_delayed_ref()
btrfs:
fix double free of qgroup record after failure to add delayed ref head
btrfs:
fix EEXIST abort due to non-consecutive gaps in chunk allocation
btrfs:
fix zero size inode with non-zero size after log replay
btrfs:
initialize inode mapping flags for cached inodes
btrfs:
lzo: reject compressed segment that overflows the compressed input
btrfs:
lzo: reject inline extents without valid headers
btrfs:
only release the dirty pages io tree after successful writes
btrfs:
qgroup: fix a wrong length calculation in qgroup_free_reserved_data()
btrfs:
remove 'reserved' argument from btrfs_pin_extent()
btrfs:
skip global block reserve accounting for rescue mounts
btrfs:
tree-log: don't use token set/get accessors in fill_inode_item()
btrfs:
zoned: don't clobber the extent buffer when zeroing it out
btrfs:
zstd: fix lost wakeup when waiting for a workspace
ceph:
always call ceph_shift_unused_folios_left()
ceph:
cap delegated inode count in ceph_parse_deleg_inos()
ceph:
do not skip the first folio of the next object in writeback
ceph:
extend ceph_writeback_ctl for ceph_writepages_start() refactoring
ceph:
fix crash after fscrypt_encrypt_pagecache_blocks() error
ceph:
fix num_ops off-by-one when crypto allocation fails
ceph:
fix UAF in check_new_map() on session freed during unlock
ceph:
introduce ceph_process_folio_batch() method
ceph:
introduce ceph_submit_write() method
ceph:
Remove call to PagePrivate2()
ceph:
Remove uses of page from ceph_process_folio_batch()
cgroup/rstat:
validate cpu before css_rstat_cpu() access
cifs:
call pagecache_isize_extended() in cifs_setsize() when extending
cifs:
fix cifsFileInfo leak on kmalloc failure in deferred close drain paths
cifs:
prevent readdir from changing file size due to stale directory metadata
clk:
mediatek: pllfh: Fix IO remapping leak in register_pllfhs error path
clk:
sunxi-ng: h616: Reparent CPU clock during frequency changes
clk:
sunxi-ng: h616: Reparent GPU clock during frequency changes
clk:
thead: th1520-ap: set all AXI clocks to CLK_IS_CRITICAL
clocksource/drivers/samsung_pwm:
Switch to raw_spinlock_t type
coresight-tmc:
change tmc_drvdata spinlock's type to raw_spinlock_t
coresight:
ete: Always save state on power down
coresight:
etm4x: missing cscfg_csdev_disable_active_config() in perf enable
coresight:
ETR: Fix ETR buffer use-after-free issue
coresight:
holding cscfg_csdev_lock while removing cscfg from csdev
coresight:
tmc-etr: Fix race condition between sysfs and perf mode
crypto:
hisilicon/hpre - enable all clusters clock gating
crypto:
hisilicon/qm - request reserved interrupt for virtual function
crypto:
x86/aegis - Add missing error checks
crypto:
x86/aegis - Fix sleeping when disallowed on PREEMPT_RT
crypto:
x86/aegis128 - eliminate some indirect calls
crypto:
x86/aegis128 - improve assembly function prototypes
crypto:
x86/aegis128 - optimize length block preparation using SSE4.1
cxl/mbox:
validate payload size before accessing contents in cxl_payload_from_user_allowed()
cxl/region:
Block region delete during region creation
cxl/region:
Resolve region deletion races
cxl:
Fix CXL_HEADERLOG_SIZE to match RAS Capability size
dibs:
fix use-after-free of dmb_node in loopback attach/detach/unregister
dm-integrity:
fix buffer overflow in inline mode with large tag size
dm-integrity:
fix buffer overflow with keyed discard
dm-integrity:
rename internal_hash
dm-integrity:
replace forgeable discard filler with a keyed sector marker
dm-integrity:
use internal variable for digestsize
dm-verity-fec:
fix reading parity bytes split across blocks (take 3)
dm-verity:
fix buffer overflow in FEC calculation
dm:
limit swapping tables for devices with zone write plugs
dmaengine:
idxd: fix double free of wq, engine, and group structs
dmaengine:
ti: k3-udma-glue: Drop skip_fdq argument from k3_udma_glue_reset_rx_chn
dmaengine:
xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout
dpll:
fix NULL deref in dpll_device_ops() during teardown race
driver core:
Add device_link_test() for testing device link flags
driver core:
Avoid warning when removing a device while its supplier is unbinding
Drivers:
hv: vmbus: Skip VMBus module cleanup for non-nested root partition
drm/amd/display:
Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35
drm/amd/display:
check if dml21_add_phantom_plane() is successful
drm/amd/display:
disable replay when crc source is enabled
drm/amd/display:
Fix dangling pointer in CRTC reset function
drm/amd/display:
Fix dangling pointer in plane reset function
drm/amd/display:
Fix dc_link NULL handling in HPD init
drm/amd/display:
Fix divide-by-zero in calculate_mcache_setting on zero viewport
drm/amd/display:
Fix NULL pointer dereference in dcn401_init_hw()
drm/amd/display:
Fix out-of-bounds read in dp_get_eq_aux_rd_interval()
drm/amd/display:
Resize MST HDCP per-connector arrays to 32
drm/amd/display:
use kvzalloc to allocate struct dc
drm/amd/display:
Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED
drm/amd:
Create a device link between APU display and XHCI devices
drm/amdgpu/atombios:
drop empty function
drm/amdgpu/ras:
add ras_suspend callback and use it for cp_ecc_error_irq
drm/amdgpu/vcn:
set no_user_fence for VCN v4.0 enc ring
drm/amdgpu:
Add wrapper for freeing vbios memory
drm/amdgpu:
Bound GPIO I2C table entry count from VBIOS
drm/amdgpu:
fix amdgpu_hmm_range_get_pages
drm/amdgpu:
Fix kernel panic during driver load failure
drm/amdgpu:
force complete the KIQ ring fences on reset
drm/amdgpu:
force complete the MES ring fences on reset
drm/amdgpu:
Release VFCT ACPI table reference
drm/amdgpu:
Remove unused amdgpu_i2c functions
drm/amdgpu:
rework i2c init and fini
drm/amdgpu:
skip the VMID 0 flush for VRAM
drm/amdgpu:
Skip vcn poison irq release on VF
drm/amdgpu:
Update SRIOV Exchange Headers for RAS Telemetry Support
drm/amdgpu:
Use dbg level for VBIOS check messages
drm/amdkfd:
Add bounds check for CRAT subtype length
drm/amdkfd:
Add TLB flush after MES queue eviction/suspension
drm/amdkfd:
Check bounds on CRIU restore queue type and mqd size
drm/amdkfd:
clamp v9 CRIU control stack checkpoint copy to BO size
drm/amdkfd:
Fix error path at svm_migrate_copy_to_ram
drm/amdkfd:
Fix infinite loop parsing CRAT with zero subtype length
drm/amdkfd:
Fix partial migrate issue
drm/amdkfd:
fix SMI event cross-process information leak
drm/amdkfd:
Fix the case that vm range is hole at svm_migrate_copy_to_vram
drm/amdkfd:
return migration pages from copy function
drm/amdkfd:
return migration pages from copy function - again
drm/exynos:
vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl()
drm/gud:
validate GUD_ROTATION_0 is present in supported rotations
drm/i915/crt:
convert to struct intel_display
drm/i915/display:
convert I915_STATE_WARN() to struct intel_display
drm/i915/display:
pass display to intel_crtc_for_pipe()
drm/i915/gmbus:
convert to struct intel_display
drm/i915/gt:
Fix NULL deref on sched_engine alloc failure
drm/i915/mst:
limit DP MST ESI service loop
drm/i915/vga:
Convert VGA code to intel_display
drm/i915:
document range_overflows() and range_end_overflows() macros
drm/i915:
Grab intel_display from the encoder to avoid potential oopsies
drm/i915:
rename range_overflows_end() to range_end_overflows()
drm/mediatek:
dsi: Store driver data before invoking mipi_dsi_host_register
drm/msm/adreno:
Fix a reference leak in a6xx_gpu_init()
drm/msm:
always recover the gpu
drm/msm:
don't tear down KMS twice when KMS init fails
drm/msm:
Only fini scheduler after successful init
drm/msm:
Recover HW before retire hung submit
drm/nouveau:
fix a use-after-free in r535_gsp_rpc_push()
drm/panfrost:
Fix scheduler workqueue bug
drm/panthor:
Add vm_bind region with kbo range overlap check
drm/panthor:
Always use the IRQ-safe variant when acquiring the fence lock
drm/panthor:
Prevent potential UAF in group creation
drm/rockchip:
vop2: Consistently use dev_err_probe()
drm/rockchip:
vop2: fail cleanly if missing a primary plane for a video-port
drm/rockchip:
vop2: Register the primary plane and overlay plane separately
drm/sched:
Use struct for drm_sched_init() params
drm/tilcdc:
Fix removal actions in case of failed probe
drm/vc4:
Fix firmware reference leak in vc4_drm_bind()
drm/vc4:
Shut down BO cache timer before teardown
drm/vc4:
Use video aperture helpers
drm/virtio:
Add a helper to map and note the dma addrs and lengths
drm/virtio:
Use drm_gem_plane_helper_prepare_fb()
drm/virtio:
use the DMA API for resource backing on Xen
drm/vmwgfx:
Stop using dev_private to store driver data.
drm/vmwgfx:
validate pitch coming from userspace
drm/xe/guc:
Add devm release action to safely tear down CT
drm/xe/guc:
Keep scheduler timeline name alive
drm/xe:
Don't allow evicting of BOs in same VM in array of VM binds
drm:
renesas: rz-du: mipi_dsi: fix kernel panic when rebooting for some panels
EDAC/igen6:
Add polling support
EDAC/igen6:
Fix call trace due to missing release()
EDAC/igen6:
Fix NULL pointer dereference
EDAC/igen6:
Fix the flood of invalid error reports
EDAC/igen6:
Initialize edac_op_state according to the configuration data
EDAC/igen6:
Skip absent memory controllers
erofs:
disable LZ4 rolling decompression for now
erofs:
fix interlaced ztailpacking pclusters
erofs:
fix metabuf leak in inode xattr initialization
esp:
do not unref managed frag pages in esp_ssg_unref()
ethtool:
module: call ethnl_ops_complete() on module flash errors
ethtool:
rss: fix indir_table and hkey leak on get_rxfh failure
eventfs:
Use children field for rcu head and add memory barriers
ext2:
Fix lost inode updates for IS_SYNC inodes
ext4:
fix ABBA deadlock in ext4_xattr_inode_cache_find()
f2fs:
avoid reading already updated pages during GC
f2fs:
fix data loss caused by incorrect use of nat_entry flag
f2fs:
fix fsck inconsistency caused by FGGC of node block
f2fs:
fix fsck inconsistency caused by incorrect nat_entry flag usage
f2fs:
fix to avoid potential deadloop in f2fs_fsync_node_pages()
f2fs:
quota: fix to avoid warning in dquot_writeback_dquots()
f2fs:
read COW data with the original inode during atomic write
fbdev:
omap2: fix inconsistent lock returns in omapfb_mmap
fbdev:
omap2: fix use-after-free in omapfb_mmap
fbdev:
Wrap user-invoked calls to fb_set_var() in helper
fcntl:
refuse F_SET_RW_HINT on an immutable inode
firewire:
ohci: fix NULL pointer dereference in ar_context_release
firmware:
arm_ffa: Add support for IMPDEF value in the memory access descriptor
firmware:
arm_ffa: Fix Endpoint Memory Access Descriptor offset calculation
firmware:
arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit()
firmware:
arm_scmi: Fix SCMI device destroy lifetimes
fs/ntfs3:
Accumulated refactoring changes
fs/resctrl:
Prevent use-after-free in rdtgroup_kn_put()
functionfs:
fix the open/removal races
fwctl/bnxt_en:
Refactor aux bus functions to be more generic
gcov:
use atomic counter updates to fix concurrent access crashes
genirq/proc:
Size interrupt directory names for 10-digit interrupt numbers
genirq/proc:
Switch to lock guards
genirq:
Consistently use '%u' format specifier for unsigned int variables
gfs2:
fix memory leaks in gfs2_fill_super error path
gpio:
pca953x: fix pca953x_irq_bus_sync_unlock regmap lock
gpiolib:
Allow to use setters with return value for output-only gpios
gpiolib:
initialize return value in gpiochip_set_multiple()
gpiolib:
introduce gpio_chip setters that return values
gpiolib:
make value setters have return values
gpiolib:
rework the wrapper around gpio_chip::set_multiple()
gpiolib:
wrap gpio_chip::set()
greybus:
raw: fix use-after-free if write is called after disconnect
greybus:
raw: fix use-after-free on cdev close
HID:
core: Add reserved item tag for main items
HID:
core: Mitigate potential OOB by removing bogus memset()
HID:
logitech-hidpp: Fix FF device cleanup on init failure
HID:
rate-limit hid_warn to prevent log flooding
HID:
steam: Reject short reads
hwmon:
(asus_rog_ryujin) Add per-device configuration
hwmon:
(asus_rog_ryujin) Rely on subsystem locking
hwmon:
(asus_rog_ryujin) Validate HID report lengths
hwmon:
(lm90) Add lock protection to lm90_alert
hwmon:
(lm90) Stop work before releasing hwmon device
hwmon:
(pmbus) Fix type confusion in notification logic
hwmon:
(pmbus/core) honor vrm_version in pmbus_data2reg_vid()
i3c:
master: Fix recursive locking during device registration
i3c:
master: svc: Fix i3c_master_get_free_addr return check
i3c:
master: svc: Fix missed IBI after false SLVSTART on NPCM845
i3c:
master: svc: Fix npcm845 FIFO empty issue
i3c:
master: svc: Fix npcm845 FIFO_EMPTY quirk
i3c:
master: svc: Fix npcm845 invalid slvstart event
i3c:
master: svc: Prevent IRQ storm from false SLVSTART on NPCM845
i3c:
mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue
i3c:
mipi-i3c-hci: Fix race in DMA ring dequeue
i3c:
mipi-i3c-hci: Preserve RUN bit when aborting DMA ring
ice:
change XDP RxQ frag_size from DMA write length to xdp.frame_sz
ice:
fix double-free of tx_buf skb
ice:
fix use-after-free in dynamic port cleanup
ice:
ptp: don't WARN when controlling PF is unavailable
idpf:
bound interrupt-vector register fill to the allocated array
idpf:
fix error handling in the init_task on load
idpf:
fix max_vport related crash on allocation error during init
ieee802154:
Avoid calling WARN_ON() on -ENOMEM in cfg802154_switch_netns()
io_uring/napi:
cap busy_poll_to 10 msec
io_uring/napi:
clean up __io_napi_do_busy_loop
io_uring/napi:
improve __io_napi_add
io_uring/napi:
protect concurrent io_napi_entry timeout accesses
io_uring/napi:
Use lock guards
io_uring/rw:
free potentially allocated iovec on cache put failure
io_uring:
defer eventfd signaling when queued from a wakeup handler
iomap:
guard io_size EOF trim against concurrent truncate underflow
iommu/amd:
Disable AMD IOMMU if CMPXCHG16B feature is not supported
iommu/amd:
Do not reallocate GA log buffers on resume
iommu/amd:
Fix ivrs_base memleak in early_amd_iommu_init()
iommu/iommufd:
Fix IOPF group ownership UAF
iommu/s390:
handle IOAT registration based on domain
iommu/s390:
Make attach succeed when the device was surprise removed
iommu/s390:
set appropriate IOTA region type
iommu/tegra241-cmdqv:
Don't fall back to a freed smmu after devm_krealloc()
iommu/tegra241-cmdqv:
Fix VINTF0 leak on the init-failure path
iommu/vt-d:
Avoid NULL pointer dereference or refcount corruption
iommu/vt-d:
Flush context cache with correct SID when tearing down aliases
ip6_gre:
remove obsolete ERSPAN PMTU update
ip6mr:
do not clone dst in ip6mr_cache_report()
Linux:
ipmi:ssif: Clean up kthread on errors
ipv4:
igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer()
ipv6:
ioam: fix potential NULL dereferences in __ioam6_fill_trace_data()
ipv6:
mcast: use rcu_assign_pointer() for __rcu list updates
ipvs:
revalidate ihl to prevent out-of-bounds access
irqwork:
Move data struct to a types header
ixgbe:
do not configure xps for XDP queues
kasan:
avoid sleepable page allocation from atomic context
ksmbd:
defer publishing granted locks to prevent UAF/double-free race
ksmbd:
detach blocked lock requests before freeing
ksmbd:
fix heap out-of-bounds write in krb5_authenticate()
ksmbd:
fix maximum allowed access checks
ksmbd:
fix signededness bug in smb_direct_prepare_negotiation()
ksmbd:
fix slab-out-of-bounds read in ksmbd_alloc_user()
ksmbd:
fix tree connection use-after-free in smb2_tree_connect()
ksmbd:
prevent path traversal bypass by restricting caseless retry
ksmbd:
remove redundant DACL check in smb_check_perm_dacl
ksmbd:
safely discard unregistered deferred locks
ksmbd:
scope session state changes to bound connections
ksmbd:
serialize oplock close with pending break ownership
ksmbd:
validate NTLMv2 response before updating session key
KVM:
arm64: Take the SRCU lock for page table walks in fault injection and AT emulation
KVM:
arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables
KVM:
arm64: vgic: Handle race between interrupt affinity change and LPI disabling
KVM:
Export hardware virtualization enabling/disabling functions
KVM:
guest_memfd: Treat memslot binding offset+size as unsigned values
KVM:
nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN
KVM:
nSVM: Avoid clearing VMCB_LBR in vmcb12
KVM:
nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT
KVM:
nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state
KVM:
s390: Fix FOLL_*/FAULT_FLAG_* confusion
KVM:
s390: Fix memory corruption by not reinjecting CK machine checks
KVM:
s390: move gmap_shadow_pgt_lookup() into kvm
KVM:
s390: move pv gmap functions into kvm
KVM:
s390: pv: fix race when making a page secure
KVM:
s390: use __kvm_faultin_pfn()
KVM:
s390: wrapper for KVM_BUG
KVM:
SEV: Drop FOLL_WRITE for encrypted region registration
KVM:
SEV: Protect *all* of sev_mem_enc_register_region() with kvm->lock
KVM:
SEV: Use long-term pin when registering encrypted memory regions
KVM:
SVM: Add missing save/restore handling of LBR MSRs
KVM:
x86: Drop superfluous kvm_lapic_set_base() call when setting APIC state
KVM:
x86: Move kvm_set_apic_base() implementation to lapic.c (from x86.c)
KVM:
x86: Move update_cr8_intercept() to lapic.c
KVM:
x86: Rename "governed features" helpers to use "guest_cpu_cap"
KVM:
x86: Rename APIC base setters to better capture their relationship
KVM:
x86: Unconditionally recompute CR8 intercept on PPR update
KVM:
x86: Use active memslots for the per-vCPU MMIO cache
libceph:
Fix potential out-of-bounds access in __ceph_x_decrypt()
Linux:
Linux 6.12.114
lockd, nfsd:
RCU-protect nlmsvc_ops dispatch
LoongArch:
BPF: Refactor jump offset calculation in tail call
LoongArch:
BPF: Zero-extend signed ALU32 div/mod results
LoongArch:
Fix address space mismatch in kexec command line lookup
md raid:
fix hang when stopping arrays with metadata through dm-raid
md/raid1,raid10:
fix bio accounting for split md cloned bios
md/raid1,raid10:
fix deadlock in read error recovery path
md/raid1,raid10:
fix error-path detection with md_cloned_bio()
md/raid10:
fix writes_pending leak on write request failures
md/raid1:
fix writes_pending and barrier reference leaks on write failures
md:
init bioset in mddev_init
md:
replace wait loop with wait_event() in md_handle_request()
media:
chips-media: wave5: Fix Null reference while testing fluster
media:
chips-media: wave5: Release m2m_ctx after Instance Removed from List
media:
stm32-dcmipp: Return queued buffers on start_streaming() failure
media:
stm32: dcmipp: replace s_stream with enable/disable_streams
media:
stm32: dcmipp: use v4l2_subdev_is_streaming
media:
v4l2-mem2mem: Add a kref to the v4l2_m2m_dev structure
media:
verisilicon: Avoid G2 bus error while decoding H.264 and HEVC
media:
verisilicon: Fix kernel panic due to __initconst misuse
mlx5:
Fix default values in create CQ
mm/huge_memory:
transfer the pmd dirty bit to the folio on zap
mm/hugetlb:
initialize gigantic bootmem hugepage struct pages earlier
mm/hugetlb:
refactor code around vmemmap_walk
mm/hugetlb_vmemmap:
fix incorrect vmemmap restore in rollback
mm/mglru:
fix and remove redundant unevictable folio handling
mm/mglru:
reset page lru tier bits when activating
mm/mglru:
use the common routine for dirty/writeback reactivation
mm/mremap:
fix locked_vm leak by splitting VMA for MREMAP_DONTUNMAP
mm/mremap:
fix locked_vm leak from MREMAP_DONTUNMAP self-merge
mm/mremap:
fix WARN with uffd that has remap events disabled
mm/page_owner:
use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg()
mm/page_table_check:
skip special zero mappings
mm/vmalloc, mm/kasan:
respect gfp mask in kasan_populate_vmalloc()
mm:
fix uprobe pte be overwritten when expanding vma
mmc:
vub300: fix use-after-free on disconnect
mmc:
vub300: fix use-after-free on probe failure
mmc:
vub300: rename probe error labels
mmc:
vub300: Use devm_mmc_alloc_host() helper
mpls:
Add mpls_dev_rcu().
mpls:
Add mpls_route_input().
mpls:
add seqcount to protect the platform_label{,s} pair
mpls:
Convert mpls_dump_routes() to RCU.
mpls:
Hold dev refcnt for mpls_nh.
mpls:
Pass net to mpls_dev_get().
mpls:
Protect net->mpls.platform_label with a per-netns mutex.
mpls:
Set rt->rt_nhn just before returning from mpls_nh_build_multi().
mpls:
Unify return paths in mpls_dev_notify().
namespace:
check the mounts before reading their parents in pivot_root()
namespace:
check the target before walking it in do_mount_setattr()
namespace:
don't inherit MNT_UMOUNT in clone_mnt()
namespace:
handle mount locking for automounts correctly
namespace:
unhash a dentry before detaching the mounts on it
net/handshake:
hand off the pinned file reference to accept_doit
net/liquidio:
drop cached VF pci_dev LUT
net/mlx5:
Fix typo of MLX5_EQ_DOORBEL_OFFSET
net/mlx5:
HWS, denote how refcounts are protected
net/mlx5:
HWS, fix bad parameter in CQ creation
net/mlx5:
HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow
net/mlx5:
HWS, Fix memory leak in hws_pool_buddy_init error path
net/mlx5:
HWS, handle returned error value in pool alloc
net/mlx5:
HWS, Make pool single resource
net/mlx5:
HWS, Refactor pool implementation
net/mlx5:
HWS, Remove unused element array
net/mlx5:
HWS, simplify allocations as we support only FDB
net/mlx5:
HWS, update flow - remove the use of dual RTCs
net/mlx5:
Store the global doorbell in mlx5_priv
net/mlx5e:
Fix publication race for priv->channel_stats[]
net/mlx5e:
Move representor vnic reporter to eswitch devlink port
net/mlx5e:
Prepare for using different CQ doorbells
net/mlx5e:
RX, Fix XDP multi-buf frag counting for legacy RQ
net/mlx5e:
RX, Fix XDP multi-buf frag counting for striding RQ
net/sched:
account classifier filter allocations to memcg
net/sched:
act_ife: Only operate on Ethernet frames
net/sched:
add qstats_cpu_drop_inc() helper
net/sched:
cls_u32: validate offshift to prevent shift-out-of-bounds
net/sched:
Fix backlog accounting in qdisc_dequeue_internal
net/sched:
Handle TC_ACT_REDIRECT from qdisc filter chains
net:
Add ->exit_rtnl() hook to struct pernet_operations.
net:
add getsockopt_iter callback to proto_ops
net:
Add ops_undo_single for module load/unload.
net:
airoha: Add missing bits in airoha_qdma_cleanup_tx_queue()
net:
airoha: Do not read uninitialized fragment address in airoha_dev_xmit()
net:
airoha: fix BQL imbalance in TX path
net:
bridge: arp/nd proxy: fix reading neigh ha
net:
do not acquire dev->tx_global_lock in netdev_watchdog_up()
net:
emac: Fix NULL pointer dereference in emac_probe
net:
ethernet: ti: am65-cpsw: streamline RX queue creation and cleanup
net:
Factorise setup_net() and cleanup_net().
net:
Fix wild-memory-access in __register_pernet_operations() when CONFIG_NET_NS=n.
net:
ibm: emac: use devm_platform_ioremap_resource
net:
ibm: emac: use platform_get_irq
net:
ioam6: fix OOB and missing lock
net:
mana: Guard mana_remove against double invocation
net:
phonet: do not BUG_ON() in pn_socket_autobind() on failed bind
net:
plumb extack in __dev_change_net_namespace()
net:
pull headers in qdisc_pkt_len_segs_init()
net:
qrtr: Drop the MHI auto_queue feature for IPCR DL channels
net:
Remove conflicting altnames for dying netns in __dev_change_net_namespace().
net:
rename netns_local to netns_immutable
net:
serialize netif_running() check in enqueue_to_backlog()
net:
stmmac: fix dma mapping leak in stmmac_tso_xmit()
net:
stmmac: fix oops when split header is enabled
net:
tap: fix wrong transport_header when sending VLAN-tagged frame
net:
team: fix NULL pointer dereference in team_xmit during mode change
net:
team: Remove unused team_mode_op, port_enabled
net:
team: Rename port_disabled team mode op to port_tx_disabled
net:
team: stop reusing skb after queue override
net:
vxlan: prevent NULL deref in vxlan_xmit_one
net:
watchdog: fix refcount tracking races
net:
xilinx: axienet: Free outstanding DMA buffers on dmaengine stop
net_sched:
sch_fq: add three drop_reason
netconsole:
Acquire su_mutex before navigating configs hierarchy
netfilter:
bridge: eb_tables: close module init race
netfilter:
ctnetlink: do not expose expectation DEAD flag
netfilter:
ebtables: move to two-stage removal scheme
netfilter:
flowtable: avoid num_encaps underflow on bridge VLAN untag
netfilter:
nat: use kfree_rcu to release ops
netfilter:
nf_conntrack_expect: use conntrack GC to reap expectations
netfilter:
nf_flow_table: drop existing skb dst before skb_dst_set_noref()
netfilter:
nf_tables: add nft_trans_commit_list_add_elem helper
netfilter:
nf_tables: clone set on flush only
netfilter:
nf_tables: fix dst corruption in same register operation
netfilter:
nf_tables: prefer nft_trans_elem_alloc helper
netfilter:
nf_tables: prepare for multiple elements in nft_trans_elem structure
netfilter:
nf_tables: skip double clone set expressions on element insert
netfilter:
nf_tables: use list_del_rcu for netlink hooks
netfilter:
x_tables: allocate hook ops while under mutex
netfilter:
x_tables: allow initial table replace without emitting audit log message
netfs:
Abstract out a rolling folio buffer implementation
netfs:
Add a tracepoint to log the lifespan of folio_queue structs
netfs:
Clean up some whitespace in trace header
netfs:
Drop the was_async arg from netfs_read_subreq_terminated()
netfs:
Fix folio state after ENOMEM whilst under writeback iteration
netfs:
Fix folio_queue ENOMEM in writeback by adding a mempool
netfs:
Fix leak of request in netfs_write_begin() error handling
netfs:
Fix missing locking around retry adding new subreqs
netfs:
Fix netfs_create_write_req() to handle async cache object creation
netfs:
Fix zeropoint update where i_size > remote_i_size
netfs:
release readahead folios on iterator preparation failure
netfs:
Use a folio_queue allocation and free functions
NFS/localio:
prevent direct reclaim recursion into NFS via nfs_writepages
NFS:
Return a delegation the client fails to record
nfsd:
convert nfsd_net boolean flags to unsigned long flags word
nfsd:
fix fcache_disposal UAF by inlining dispose state into nfsd_net
nfsd:
restore rq_status_counter to even on all nfsd_dispatch() exit paths
NFSv4.1:
zero referring call lists before decoding
NFSv4/flexfiles:
fix NULL dereference for NFSv4.0 data servers
nouveau/gsp:
drop WARN_ON in ACPI probes
NTB:
core: Add .get_dma_dev() callback to ntb_dev_ops
NTB:
ntb_transport: Use ntb_get_dma_dev() for DMA buffers
ntb:
Store original DMA address for future release
ntfs3:
fix circular locking dependency in run_unpack_ex
nvmet-tcp:
check return value of nvmet_tcp_set_queue_sock
nvmet:
fix max_qid race between configfs and controller allocation
ocfs2/heartbeat:
fix slot mapping rollback leaks on error paths
ocfs2:
add extra consistency checks for chain allocator dinodes
ocfs2:
add suballoc slot check in ocfs2_validate_inode_block()
ocfs2:
correct l_next_free_rec in online check
ocfs2:
fix UBSAN array-index-out-of-bounds in ocfs2_sum_rightmost_rec
ocfs2:
o2hb: quiesce negotiate handlers and timeout work
ocfs2:
use correct endian in ocfs2_dinode_has_extents
ocfs2:
validate DIO orphan slot during inode read
ocfs2:
validate external xattr entries when reading metadata
ocfs2:
validate fast symlink target during inode read
ocfs2:
validate i_refcount_loc when refcount flag is set
ocfs2:
validate inline xattrs during inode block validation
ocfs2:
validate orphan slot during inode read
octeontx2-af:
Block VFs from clobbering special CGX PKIND state
octeontx2-vf:
fix workqueue and netdev race in probe/remove
OPP:
Fix race between OPP addition and lookup
overflow:
add range_overflows() and range_end_overflows()
ovl:
check access to copy_file_range source with src mounter creds
PCI/pwrctl:
Create pwrctl device only if at least one power supply is present
PCI/pwrctl:
Use of_platform_device_create() to create pwrctl devices
PCI/pwrctrl:
Cancel outstanding rescan work when unregistering
PCI:
endpoint: Add missing NULL check for alloc_workqueue()
PCI:
Fix dyn_id add TOCTOU
PCI:
Fix UAF when probe runs concurrent to dyn ID removal
PCI:
Make pci_match_one_device() match on ID instead of device
perf/dwc_pcie:
fix duplicate pci_dev devices
perf/dwc_pcie:
Qualify RAS DES VSEC Capability by Vendor, Revision
perf/x86/intel/uncore:
Fix uncore_box ref/unref ordering
perf/x86/intel:
Prevent drain_pebs() reentry
pinctrl:
mediatek: paris: bypass pinctrl GPIO layer in set GPIO direction
pinctrl:
mediatek: paris: don't double-check the GPIO number
pinctrl:
mediatek: paris: use new GPIO line value setter callbacks
pinctrl:
mediatek: use devm_gpiochip_add_data() for GPIO chip
platform/x86/amd/pmf:
Switch to platform_get_resource() and devm_ioremap_resource()
platform/x86/amd:
pmf: Use device managed allocations
platform/x86:
asus-wmi: fix resource leaks on probe failure
platform/x86:
dell-wmi-base: Fix handling of ultra performance key
PM:
Block enabling of runtime PM during system suspend
PM:
Rearrange documentation related to __pm_runtime_disable()
PM:
runtime: Introduce pm_runtime_blocked()
PM:
sleep: core: Restrict power.set_active propagation
PM:
sleep: core: Synchronize runtime PM status of parents and children
PM:
sleep: Fix bit masking operation
PM:
sleep: Unblock runtime PM when device prepare fails
PM:
sleep: Use DPM_FLAG_SMART_SUSPEND conditionally
pmdomain:
imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI
powerpc/64s:
Fix unmap race with PMD migration entries
powerpc/pgtable-frag:
Fix bad page state in pte_frag_destroy
powerpc/xive:
add error return value to xive_smp_probe()
powerpc/xive:
propagate IPI init errors to prevent use-after-free
printk:
Don't WARN on kthread_run failure.
ptp:
ocp: fix use-after-free bugs causing by ptp_ocp_watchdog
rcu:
add rcu_read_lock_dont_migrate()
RDMA/bnxt_re:
Add a max slot check for SQ
RDMA/bnxt_re:
Avoid repeated requests to allocate WC pages
RDMA/bnxt_re:
Fix budget handling of notification queue
RDMA/bnxt_re:
Free CQ toggle page after firmware teardown
RDMA/bnxt_re:
Free SRQ toggle page after firmware teardown
RDMA/bnxt_re:
Initialize dpi variable to zero
RDMA/bnxt_re:
Remove unusable nq variable
RDMA/counter:
Fix num_counters leak on bind_qp failure in alloc_and_bind()
RDMA/cxgb4:
Fix dereg_skb leak and double free in write_tpt_entry()
RDMA/efa:
Fix use of completion ctx after free
RDMA/irdma:
Prevent user-triggered null deref on QP create
RDMA/irdma:
Replace waitqueue and flag with completion
RDMA/mlx4:
Fix mis-use of RCU in mlx4_srq_event()
RDMA/mlx5:
Remove the redundant MLX5_IB_STAGE_UAR stage
RDMA/rvt:
Return NULL after port allocation failure
RDMA/rxe:
Fix iova-to-va conversion for MR page sizes != PAGE_SIZE
RDMA/rxe:
Move some code to rxe_loc.h in preparation for ODP
refcount:
provide ops for cases when object's memory can be reused
remoteproc:
qcom: pas: Conclude the rename from adsp
remoteproc:
qcom: pas: Make remoteproc name human friendly
remoteproc:
qcom: pas: Shutdown lite ADSP DTB on X1E
remoteproc:
qcom_q6v5_pas: Simplify with dev_err_probe()
remoteproc:
qcom_wcnss: Fix handling the lack of PD regulators in v3
remoteproc:
Switch back to struct platform_driver::remove()
Revert "drm/amdkfd:
return migration pages from copy function"
Revert "esp:
do not unref managed frag pages in esp_ssg_unref()"
Revert "net/smc:
Introduce TCP ULP support"
ring-buffer:
Fix possible dereference of uninitialized pointer
RISC-V:
KVM: Teardown riscv specific bits after kvm_exit
RISC-V:
KVM: Write hgatp register with valid mode bits
riscv:
Add support for per-thread envcfg CSR values
riscv:
Enable cbo.zero only when all harts support Zicboz
riscv:
kvm: fix vector context allocation leak
riscv:
patch: Avoid early phys_to_page()
riscv:
patch: fix handling of bpf-jit execmem addresses
riscv:
save the SR_SUM status over switches
riscv:
trace: fix snapshot deadlock with sbi ecall
riscv:
uaccess: Only restore the CSR_STATUS SUM bit
rv:
Remove trailing whitespace from tracepoint string
rv:
Use strings in da monitors tracepoints
rxrpc, afs:
Fix missing error pointer check after rxrpc_kernel_lookup_peer()
rxrpc:
kdoc: Update function descriptions and add link from rxrpc.rst
rxrpc:
proc: size address buffers for %pISpc output
s390/ap/zcrypt:
New xflag parameter
s390/ap/zcrypt:
Rework AP message buffer allocation
s390/ap:
Introduce ap message buffer pool
s390/ap:
Move response_type struct into ap_msg struct
s390/entry:
Remove __GMAP_ASCE and use _PIF_GUEST_FAULT again
s390/ism:
Fix UAF of sba and ieq during ism_dev_exit()
s390/kvm:
Initialize uninitialized flags variable
s390/kvm:
Mask extra bits from program interrupt code
s390/kvm:
Remove kvm_arch_fault_in_page()
s390/mm/fault:
Handle guest-related program interrupts in KVM
s390/mm:
Add missing secure storage access fixups for donated memory
s390/mm:
Fix in_atomic() handling in do_secure_storage_access()
s390/mm:
Get rid of fault type switch statements
s390/mm:
Simplify get_fault_type()
s390/uv:
Don't return 0 from make_hva_secure() if the operation was not successful
s390/zcrypt:
Close speculative mem read possibility
s390/zcrypt:
Fix buffer over-read in cca_cipher2protkey
s390/zcrypt:
Fix memory leak with CCA cards used as accelerator
s390/zcrypt:
Move inline function rng_type6cprb_msgx from header to code
s390/zcrypt:
Rework domain processing within zcrypt device driver
sched/deadline:
Fix missing ENQUEUE_REPLENISH during PI de-boosting
sched/psi:
Create the psimon kthread outside of cgroup_mutex
sched/psi:
fix race between file release and pressure write
sched_ext:
Don't warn on core-sched forced idle in put_prev_task_scx()
sched_ext:
Fix CPU hotplug hang when a dying CPU's tasks sit in the BPF scheduler
scsi:
ch: Do not keep references to data transfer element devices
scsi:
core: pair EH runtime PM get and put
scsi:
hisi_sas: Add slave_destroy interface for v3 hw
scsi:
qla2xxx: Clear cmds after chip reset
scsi:
qla2xxx: Completely fix fcport double free
scsi:
sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails
scsi:
sd: Move the sd_config_discard() function definition
scsi:
ufs: core: Add a comment block above ufshcd_mcq_compl_all_cqes_lock()
scsi:
ufs: core: Add debug log for MCQ command timeout
scsi:
ufs: core: Avoid unsafe MMIO reads in ufshcd_mcq_compl_all_cqes_lock()
scsi:
ufs: core: Convert string descriptor format macros to enum
scsi:
ufs: core: Decouple CQ sweep from request iterator in MCQ
scsi:
ufs: core: Fix data race in CPU latency PM QoS request handling
scsi:
ufs: core: Move an assignment in ufshcd_mcq_process_cqe()
scsi:
ufs: core: Validate string descriptors
scsi:
ufs: qcom : Fix NULL pointer dereference in ufs_qcom_setup_clocks
scsi:
ufs: qcom : Refactor phy_power_on/off calls
scsi:
ufs: ufs-qcom: Fix UFS OCP issue during UFS power down (PC=3)
sctp:
add INIT verification after cookie unpacking
sctp:
fix addr_wq_timer race in sctp_free_addr_wq()
sctp:
validate cookie AUTH state before use
sctp:
validate embedded INIT chunk and address list lengths in cookie
selftests:
tls: add rekey tests
selinux:
allow multiple opens of /sys/fs/selinux/policy
serial:
8250: invert serial8250_register_8250_port() CIR condition
serial:
core: clear freed pointers on uart_register_driver() failure
serial:
core: do fallible allocations before the console can be registered
serial:
core: fix infinite loop in handle_tx() for PORT_UNKNOWN
serial:
rename local uart_port_lock() -> uart_port_ref_lock()
smb/client:
fix chown/chgrp with SMB3 POSIX Extensions
smb/client:
invalidate fscache for fallocate range operations
smb:
client: avoid using uninitialized SIDs in cifs_posix_to_fattr()
smb:
client: fix compound alignment with encryption
smb:
client: get rid of bounds check in SMB2_ioctl_init()
smb:
client: honor forceuid/forcegid when mapping SIDs to uid/gid
smb:
client: improve compound padding in encryption
smb:
client: let recv_done verify data_offset, data_length and remaining_data_length
smb:
client: reject a tree connect response whose byte count is too small
soc/tegra:
pmc: Add kerneldoc for wake-up variables
soc/tegra:
pmc: Document tegra_pmc.syscore field
soc/tegra:
pmc: Fix unsafe generic_handle_irq() call
soc:
aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read
soc:
xilinx: Fix race condition in event registration
sockmap:
Fix use-after-free in udp_bpf_recvmsg()
soundwire:
fix bug in sdw_add_element_group_count found by syzkaller
soundwire:
intel_auxdevice: Fix system suspend/resume handling
spi:
ch341: fix devres lifetime
spi:
ch341: switch to use devm_spi_alloc_host()
spi:
microchip-core-qspi: control built-in cs manually
spi:
microchip-core-qspi: remove unused param from mchp_coreqspi_write_op()
spi:
microchip-core-qspi: set min_speed_hz during probe
spi:
microchip-core-qspi: stop checking viability of op->max_freq in supports_op callback
spi:
microchip-core-qspi: Support per spi-mem operation frequency switches
spi:
mpc52xx: clean up interrupt handling
srcu:
Use irq_work to start GP in tiny SRCU
staging:
most: remove broken i2c driver
staging:
rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths
staging:
rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction
stddef:
Introduce TRAILING_OVERLAP() helper macro
SUNRPC:
Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2
svcrdma:
Add Write chunk WRs to the RPC's Send WR chain
svcrdma:
Clear sc_cm_id when ADDR_CHANGE replacement fails
svcrdma:
Reject Read lists that exceed the page budget
svcrdma:
wake sq waiters when the transport closes
syscore:
Pass context data to callbacks
sysfs:
check visibility before changing group attribute ownership
tap:
fix stack info leak in tap_ioctl() SIOCGIFHWADDR
tap:
Keep hdr_len in tap_get_user()
tcp:
fix stale per-CPU tcp_tw_isn leak enabling ISN prediction
tcp:
Remove sk->sk_prot->orphan_count.
team:
avoid NETDEV_CHANGEMTU event when unregistering slave
thermal:
hwmon: Remove hwmon class device along with its parent
time/namespace:
Validate nanosecond field in proc_timens_set_offset()
tipc:
avoid busy looping in tipc_exit_net()
tipc:
fix UAF in cleanup_bearer() due to premature dst_cache_destroy()
tipc:
serialize udp bearer replicast list updates
tls:
rx: restore msg_iter before TLS 1.3 optimistic retry
tracing/probes:
Remove WARN_ON_ONCE from parse_btf_arg
tracing:
Fix comment in tracing_buffers_splice_read()
tracing:
Fix ring_buffer_read_page_size() kernel-doc
tracing:
Fix subbuf resize races with trace_pipe_raw readers
tty:
serial: 8250: protect against NULL uart->port.dev in register
tty:
skip cdev_del() when no cdev is registered
types:
move struct rcuwait into types.h
ublk:
check import_ubuf() return value
ublk:
fix dead loop when canceling io command
ublk:
fix race between io_uring_cmd_complete_in_task and ublk_cancel_cmd
usb:
gadget: f_hid: Add missing error code
usb:
gadget: uac: validate rate list length before storing
vdpa:
use generic driver_override infrastructure
vduse:
validate virtqueue alignment
vhost:
invalidate vring access on IOTLB transitions
vhost_iotlb:
bound map allocation in add_range
virt:
acrn: Fix irqfd use-after-free during eventfd shutdown
virt:
acrn: Remove unused list 'acrn_irqfd_clients'
virtio:
break and reset virtio devices on device_shutdown()
virtio_net:
Fix misalignment bug in struct virtnet_info
virtio_net:
Fix resize of the RX ring
virtio_ring:
fix stale descriptor flags after a failed packed add
vxlan:
fix reading neigh ha
watchdog:
at91sam9_wdt: prevent timer rearm during teardown
wifi:
ath11k: cancel SSR work items during PCI shutdown
wifi:
ath12k: ath12k_mac_op_sta_state(): clean up update_wk cancellation
wifi:
ath12k: Avoid explicit type cast in monitor status parse handler
wifi:
ath12k: Avoid memory leak while enabling statistics
wifi:
ath12k: convert struct ath12k_sta::update_wk to use struct wiphy_work
wifi:
ath12k: fix incorrect TID updation in DP monitor status path
wifi:
ath12k: Fix memory leak due to multiple rx_stats allocation
wifi:
ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic()
wifi:
ath12k: Fix MSDU buffer types handling in RX error path
wifi:
ath12k: fix overreads in ath12k_wmi_process_csa_switch_count_event()
wifi:
ath12k: fix struct hal_rx_phyrx_rssi_legacy_info
wifi:
ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type()
wifi:
ath12k: prepare vif data structure for MLO handling
wifi:
atk9k: Revert "wifi: ath9k: reject short WMI command responses"
wifi:
brcmfmac: fix P2P action frame handling without device vif
wifi:
cfg80211: add link_station_info structure to support MLO statistics
wifi:
cfg80211: Fix an error handling path in cfg80211_wext_siwscan()
wifi:
cfg80211: stop PMSR before P2P and NAN teardown
wifi:
cfg80211: use wiphy work for socket owner autodisconnect
wifi:
fix leak if split 6 GHz scanning fails
wifi:
ieee80211: validate MLE common info length
wifi:
iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start()
wifi:
iwlwifi: dvm: pair transport op-mode enter/leave
wifi:
iwlwifi: fix 22000 series SMEM parsing
wifi:
iwlwifi: Fix error code in iwl_op_mode_dvm_start()
wifi:
iwlwifi: mvm: don't send a 6E related command when not supported
wifi:
iwlwifi: mvm: fix P2P-Device binding handling
wifi:
iwlwifi: return ERR_PTR from opmode start()
wifi:
iwlwifi: simplify nested if checks
wifi:
mac80211: capture fast-RX rate before mesh reuses skb->cb
wifi:
mac80211: defer link RX stats percpu free to RCU
wifi:
mac80211: don't WARN for connections on invalid channels
wifi:
mac80211: fix missing RX bitrate update for mesh forwarding path
wifi:
mac80211: fix typo in HE MCS check
wifi:
mac80211: log link information in ieee80211_determine_chan_mode
wifi:
mac80211: refactor populating mesh related fields in sinfo
wifi:
mac80211: validate extension-frame layout before RX
wifi:
mt76: add wcid publish check in mt76_sta_add
wifi:
mt76: cancel reset and rc work on device unregister
wifi:
mt76: connac: tolerate inactive BSS deactivation
wifi:
mt76: Fix memory leak destroying device
wifi:
mt76: mt7915: fix list corruption after hardware restart
wifi:
mt76: mt7925: fix potential deadlock in mt7925_roc_abort_sync
wifi:
mt76: mt7996: do not attach hif2 WED when the main WED attach failed
wifi:
mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER
wifi:
mt76: wed: use proper wed reference in mt76 wed driver callabacks
wifi:
nl80211: check link is beaconing for color change
wifi:
nl80211: clean up color-change beacon data on errors
wifi:
rtw89: pci: configure manual DAC mode via PCI config API only
wifi:
rtw89: pci: validate sequence number of TX release report
wireguard:
device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit
xen/pvcalls:
bound backend response req_id before indexing rsp[]
xfrm:
fix stale skb->prev after async crypto steals a GSO segment
xfs:
avoid dquot buffer pin deadlock
xfs:
catch stale AGF/AGF metadata
xfs:
close crash window in attr dabtree inactivation
xfs:
factor out stale buffer item completion
xfs:
factor out xfs_attr3_node_entry_remove
xfs:
fix exchange-range-to-eof file size exchange
xfs:
fix unmount hang with unflushable inodes stuck in the AIL
xfs:
handle NULL b_addr in xfs_buf_free
xfs:
rearrange code in xfs_buf_item.c
xfs:
remove bp->b_error check in xfs_attr3_root_inactive
xfs:
remove unused trace event xfs_dqreclaim_dirty
xfs:
stop exchanging reflink flags when exchanging mappings
xfs:
xfs_ifree_cluster vs xfs_iflush_shutdown_abort deadlock
xsk:
drain continuation descs after overflow in xsk_build_skb()
xsk:
honor XDP_TX_METADATA in zero-copy path
xsk:
provide sufficient space in pool->tx_descs
xsk:
reclaim invalid Tx descriptors in ZC batch path