Skip to content

Commit 297e169

Browse files
committed
Merge tag 'v6.18.21' into qcom-6.18.y
Linux 6.18.21 Bluetooth: L2CAP: Fix regressions caused by reusing ident futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() futex: Require sys_futex_requeue() to have identical flags irqchip/renesas-rzv2h: Fix error path in rzv2h_icu_probe_common() netfs: Fix the handling of stream->front by removing it xen/privcmd: unregister xenstore notifier on module exit btrfs: fix lost error when running device stats on multiple devices fs btrfs: fix leak of kobject name for sub-group space_info btrfs: fix super block offset in error message in btrfs_validate_super() netfs: Fix read abandonment during retry selftests/mount_setattr: increase tmpfs size for idmapped mount tests dmaengine: xilinx_dma: Fix reset related timeout with two-channel AXIDMA dmaengine: xilinx: xilinx_dma: Fix unmasked residue subtraction dmaengine: xilinx: xilinx_dma: Fix residue calculation for cyclic DMA dmaengine: xilinx: xilinx_dma: Fix dma_device directions dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc() netfs: Fix NULL pointer dereference in netfs_unbuffered_write() on retry netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators dmaengine: xilinx: xdma: Fix regmap init error handling dmaengine: dw-edma: Fix multiple times setting of the CYCLE_STATE and CYCLE_BIT bits for HDMA. phy: ti: j721e-wiz: Fix device node reference leak in wiz_get_lane_phy_types() dmaengine: idxd: Fix leaking event log memory dmaengine: idxd: Fix freeing the allocated ida too late dmaengine: idxd: Fix memory leak when a wq is reset dmaengine: idxd: Fix not releasing workqueue on .release() dmaengine: idxd: Fix possible invalid memory access after FLR dmaengine: idxd: Fix crash when the event log is disabled mm/mseal: update VMA end correctly on merge ksmbd: fix use-after-free and NULL deref in smb_grant_oplock() mm/huge_memory: fix folio isn't locked in softleaf_to_folio() mm/damon/sysfs: fix param_ctx leak on damon_sysfs_new_test_ctx() failure mm/damon/core: avoid use of half-online-committed context mm/damon/stat: monitor all System RAM resources drm/amd/pm: fix amdgpu_irq enabled counter unbalanced on smu v11.0 rust: pin-init: internal: init: document load-bearing fact of field accessors unwind_user/x86: Fix arch=um build powerpc64/bpf: do not increment tailcall count when prog is NULL arm64: dts: imx8mn-tqma8mqnl: fix LDO5 power off ext4: always drain queued discard work in ext4_mb_release() ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths ext4: handle wraparound when searching for blocks for indirect mapped blocks ext4: fix the might_sleep() warnings in kvfree() ext4: fix use-after-free in update_super_work when racing with umount ext4: reject mount if bigalloc with s_first_data_block != 0 ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() ext4: avoid infinite loops caused by residual data ext4: validate p_idx bounds in ext4_ext_correct_indexes ext4: test if inode's all dirty pages are submitted to disk ext4: publish jinode after initialization ext4: replace BUG_ON with proper error handling in ext4_read_inline_folio ext4: make recently_deleted() properly work with lazy itable initialization ext4: fix fsync(2) for nojournal mode ext4: do not check fast symlink during orphan recovery ext4: fix stale xarray tags after writeback ext4: convert inline data to extents when truncate exceeds inline size ext4: fix journal credit check when setting fscrypt context xfs: remove file_path tracepoint data xfs: don't irele after failing to iget in xfs_attri_recover_work xfs: fix ri_total validation in xlog_recover_attri_commit_pass2 xfs: scrub: unlock dquot before early return in quota scrub xfs: avoid dereferencing log items after push callbacks xfs: save ailp before dropping the AIL lock in push callbacks xfs: stop reclaim before pushing AIL during unmount mm/pagewalk: fix race between concurrent split and refault mm/damon/sysfs: check contexts->nr in repeat_call_fn mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0] drm/amd/pm: Return -EOPNOTSUPP for unsupported OD_MCLK on smu_v13_0_6 LoongArch: KVM: Handle the case that EIOINTC's coremap is empty LoongArch: KVM: Make kvm_get_vcpu_by_cpuid() more robust LoongArch: Workaround LS2K/LS7A GPU DMA hang bug LoongArch: vDSO: Emit GNU_EH_FRAME correctly LoongArch: Fix missing NULL checks for kstrdup() drm/i915: Unlink NV12 planes earlier drm/i915: Order OP vs. timeout correctly in __wait_for() drm/i915/dp_tunnel: Fix error handling when clearing stream BW in atomic state drm/amd/display: Fix drm_edid leak in amdgpu_dm drm/amdgpu: prevent immediate PASID reuse case dmaengine: sh: rz-dmac: Move CHCTRL updates under spinlock dmaengine: sh: rz-dmac: Protect the driver specific lists dmaengine: fsl-edma: fix channel parameter config for fixed channel requests i2c: imx: ensure no clock is generated after last read i2c: imx: fix i2c issue when reading multiple messages futex: Clear stale exiting pointer in futex_lock_pi() retry path i2c: designware: amdisp: Fix resume-probe race condition issue irqchip/qcom-mpm: Add missing mailbox TX done acknowledgment jbd2: gracefully abort on checkpointing state corruptions KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE net: macb: Use dev_consume_skb_any() to free TX SKBs net: macb: Protect access to net_device::ip_ptr with RCU lock net: macb: Move devm_{free,request}_irq() out of spin lock area scsi: ses: Handle positive SCSI error from ses_recv_diag() scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() ovl: fix wrong detection of 32bit inode numbers ovl: make fsync after metadata copy-up opt-in mount option phy: qcom: qmp-ufs: Fix SM8650 PCS table for Gear 4 x86/fred: Fix early boot failures on SEV-ES/SNP guests x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask x86/cpu: Enable FSGSBASE early in cpu_init_exception_handling() writeback: don't block sync for filesystems with no data integrity guarantees alarmtimer: Fix argument order in alarm_timer_forward() erofs: add GFP_NOIO in the bio completion if needed virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false virt: tdx-guest: Fix handling of host controlled 'quote' buffer length xfrm: iptfs: only publish mode_data after clone setup xfrm: iptfs: validate inner IPv4 header length in IPTFS payload media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex hwmon: (peci/cputemp) Fix off-by-one in cputemp_is_visible() hwmon: (peci/cputemp) Fix crit_hyst returning delta instead of absolute temperature hwmon: (pmbus/isl68137) Add mutex protection for AVS enable sysfs attributes hwmon: (pmbus/ina233) Fix error handling and sign extension in shunt voltage read KVM: arm64: Discard PC update state on vcpu reset platform/x86: ISST: Correct locked bit width RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() thermal: intel: int340x: soc_slider: Set offset only for balanced mode kbuild: Delete .builtin-dtbs.S when running make clean cpufreq: conservative: Reset requested_freq on limits change can: netlink: can_changelink(): add missing error handling to call can_ctrlmode_changelink() can: isotp: fix tx.buf use-after-free in isotp_sendmsg() can: gw: fix OOB heap access in cgw_csum_crc8_rel() ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload ASoC: sma1307: fix double free of devm_kzalloc() memory ASoC: codecs: wcd934x: fix typo in dt parsing ALSA: firewire-lib: fix uninitialized local variable ALSA: hda/realtek: add quirk for ASUS Strix G16 G615JMR Revert "ALSA: hda/intel: Add MSI X870E Tomahawk to denylist" ksmbd: do not expire session on binding failure ksmbd: fix memory leaks and NULL deref in smb2_lock() ksmbd: fix potencial OOB in get_file_all_info() for compound requests ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len() drm/xe: always keep track of remap prev/next tracing: Fix potential deadlock in cpu hotplug with osnoise s390/entry: Scrub r12 register on kernel entry s390/barrier: Make array_index_mask_nospec() __always_inline s390/syscalls: Add spectre boundary for syscall dispatch table ALSA: usb-audio: Exclude Scarlett 2i4 1st Gen from SKIP_IFACE_SETUP spi: spi-fsl-lpspi: fix teardown order issue (UAF) ASoC: adau1372: Fix clock leak on PLL lock failure ASoC: adau1372: Fix unchecked clk_prepare_enable() return value sysctl: fix uninitialized variable in proc_do_large_bitmap hwmon: (pmbus/core) Protect regulator operations with mutex hwmon: (pmbus) Introduce the concept of "write-only" attributes hwmon: (pmbus) Mark lowest/average/highest/rated attributes as read-only hwmon: (adm1177) fix sysfs ABI violation and current unit conversion drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib ACPI: EC: clean up handlers on probe failure in acpi_ec_setup() spi: use generic driver_override infrastructure drm/xe: Implement recent spec updates to Wa_16025250150 rust: regulator: do not assume that regulator_get() returns non-null ASoC: dt-bindings: stm32: Fix incorrect compatible string in stm32h7-sai match drm/amd/display: Do not skip unrelated mode changes in DSC validation spi: meson-spicc: Fix double-put in remove path ASoC: Intel: catpt: Fix the device initialization spi: sn-f-ospi: Fix resource leak in f_ospi_probe() PM: sleep: Drop spurious WARN_ON() from pm_restore_gfp_mask() PM: hibernate: Drain trailing zero pages on userspace restore drm/i915/gmbus: fix spurious timeout on 512-byte burst reads drm/mediatek: dsi: Store driver data before invoking mipi_dsi_host_register x86/efi: efi_unmap_boot_services: fix calculation of ranges_to_free size scsi: scsi_transport_sas: Fix the maximum channel scanning issue ASoC: fsl: imx-card: initialize playback_only and capture_only RDMA/irdma: Harden depth calculation functions RDMA/irdma: Return EINVAL for invalid arp index error RDMA/irdma: Fix deadlock during netdev reset with active connections RDMA/irdma: Remove reset check from irdma_modify_qp_to_err() RDMA/irdma: Clean up unnecessary dereference of event->cm_node RDMA/irdma: Remove a NOP wait_event() in irdma_modify_qp_roce() RDMA/irdma: Update ibqp state to error if QP is already in error state RDMA/irdma: Initialize free_qp completion before using it ALSA: usb-audio: Exclude Scarlett 2i2 1st Gen from SKIP_IFACE_SETUP RDMA/efa: Fix possible deadlock RDMA/rw: Fall back to direct SGE on MR pool exhaustion ALSA: hda/realtek: Sequence GPIO2 on Star Labs StarFighter regmap: Synchronize cache for the page selector RDMA/efa: Fix use of completion ctx after free RDMA/efa: Improve admin completion context state machine RDMA/efa: Check stored completion CTX command ID with received one net: macb: use the current queue number for stats netfilter: ctnetlink: use netlink policy range checks netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp netfilter: nf_conntrack_expect: skip expectations in other netns via proc netfilter: nft_set_rbtree: revisit array resize logic netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD tls: Purge async_hold in tls_decrypt_async_wait() Bluetooth: btusb: clamp SCO altsetting table indices Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() Bluetooth: L2CAP: Fix not tracking outstanding TX ident Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock Bluetooth: L2CAP: Fix send LE flow credits in ACL link dma-mapping: add missing `inline` for `dma_free_attrs` rtnetlink: fix leak of SRCU struct in rtnl_link_register net: lan743x: fix duplex configuration in mac_link_up team: fix header_ops type confusion with non-Ethernet ports virtio-net: correct hdr_len handling for tunnel gso virtio-net: correct hdr_len handling for VIRTIO_NET_F_GUEST_HDRLEN net: enetc: fix the output issue of 'ethtool --show-ring' udp: Fix wildcard bind conflict check when using hash2 net: airoha: add RCU lock around dev_fill_forward_path net: fix fanout UAF in packet_release() via NETDEV_UP race ipv6: Don't remove permanent routes with exceptions from tb6_gc_hlist. ipv6: Remove permanent routes from tb6_gc_hlist when all exceptions expire. iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() ice: use ice_update_eth_stats() for representor stats ice: fix inverted ready check for VF representors platform/x86: intel-hid: disable wakeup_mode during hibernation platform/olpc: olpc-xo175-ec: Fix overflow error message to print inlen platform/x86: lenovo: wmi-gamezone: Drop gz_chain_head platform/x86: ISST: Check HWP support before MSR access net: bcmasp: fix double disable of clk net: bcmasp: fix double free of WoL irq net: bcmasp: streamline early exit in probe rtnetlink: count IFLA_INFO_SLAVE_KIND in if_nlmsg_size rtnetlink: count IFLA_PARENT_DEV_{NAME,BUS_NAME} in if_nlmsg_size net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer openvswitch: validate MPLS set/set_masked payload length openvswitch: defer tunnel netdev_put to RCU release net: openvswitch: Avoid releasing netdev before teardown completes nfc: nci: fix circular locking dependency in nci_close_device ionic: fix persistent MAC address override on PF pinctrl: mediatek: common: Fix probe failure for devices without EINT Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb Bluetooth: hci_ll: Fix firmware leak on error path Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv() Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req pinctrl: stm32: fix HDP driver dependency on GPIO_GENERIC can: statistics: add missing atomic access in hot path erofs: set fileio bio failed in short read case dma: swiotlb: add KMSAN annotations to swiotlb_bounce() af_key: validate families in pfkey_send_migrate() xfrm: prevent policy_hthresh.work from racing with netns teardown xfrm: Fix work re-schedule after cancel in xfrm_nat_keepalive_net_fini() pinctrl: renesas: rza1: Normalize return value of gpio_get() xfrm: iptfs: fix skb_put() panic on non-linear skb during reassembly pinctrl: renesas: rzt2h: Fix device node leak in rzt2h_gpio_register() esp: fix skb leak with espintcp and async crypto xfrm: call xdo_dev_state_delete during state update xfrm: fix the condition on x->pcpu_num in xfrm_sa_len xfrm: add missing extack for XFRMA_SA_PCPU in add_acquire and allocspi i3c: master: dw-i3c: Fix missing of_node for virtual I2C adapter ALSA: hda/realtek: add quirk for ASUS UM6702RC spi: intel-pci: Add support for Nova Lake mobile SPI flash usb: core: new quirk to handle devices with zero configurations drm/amdgpu: fix gpu idle power consumption issue for gfx v12 nvmet: move async event work off nvmet-wq objtool: Handle Clang RSP musical chairs ALSA: hda/realtek: Add headset jack quirk for Thinkpad X390 ALSA: hda/realtek: Add quirk for Gigabyte Technology to fix headphone ALSA: hda/realtek: add HP Laptop 14s-dr5xxx mute LED quirk powerpc64/ftrace: fix OOL stub count with clang btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create sched_ext: Use WRITE_ONCE() for the write side of dsq->seq update HID: apple: avoid memory leak in apple_report_fixup() bpf: Fix u32/s32 bounds when ranges cross min/max boundary ASoC: amd: acp: Add ACP6.3 match entries for Cirrus Logic parts drm/ttm/tests: Fix build failure on PREEMPT_RT ALSA: hda/senary: Ensure EAPD is enabled during init block: break pcpu_alloc_mutex dependency on freeze_lock dma-buf: Include ioctl.h in UAPI header ASoC: cs35l56: Only patch ASP registers if the DAI is part of a DAIlink ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_put_bits() ALSA: hda/hdmi: Add Tegra238 HDA codec device ID ASoC: Intel: sof_sdw: Add quirk for Alienware Area 51 (2025) 0CCD SKU scsi: devinfo: Add BLIST_SKIP_IO_HINTS for Iomega ZIP ASoC: rt1321: fix DMIC ch2/3 mask issue scsi: mpi3mr: Clear reset history on ready and recheck state after timeout ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_set_reg() module: Fix kernel panic when a symbol st_shndx is out of bounds HID: asus: add xg mobile 2023 external hardware support HID: mcp2221: cancel last I2C command on read error platform/x86: oxpec: Add support for OneXPlayer X1 Air platform/x86: oxpec: Add support for Aokzoe A2 Pro kbuild: install-extmod-build: Package resolve_btfids if necessary net: usb: r8152: add TRENDnet TUC-ET2G platform/x86: oxpec: Add support for OneXPlayer X1z HID: apple: Add EPOMAKER TH87 to the non-apple keyboards list platform/x86: oxpec: Add support for OneXPlayer APEX HID: intel-ish-hid: ipc: Add Nova Lake-H/S PCI device IDs HID: magicmouse: avoid memory leak in magicmouse_report_fixup() HID: magicmouse: fix battery reporting for Apple Magic Trackpad 2 nvme-pci: ensure we're polling a polled queue platform/x86: touchscreen_dmi: Add quirk for y-inverted Goodix touchscreen on SUPI S10 platform/x86: intel-hid: Enable 5-button array on ThinkPad X1 Fold 16 Gen 1 platform/x86: hp-wmi: Add Omen 16-xd0xxx fan and thermal support nvme-fabrics: use kfree_sensitive() for DHCHAP secrets nvme-pci: cap queue creation to used queues platform/x86: intel-hid: Add Dell 14 Plus 2-in-1 to dmi_vgbs_allow_list HID: asus: avoid memory leak in asus_report_fixup() platform/x86: hp-wmi: Add Omen 16-wf0xxx fan and thermal support tracing: Revert "tracing: Remove pid in task_rename tracing output" bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN bpf: Fix exception exit lock checking for subprogs cxl: Adjust the startup priority of cxl_pmem to be higher than that of cxl_acpi bpf: Release module BTF IDR before module unload driver core: platform: use generic driver_override infrastructure driver core: generalize driver_override in struct device sh: platform_early: remove pdev->driver_override check hwmon: axi-fan: don't use driver_override as IRQ name cxl/hdm: Avoid incorrect DVSEC fallback when HDM decoders are enabled s390/mm: Add missing secure storage access fixups for donated memory perf: Make sure to use pmu_ctx->pmu for groups x86/perf: Make sure to program the counter value for stopped events on migration bpf: Fix constant blinding for PROBE_MEM32 stores bpf: Reset register ID for BPF_END value tracking cxl/port: Fix use after free of parent_port in cxl_detach_ep() Linux 6.18.20 xen/privcmd: add boot control for restricted usage in domU xen/privcmd: restrict usage in unprivileged domU hwmon: (max6639) Fix pulses-per-revolution implementation arm64: realm: Fix PTE_NS_SHARED for 52bit PA support tools/bootconfig: fix fd leak in load_xbc_file() on fstat failure lib/bootconfig: check xbc_init_node() return in override path fs/tests: exec: Remove bad test vector drm/i915/gt: Check set_default_submission() before deferencing ksmbd: fix use-after-free in durable v2 replay of active file handles ksmbd: fix use-after-free of share_conf in compound request drm/bridge: dw-hdmi-qp: fix multi-channel audio output drm/amd: fix dcn 2.01 check drm/amd/display: Fix DisplayID not-found handling in parse_edid_displayid_vrr() iommu/sva: Fix crash in iommu_sva_unbind_device() drm/vmwgfx: Don't overwrite KMS surface dirty tracker spi: amlogic-spisg: Fix memory leak in aml_spisg_probe() spi: amlogic: spifc-a4: Remove redundant clock cleanup mtd: rawnand: brcmnand: skip DMA during panic write mtd: rawnand: serialize lock/unlock against other NAND operations binfmt_elf_fdpic: fix AUXV size calculation for ELF_HWCAP3 and ELF_HWCAP4 tracing: Fix trace_marker copy link list updates x86/platform/uv: Handle deconfigured sockets tracing: Fix failure to read user space from system call trace events ring-buffer: Fix to update per-subbuf entries of persistent ring buffer perf/x86: Move event pointer setup earlier in x86_pmu_enable() perf/x86/intel: Add missing branch counters constraint apply irqchip/riscv-rpmi-sysmsi: Fix mailbox channel leak in rpmi_sysmsi_probe() i2c: pxa: defer reset on Armada 3700 when recovery is used i2c: fsi: Fix a potential leak in fsi_i2c_probe() i2c: cp2615: fix serial string NULL-deref at probe USB: serial: f81232: fix incomplete serial port generation hwmon: (pmbus/isl68137) Fix unchecked return value and use sysfs_emit() hwmon: (pmbus/mp2869) Check pmbus_read_byte_data() before using its return value hwmon: (pmbus/mp2975) Add error check for pmbus_read_word_data() return value hwmon: (pmbus/ina233) Add error check for pmbus_read_word_data() return value MPTCP: fix lock class name family in pm_nl_create_listen_socket icmp: fix NULL pointer dereference in icmp_tag_validation() net: dsa: bcm_sf2: fix missing clk_disable_unprepare() in error paths net: shaper: protect from late creation of hierarchy net: shaper: protect late read accesses to the hierarchy net: mvpp2: guard flow control update with global_tx_fc in buffer switching nfnetlink_osf: validate individual option lengths in fingerprints netfilter: nf_tables: release flowtable after rcu grace period on error netfilter: bpf: defer hook memory release until rcu readers are done net: bonding: fix NULL deref in bond_debug_rlb_hash_show udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n net/mlx5e: Fix race condition during IPSec ESN update net/mlx5e: Prevent concurrent access to IPSec ASO context net/mlx5: qos: Restrict RTNL area to avoid a lock cycle net: macb: fix uninitialized rx_fs_lock netdevsim: drop PSP ext ref on forward failure ACPI: processor: Fix previous acpi_processor_errata_piix4() fix wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom wifi: mac80211: fix NULL deref in mesh_matches_local() libie: prevent memleak in fwlog code iavf: fix VLAN filter lost on add/delete race igc: fix page fault in XDP TX timestamps handling igc: fix missing update of skb->tail in igc_xmit_frame() ACPICA: Update the format of Arg3 of _DSM net: usb: aqc111: Do not perform PM inside suspend callback clsact: Fix use-after-free in init/destroy rollback asymmetry net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check net: airoha: Remove airoha_dev_stop() in airoha_remove() net/sched: teql: Fix double-free in teql_master_xmit net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() bonding: prevent potential infinite loop in bond_header_parse() PM: runtime: Fix a race condition related to device removal sched: idle: Consolidate the handling of two special cases net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown net: bcmgenet: increase WoL poll timeout crypto: ccp - Fix leaking the same page twice netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() netfilter: xt_time: use unsigned int for monthday bit shift netfilter: xt_CT: drop pending enqueued packets on template removal netfilter: nft_ct: drop pending enqueued packets on removal nf_tables: nft_dynset: fix possible stateful expression memleak in error path netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() mpls: add missing unregister_netdevice_notifier to mpls_init net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect bridge: cfm: Fix race condition in peer_mep deletion Bluetooth: qca: fix ROM version reading on WCN3998 chips Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user Bluetooth: HIDP: Fix possible UAF Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers Bluetooth: hci_sync: Fix hci_le_create_conn_sync Bluetooth: ISO: Fix defer tests being unstable Bluetooth: SMP: make SM/PER/KDU/BI-04-C happy Bluetooth: LE L2CAP: Disconnect if sum of payload sizes exceed SDU Bluetooth: LE L2CAP: Disconnect if received packet's SDU exceeds IMTU firmware: arm_scmi: Fix NULL dereference on notify error path firmware: arm_scpi: Fix device_node reference leak in probe path firmware: arm_ffa: Remove vm_id argument in ffa_rxtx_unmap() arm64: dts: renesas: rzg3s-smarc-som: Set bypass for Versa3 PLL2 arm64: dts: renesas: r9a09g087: Fix CPG register region sizes arm64: dts: renesas: r9a09g077: Fix CPG register region sizes arm64: dts: renesas: r9a09g057: Remove wdt{0,2,3} nodes arm64: dts: renesas: r9a09g057: Add RTC node arm64: dts: renesas: rzv2-evk-cn15-sd: Add ramp delay for SD0 regulator arm64: dts: renesas: rzt2h-n2h-evk: Add ramp delay for SD0 card regulator wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down wifi: mac80211: Fix static_branch_dec() underflow for aql_disable. wifi: mac80211: use jiffies_delta_to_msecs() for sta_info inactive times wifi: mac80211: remove keys after disabling beaconing tee: shm: Remove refcounting of kernel pages soc: fsl: cpm1: qmc: Fix error check for devm_ioremap_resource() in qmc_qe_init_resources() soc: fsl: qbman: fix race condition in qman_destroy_fq soc: rockchip: grf: Add missing of_node_put() when returning cache: ax45mp: Fix device node reference leak in ax45mp_cache_init() cache: starfive: fix device node leak in starlink_cache_init() soc: microchip: mpfs: Fix memory leak in mpfs_sys_controller_probe() btrfs: tree-checker: fix misleading root drop_level error message btrfs: log new dentries when logging parent dir of a conflicting inode drm/i915/psr: Compute PSR entry_setup_frames into intel_crtc_state Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ drm/xe: Open-code GGTT MMIO access protection drm/xe/oa: Allow reading after disabling OA stream drm/xe/guc: Ensure CT state transitions via STOP before DISABLED drm/i915/dmc: Fix an unlikely NULL pointer deference at probe drm/amdgpu: Limit BO list entry count to prevent resource exhaustion drm/amdgpu: apply state adjust rules to some additional HAINAN vairants drm/radeon: apply state adjust rules to some additional HAINAN vairants drm/imagination: Synchronize interrupts before suspending the GPU drm/imagination: Fix deadlock in soft reset sequence drm/amdgpu/mmhub4.1.0: add bounds checking for cid drm/amdgpu/mmhub3.0: add bounds checking for cid drm/amdgpu/mmhub3.0.2: add bounds checking for cid drm/amdgpu/mmhub3.0.1: add bounds checking for cid drm/amdgpu/mmhub2.3: add bounds checking for cid drm/amdgpu/mmhub2.0: add bounds checking for cid drm/amdgpu/gmc9.0: add bounds checking for cid drm/amd/display: Wrap dcn32_override_min_req_memclk() in DC_FP_{START, END} drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug serial: uartlite: fix PM runtime usage count underflow on probe serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN serial: 8250_dw: Ensure BUSY is deasserted serial: 8250: Add late synchronize_irq() to shutdown to handle DW UART BUSY serial: 8250_dw: Rework IIR_NO_INT handling to stop interrupt storm serial: 8250_dw: Rework dw8250_handle_irq() locking and IIR handling serial: 8250: Add serial8250_handle_irq_locked() serial: 8250_dw: Avoid unnecessary LCR writes serial: 8250: Protect LCR write in shutdown serial: 8250: always disable IRQ during THRE test serial: 8250: Fix TX deadlock when using DMA serial: 8250_pci: add support for the AX99100 vt: save/restore unicode screen buffer for alternate screen io_uring/kbuf: propagate BUF_MORE through early buffer commit path io_uring/kbuf: fix missing BUF_MORE for incremental buffers at EOF io_uring/poll: fix multishot recv missing EOF on wakeup race iommu/vt-d: Only handle IOPF for SVA when PRI is supported iommu/vt-d: Fix intel iommu iotlb sync hardlockup and retry mtd: Avoid boot crash in RedBoot partition table parser mtd: rawnand: cadence: Fix error check for dma_alloc_coherent() in cadence_nand_init() mtd: rawnand: pl353: make sure optimal timings are applied spi: fix statistics allocation spi: fix use-after-free on controller registration failure pmdomain: bcm: bcm2835-power: Increase ASB control timeout mmc: sdhci: fix timing selection for 1-bit bus width mmc: sdhci-pci-gli: fix GL9750 DMA write corruption ata: libata-scsi: report correct sense field pointer in ata_scsiop_maint_in() ata: libata-core: disable LPM on ADATA SU680 SSD mm/huge_memory: fix a folio_split() race condition with folio_try_get() ipmi:msghandler: Handle error returns from the SMI sender ipmi: Consolidate the run to completion checking for xmit msgs lock sched_ext: Disable preemption between scx_claim_exit() and kicking helper work sched_ext: Simplify breather mechanism with scx_aborting flag sched_ext: Fix starvation of scx_enable() under fair-class saturation nsfs: tighten permission checks for ns iteration ioctls drm/xe/sync: Fix user fence leak on alloc failure fgraph: Fix thresh_return nosleeptime double-adjust ksmbd: Don't log keys in SMB3 signing and encryption key generation net: macb: Shuffle the tx ring before enabling tx net: macb: sort #includes drm/i915/vrr: Configure VRR timings after enabling TRANS_DDI_FUNC_CTL drm/i915/vrr: Move HAS_VRR() check into intel_vrr_set_transcoder_timings() drm/xe: Fix memory leak in xe_vm_madvise_ioctl cifs: open files should not hold ref on superblock crypto: atmel-sha204a - Fix OOM ->tfm_count leak netconsole: fix sysdata_release_enabled_show checking wrong flag ublk: fix NULL pointer dereference in ublk_ctrl_set_size() LoongArch: Check return values for set_memory_{rw,rox} net: macb: Reinitialize tx/rx queue pointer registers and rx ring during resume net: macb: Introduce gem_init_rx_ring() drm/i915/psr: Write DSC parameters on Selective Update in ET mode drm/i915/dsc: Add helper for writing DSC Selective Update ET parameters drm/i915/dsc: Add Selective Update register definitions ksmbd: use volume UUID in FS_OBJECT_ID_INFORMATION ksmbd: unset conn->binding on failed binding request smb: client: fix krb5 mount with username option Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp() crypto: padlock-sha - Disable for Zhaoxin processor mac80211: fix crash in ieee80211_chan_bw_change for AP_VLAN stations batman-adv: avoid OGM aggregation when skb tailroom is insufficient parisc: Flush correct cache in cacheflush() syscall bnxt_en: fix OOB access in DBG_BUF_PRODUCER async event handler net: macb: fix use-after-free access to PTP clock NFC: nxp-nci: allow GPIOs to sleep LoongArch: No need to flush icache if text copy failed LoongArch: Give more information if kmem access failed mm/huge_memory: fix early failure try_to_migrate() when split huge pmd for shared THP mm/huge_memory: fix use of NULL folio in move_pages_huge_pmd() mm/rmap: fix incorrect pte restoration for lazyfree folios crash_dump: don't log dm-crypt key bytes in read_key_from_user_keying nvdimm/bus: Fix potential use after free in asynchronous initialization sunrpc: fix cache_request leak in cache_release HID: bpf: prevent buffer overflow in hid_hw_request selftests/hid: fix compilation when bpf_wq and hid_device are not exported nfsd: fix heap overflow in NFSv4.0 LOCK replay cache NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd NFSD: Defer sub-object cleanup in export put callbacks Linux 6.18.19 bpf: drop kthread_exit from noreturn_deny drm/bridge: ti-sn65dsi86: Add support for DisplayPort mode with HPD mm/damon/core: disallow non-power of two min_region_sz io_uring/eventfd: use ctx->rings_rcu for flags checking io_uring: ensure ctx->rings is stable for task work flags manipulation net/tcp-md5: Fix MAC comparison to be constant-time lib/crypto: tests: Depend on library options rather than selecting them ksmbd: Compare MACs in constant time smb: client: Compare MACs in constant time kbuild: Leave objtool binary around with 'make clean' KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated KVM: SVM: Add a helper to look up the max physical ID for AVIC KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids KVM: arm64: Eagerly init vgic dist/redist on vgic creation KVM: arm64: gic: Set vgic_model before initing private IRQs mmc: dw_mmc-rockchip: Fix runtime PM support for internal phase support mmc: dw_mmc-rockchip: Add memory clock auto-gating support drm/gud: fix NULL crtc dereference on display disable drm/gud: rearrange gud_probe() to prepare for function splitting mm: Fix a hmm_range_fault() livelock / starvation problem cxl/acpi: Fix CXL_ACPI and CXL_PMEM Kconfig tristate mismatch i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue i3c: mipi-i3c-hci: Fix race in DMA ring dequeue i3c: mipi-i3c-hci: Add missing TID field to no-op command descriptor i3c: mipi-i3c-hci: Restart DMA ring correctly after dequeue abort i3c: mipi-i3c-hci: Consolidate spinlocks i3c: mipi-i3c-hci: Factor out DMA mapping from queuing path i3c: mipi-i3c-hci: Use ETIMEDOUT instead of ETIME for timeout errors iio: proximity: hx9023s: Protect against division by zero in set_samp_freq iio: proximity: hx9023s: fix assignment order for __counted_by iio: imu: inv_icm42600: fix odr switch when turning buffer off iio: imu: inv_icm42600: fix odr switch to the same value iio: light: bh1780: fix PM runtime leak on error path iio: gyro: mpu3050-i2c: fix pm_runtime error handling iio: imu: adis: Fix NULL pointer dereference in adis_init iio: gyro: mpu3050-core: fix pm_runtime error handling iio: buffer: Fix wait_queue not being removed iio: chemical: bme680: Fix measurement wait duration calculation iio: potentiometer: mcp4131: fix double application of wiper shift iio: magnetometer: tlv493d: remove erroneous shift in X-axis data iio: chemical: sps30_i2c: fix buffer size in sps30_i2c_read_meas() iio: chemical: sps30_serial: fix buffer size in sps30_serial_read_meas() iio: frequency: adf4377: Fix duplicated soft reset mask iio: dac: ds4424: reject -128 RAW value btrfs: abort transaction on failure to update root in the received subvol ioctl btrfs: add missing RCU unlock in error path in try_release_subpage_extent_buffer() btrfs: fix transaction abort on set received ioctl due to item overflow btrfs: fix transaction abort on file creation due to name hash collision btrfs: fix transaction abort when snapshotting received subvolumes smb: client: fix iface port assignment in parse_server_interfaces smb: client: fix in-place encryption corruption in SMB2_write() smb: client: fix atomic open with O_DIRECT & O_SYNC lib/bootconfig: check bounds before writing in __xbc_open_brace() lib/bootconfig: fix snprintf truncation check in xbc_node_compose_key_after() kprobes: Remove unneeded warnings from __arm_kprobe_ftrace() x86/apic: Disable x2apic on resume if the kernel expects so scsi: core: Fix error handling for scsi_alloc_sdev() lib/bootconfig: fix off-by-one in xbc_verify_tree() unclosed brace error powerpc64/bpf: fix the address returned by bpf_get_func_ip powerpc64/bpf: fix kfunc call support powerpc/pseries: Correct MSI allocation tracking s390/dasd: Copy detected format information to secondary device s390/dasd: Move quiesce state with pprc swap s390/zcrypt: Enable AUTOSEL_DOM for CCA serialnr sysfs attribute sched_ext: Fix enqueue_task_scx() truncation of upper enqueue flags xfs: ensure dquot item is deleted from AIL only after log shutdown xfs: fix undersized l_iclog_roundoff values xfs: fix returned valued from xfs_defer_can_append xfs: fix integer overflow in bmap intent sort comparator cifs: make default value of retrans as zero io_uring/kbuf: check if target buffer list is still legacy on recycle qmi_wwan: allow max_mtu above hard_mtu to control rx_urb_size net-shapers: don't free reply skb after genlmsg_reply() tracing: Fix trace_buf_size= cmdline parameter with sizes >= 2G tracing: Fix enabling multiple events on the kernel command line and bootconfig drm/msm/dpu: Correct the SA8775P intr_underrun/intr_underrun index drm/amd: Fix a few more NULL pointer dereference in device cleanup drm/msm: Fix dma_free_attrs() buffer size drm/i915/psr: Repeat Selective Update area alignment drm/i915: Fix potential overflow of shmem scatterlist length drm/bridge: ti-sn65dsi83: halve horizontal syncs for dual LVDS output drm/bridge: ti-sn65dsi83: fix CHA_DSI_CLK_RANGE rounding drm/amd: Fix NULL pointer dereference in device cleanup drm/amd: Set num IP blocks to 0 if discovery fails drm/amdgpu: Fix use-after-free race in VM acquire drm/amd/pm: remove invalid gpu_metrics.energy_accumulator on smu v13.0.x net: dsa: microchip: Fix error path in PTP IRQ setup net: ethernet: arc: emac: quiesce interrupts before requesting IRQ net: ncsi: fix skb leak in error paths net: nexthop: fix percpu use-after-free in remove_nh_grp_entry net: mctp: fix device leak on probe failure ksmbd: fix use-after-free by using call_rcu() for oplock_info smb: server: fix use-after-free in smb2_open() ksmbd: fix use-after-free in smb_lazy_parent_lease_break_close() memcg: fix slab accounting in refill_obj_stock() trylock path slab: distinguish lock and trylock for sheaf_flush_main() s390/xor: Fix xor_xc_5() inline assembly drm/amd/display: Fallback to boot snapshot for dispclk s390/xor: Fix xor_xc_2() inline assembly constraints ata: libata-core: Disable LPM on ST1000DM010-2EP102 s390/stackleak: Fix __stackleak_poison() inline assembly constraint crypto: ccp - allow callers to use HV-Fixed page API when SEV is disabled pmdomain: bcm: bcm2835-power: Fix broken reset status read regulator: pf9453: Respect IRQ trigger settings from firmware io_uring/net: reject SEND_VECTORIZED when unsupported parisc: Check kernel mapping earlier at bootup arm64: contpte: fix set_access_flags() no-op check for SMMU/ATS faults parisc: Fix initial page table creation for boot io_uring/zcrx: use READ_ONCE with user shared RQEs hwmon: (pmbus/q54sj108a2) fix stack overflow in debugfs read arm64: mm: Add PTE_DIRTY back to PAGE_KERNEL* to fix kexec/hibernation nouveau/dpcd: return EBUSY for aux xfer if the device is asleep parisc: Increase initial mapping to 64 MB with KALLSYMS pmdomain: rockchip: Fix PD_VCODEC for RK3588 drm/xe/xe2_hpg: Correct implementation of Wa_16025250150 batman-adv: Avoid double-rtnl_lock ELP metric worker net/tcp-ao: Fix MAC comparison to be constant-time tracing: Fix syscall events activation by ensuring refcount hits zero ice: fix retry for AQ command 0x06EE net: mana: Ring doorbell at 4 CQ wraparounds media: dvb-net: fix OOB access in ULE extension header tables selftests: fix mntns iteration selftests pinctrl: cy8c95x0: Don't miss reading the last bank registers staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie staging: rtl8723bs: properly validate the data in rtw_get_ie_ex() staging: sm750fb: add missing pci_release_region on error and removal mm/slab: fix an incorrect check in obj_exts_alloc_size() mm/damon/core: clear walk_control on inactive context in damos_walk() ixgbevf: fix link setup issue kunit: irq: Ensure timer doesn't fire too frequently ice: reintroduce retry mechanism for indirect AQ iomap: reject delalloc mappings during writeback btrfs: fix chunk map leak in btrfs_map_block() after btrfs_chunk_map_num_copies() irqchip/gic-v3-its: Limit number of per-device MSIs to the range the ITS supports device property: Allow secondary lookup in fwnode_get_next_child_node() nfsd: Fix cred ref leak in nfsd_nl_listener_set_doit(). arm64: gcs: Honour mprotect(PROT_NONE) on shadow stack mappings bpf: Fix kprobe_multi cookies access in show_fdinfo callback s390/pfault: Fix virtual vs physical address confusion drm/xe/sync: Cleanup partially initialized sync on parse failure ipmi:si: Fix check for a misbehaving BMC gpiolib: normalize the return value of gc->get() on behalf of buggy drivers drm/i915/alpm: ALPM disable fixes nouveau/gsp: drop WARN_ON in ACPI probes ipmi:si: Handle waiting messages when BMC failure detected drm/bridge: ti-sn65dsi86: Enable HPD polling if IRQ is not used drm/bridge: samsung-dsim: Fix memory leak in error path ipmi:si: Use a long timeout when the BMC is misbehaving ipmi:si: Don't block module unload if the BMC is messed up drm/amd: Disable MES LR compute W/A drm/amdgpu: add upper bound check on user inputs in wait ioctl drm/amdgpu/userq: Fix reference leak in amdgpu_userq_wait_ioctl drm/amdgpu: add upper bound check on user inputs in signal ioctl cpufreq: intel_pstate: Fix NULL pointer dereference in update_cpu_qos_request() kthread: consolidate kthread exit paths to prevent use-after-free Revert "ptdesc: remove references to folios from __pagetable_ctor() and pagetable_dtor()" Revert "tcpm: allow looking for role_sw device in the main node" scsi: hisi_sas: Fix NULL pointer exception during user_scan() scsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend powerpc, perf: Check that current->mm is alive before getting user callchain i3c: dw-i3c-master: Set SIR_REJECT in DAT on device attach and reattach time/jiffies: Mark jiffies_64_to_clock_t() notrace ALSA: usb-audio: Improve Focusrite sample rate filtering ceph: fix memory leaks in ceph_mdsc_build_path() ceph: do not skip the first folio of the next object in writeback ceph: fix i_nlink underrun during async unlink libceph: admit message frames only in CEPH_CON_S_OPEN state libceph: Use u32 for non-negative values in ceph_monmap_decode() libceph: prevent potential out-of-bounds reads in process_message_header() libceph: reject preamble if control segment is empty libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() ceph: add a bunch of missing ceph_path_info initializers kprobes: avoid crash when rmmod/insmod after ftrace killed tipc: fix divide-by-zero in tipc_sk_filter_connect() ASoC: qcom: qdsp6: Fix q6apm remove ordering during ADSP stop and start mmc: core: Avoid bitfield RMW for claim/retune flags mm/kfence: disable KFENCE upon KASAN HW tags enablement mmc: mmci: Fix device_node reference leak in of_get_dml_pipe_index() mm/kfence: fix KASAN hardware tag faults during late enablement mm/tracing: rss_stat: ensure curr is false from kthread context usb: gadget: f_ncm: Fix net_device lifecycle with device_move Revert "usb: gadget: u_ether: add gether_opts for config caching" Revert "usb: gadget: f_ncm: align net_device lifecycle with bind/unbind" Revert "usb: gadget: u_ether: Add auto-cleanup helper for freeing net_device" Revert "usb: legacy: ncm: Fix NPE in gncm_bind" Revert "usb: gadget: f_ncm: Fix atomic context locking issue" usb: legacy: ncm: Fix NPE in gncm_bind usb: gadget: f_ncm: Fix atomic context locking issue usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling usb: image: mdc800: kill download URB on timeout usb: gadget: uvc: fix interval_duration calculation usb: mdc800: handle signal and read racing usb: gadget: f_hid: fix SuperSpeed descriptors usb: renesas_usbhs: fix use-after-free in ISR during device removal usb: class: cdc-wdm: fix reordering issue in read code path USB: core: Limit the length of unkillable synchronous timeouts USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts USB: usbcore: Introduce usb_bulk_msg_killable() usb: typec: altmode/displayport: set displayport signaling rate in configure message usb: roles: get usb role switch from parent only for usb-b-connector usb: cdc-acm: Restore CAP_BRK functionnality to CH343 usb: core: don't power off roothub PHYs if phy_set_mode() fails usb: misc: uss720: properly clean up reference in uss720_probe() usb: dwc3: pci: add support for the Intel Nova Lake -H usb: yurex: fix race in probe usb: xhci: Prevent interrupt storm on host controller error (HCE) usb: xhci: Fix memory leak in xhci_disable_slot() USB: ezcap401 needs USB_QUIRK_NO_BOS to function on 10gbs usb speed usb/core/quirks: Add Huawei ME906S-device to wakeup quirk USB: add QUIRK_NO_BOS for video capture several devices KVM: arm64: pkvm: Fallback to level-3 mapping on host stage-2 fault KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with in-kernel APIC KVM: x86: Introduce KVM_X86_QUIRK_VMCS12_ALLOW_FREEZE_IN_SMM KVM: arm64: Fix protected mode handling of pages larger than 4kB ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK PM1503CDA ata: libata-core: Add BRIDGE_OK quirk for QEMU drives rust: str: make NullTerminatedFormatter public rust: kbuild: allow `unused_features` rust_binder: call set_notification_done() without proc lock rust_binder: avoid reading the written value in offsets array rust_binder: check ownership before using vma rust_binder: fix oneway spam detection net: usb: lan78xx: skip LTM configuration for LAN7850 net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect net: usb: lan78xx: fix TX byte statistics for small packets net: usb: lan78xx: fix silent drop of packets with checksum errors can: gs_usb: gs_can_open(): always configure bitrates before starting device ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer interfaces ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain() sched_ext: Remove redundant css_put() in scx_cgroup_init() cgroup: fix race between task migration and iteration drm/amdgpu: ensure no_hw_access is visible before MMIO usb: gadget: f_mass_storage: Fix potential integer overflow in check_command_size_in_blocks() iio: imu: inv-mpu9150: fix irq ack preventing irq storms net: prevent NULL deref in ip[6]tunnel_xmit() octeontx2-af: devlink: fix NIX RAS reporter to use RAS interrupt status octeontx2-af: devlink: fix NIX RAS reporter recovery condition net: ethernet: ti: am65-cpsw-nuss: Fix rx_filter value for PTP support net: ti: am65-cpsw: move hw timestamping to ndo callback net/mana: Null service_wq on setup error to prevent double destroy neighbour: restore protocol != 0 check in pneigh update net: dsa: realtek: Fix LED group port bit for non-zero LED group net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled perf synthetic-events: Fix stale build ID in module MMAP2 records drm/amdkfd: Unreserve bo if queue update failed ASoC: detect empty DMI strings ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock acquisition ACPI: OSL: fix __iomem type on return from acpi_os_map_generic_address() net: bcmgenet: fix broken EEE by converting to phylib-managed state page_pool: store detach_time as ktime_t to avoid false-negatives e1000/e1000e: Fix leak in DMA error cleanup i40e: fix src IP mask checks and memcpy argument names in cloud filter iavf: fix incorrect reset handling in callbacks iavf: fix PTP use-after-free during reset drivers: net: ice: fix devlink parameters get without irdma nvme-pci: Fix race bug in nvme_poll_irqdisable() nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set sched: idle: Make skipping governor callbacks more consistent perf ftrace: Fix hashmap__new() error checking regulator: pca9450: Correct probed name for PCA9452 regulator: pca9450: Add support for setting debounce settings regulator: pca9450: Correct interrupt type perf annotate: Fix hashmap__new() error checking netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path netfilter: x_tables: guard option walkers against 1-byte tail reads netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() netfilter: nf_tables: always walk all pending catchall elements netfilter: nf_tables: Fix for duplicate device in netdev hooks net: add xmit recursion limit to tunnel xmit functions amd-xgbe: prevent CRC errors during RX adaptation with AN disabled amd-xgbe: fix link status handling in xgbe_rx_adaptation mctp: route: hold key->lock in mctp_flow_prepare_output() bonding: fix type confusion in bond_setup_by_slave() bonding: use common function to compute the features can: hi311x: hi3110_open(): add check for hi3110_power_enable() return value mctp: i2c: fix skb memory leak in receive path bnxt_en: Fix RSS table size check when changing ethtool channels serial: caif: hold tty->link reference in ldisc_open and ser_release net: sfp: improve Huawei MA5671a fixup ASoC: simple-card-utils: fix graph_util_is_ports0() for DT overlays ASoC: soc-core: flush delayed work before removing DAIs and widgets ASoC: soc-core: drop delayed_work_pending() check before flush spi: rockchip-sfc: Fix double-free in remove() callback spi: amlogic: spifc-a4: Fix DMA mapping error handling drm/sitronix/st7586: fix bad pixel data due to byte swap net: spacemit: Fix error handling in emac_tx_mem_map() net: spacemit: Fix error handling in emac_alloc_rx_desc_buffers() rxrpc, afs: Fix missing error pointer check after rxrpc_kernel_lookup_peer() net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery net/mlx5: Fix peer miss rules host disabled checks net/mlx5: Fix crash when moving to switchdev mode net/mlx5: Fix deadlock between devlink lock and esw->wq bonding: handle BOND_LINK_FAIL, BOND_LINK_BACK as valid link states bonding: do not set usable_slaves for broadcast mode drm/amd/pm: add missing od setting PP_OD_FEATURE_ZERO_FAN_BIT for smu v14 drm/amd/pm: add missing od setting PP_OD_FEATURE_ZERO_FAN_BIT for smu v13 drm/msm/dsi: fix pclk rate calculation for bonded dsi net: dsa: realtek: rtl8365mb: remove ifOutDiscards from rx_packets dt-bindings: display/msm: qcom,sm8750-mdss: Fix model typo perf disasm: Fix off-by-one bug in outside check workqueue: Use POOL_BH instead of WQ_BH when checking pool flags btrfs: hold space_info->lock when clearing periodic reclaim ready xprtrdma: Decrement re_receiving on the early exit paths drm/msm/dsi: fix hdisplay calculation when programming dsi registers nfs: return EISDIR on nfs3_proc_create if d_alias is a dir smb/server: Fix another refcount leak in smb2_open() powerpc: 83xx: km83xx: Fix keymile vendor prefix remoteproc: mediatek: Unprepare SCP clock during system suspend remoteproc: sysmon: Correct subsys_name_len type in QMI request powerpc/crash: adjust the elfcorehdr size powerpc/kexec/core: use big-endian types for crash variables kexec: Include kernel-end even without crashkernel powerpc/uaccess: Fix inline assembly for clang build on PPC32 ALSA: usb-audio: Check max frame size for implicit feedback mode, too drm/amdgpu/vcn5: Add SMU dpm interface type ALSA: usb-audio: Avoid implicit feedback mode on DIYINHK USB Audio 2.0 scsi: ufs: core: Fix shift out of bounds when MAXQ=32 scsi: ufs: core: Fix possible NULL pointer dereference in ufshcd_add_command_trace() ASoC: cs42l43: Report insert for exotic peripherals ASoC: amd: yc: Add ASUS EXPERTBOOK BM1503CDA to quirk table scsi: ses: Fix devices attaching to different hosts ACPI: OSI: Add DMI quirk for Acer Aspire One D255 wifi: mac80211: set default WMM parameters on all links unshare: fix unshare_fs() handling ALSA: hda/realtek: Fix speaker pop on Star Labs StarFighter scsi: mpi3mr: Add NULL checks when resetting request and reply queues fs: init flags_valid before calling vfs_fileattr_get scsi: ufs: core: Reset urgent_bkops_lvl to allow runtime PM power mode ACPI: PM: Save NVS memory on Lenovo G70-35 scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT Signed-off-by: Sivasri Kumar, Vanka <svanka@qti.qualcomm.com>
2 parents b92b7c0 + 44c944a commit 297e169

822 files changed

Lines changed: 8801 additions & 3714 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

Documentation/admin-guide/kernel-parameters.txt

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7925,6 +7925,9 @@
79257925
p = USB_QUIRK_SHORT_SET_ADDRESS_REQ_TIMEOUT
79267926
(Reduce timeout of the SET_ADDRESS
79277927
request from 5000 ms to 500 ms);
7928+
q = USB_QUIRK_FORCE_ONE_CONFIG (Device
7929+
claims zero configurations,
7930+
forcing to 1);
79287931
Example: quirks=0781:5580:bk,0a5c:5834:gij
79297932

79307933
usbhid.mousepoll=

Documentation/devicetree/bindings/display/msm/qcom,sm8750-mdss.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ maintainers:
1010
- Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
1111

1212
description:
13-
SM8650 MSM Mobile Display Subsystem(MDSS), which encapsulates sub-blocks like
13+
SM8750 MSM Mobile Display Subsystem(MDSS), which encapsulates sub-blocks like
1414
DPU display controller, DSI and DP interfaces etc.
1515

1616
$ref: /schemas/display/msm/mdss-common.yaml#

Documentation/devicetree/bindings/sound/st,stm32-sai.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -164,7 +164,7 @@ allOf:
164164
properties:
165165
compatible:
166166
contains:
167-
const: st,stm32mph7-sai
167+
const: st,stm32h7-sai
168168
then:
169169
properties:
170170
clocks:

Documentation/filesystems/overlayfs.rst

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -783,6 +783,56 @@ controlled by the "uuid" mount option, which supports these values:
783783
mounted with "uuid=on".
784784

785785

786+
Durability and copy up
787+
----------------------
788+
789+
The fsync(2) system call ensures that the data and metadata of a file
790+
are safely written to the backing storage, which is expected to
791+
guarantee the existence of the information post system crash.
792+
793+
Without an fsync(2) call, there is no guarantee that the observed
794+
data after a system crash will be either the old or the new data, but
795+
in practice, the observed data after crash is often the old or new data
796+
or a mix of both.
797+
798+
When an overlayfs file is modified for the first time, copy up will
799+
create a copy of the lower file and its parent directories in the upper
800+
layer. Since the Linux filesystem API does not enforce any particular
801+
ordering on storing changes without explicit fsync(2) calls, in case
802+
of a system crash, the upper file could end up with no data at all
803+
(i.e. zeros), which would be an unusual outcome. To avoid this
804+
experience, overlayfs calls fsync(2) on the upper file before completing
805+
data copy up with rename(2) or link(2) to make the copy up "atomic".
806+
807+
By default, overlayfs does not explicitly call fsync(2) on copied up
808+
directories or on metadata-only copy up, so it provides no guarantee to
809+
persist the user's modification unless the user calls fsync(2).
810+
The fsync during copy up only guarantees that if a copy up is observed
811+
after a crash, the observed data is not zeroes or intermediate values
812+
from the copy up staging area.
813+
814+
On traditional local filesystems with a single journal (e.g. ext4, xfs),
815+
fsync on a file also persists the parent directory changes, because they
816+
are usually modified in the same transaction, so metadata durability during
817+
data copy up effectively comes for free. Overlayfs further limits risk by
818+
disallowing network filesystems as upper layer.
819+
820+
Overlayfs can be tuned to prefer performance or durability when storing
821+
to the underlying upper layer. This is controlled by the "fsync" mount
822+
option, which supports these values:
823+
824+
- "auto": (default)
825+
Call fsync(2) on upper file before completion of data copy up.
826+
No explicit fsync(2) on directory or metadata-only copy up.
827+
- "strict":
828+
Call fsync(2) on upper file and directories before completion of any
829+
copy up.
830+
- "volatile": [*]
831+
Prefer performance over durability (see `Volatile mount`_)
832+
833+
[*] The mount option "volatile" is an alias to "fsync=volatile".
834+
835+
786836
Volatile mount
787837
--------------
788838

Documentation/hwmon/adm1177.rst

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -27,10 +27,10 @@ for details.
2727
Sysfs entries
2828
-------------
2929

30-
The following attributes are supported. Current maxim attribute
30+
The following attributes are supported. Current maximum attribute
3131
is read-write, all other attributes are read-only.
3232

33-
in0_input Measured voltage in microvolts.
33+
in0_input Measured voltage in millivolts.
3434

35-
curr1_input Measured current in microamperes.
36-
curr1_max_alarm Overcurrent alarm in microamperes.
35+
curr1_input Measured current in milliamperes.
36+
curr1_max Overcurrent shutdown threshold in milliamperes.

Documentation/hwmon/peci-cputemp.rst

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -51,8 +51,9 @@ temp1_max Provides thermal control temperature of the CPU package
5151
temp1_crit Provides shutdown temperature of the CPU package which
5252
is also known as the maximum processor junction
5353
temperature, Tjmax or Tprochot.
54-
temp1_crit_hyst Provides the hysteresis value from Tcontrol to Tjmax of
55-
the CPU package.
54+
temp1_crit_hyst Provides the hysteresis temperature of the CPU
55+
package. Returns Tcontrol, the temperature at which
56+
the critical condition clears.
5657

5758
temp2_label "DTS"
5859
temp2_input Provides current temperature of the CPU package scaled
@@ -62,8 +63,9 @@ temp2_max Provides thermal control temperature of the CPU package
6263
temp2_crit Provides shutdown temperature of the CPU package which
6364
is also known as the maximum processor junction
6465
temperature, Tjmax or Tprochot.
65-
temp2_crit_hyst Provides the hysteresis value from Tcontrol to Tjmax of
66-
the CPU package.
66+
temp2_crit_hyst Provides the hysteresis temperature of the CPU
67+
package. Returns Tcontrol, the temperature at which
68+
the critical condition clears.
6769

6870
temp3_label "Tcontrol"
6971
temp3_input Provides current Tcontrol temperature of the CPU

Documentation/netlink/specs/net_shaper.yaml

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -247,8 +247,8 @@ operations:
247247
flags: [admin-perm]
248248

249249
do:
250-
pre: net-shaper-nl-pre-doit
251-
post: net-shaper-nl-post-doit
250+
pre: net-shaper-nl-pre-doit-write
251+
post: net-shaper-nl-post-doit-write
252252
request:
253253
attributes:
254254
- ifindex
@@ -278,8 +278,8 @@ operations:
278278
flags: [admin-perm]
279279

280280
do:
281-
pre: net-shaper-nl-pre-doit
282-
post: net-shaper-nl-post-doit
281+
pre: net-shaper-nl-pre-doit-write
282+
post: net-shaper-nl-post-doit-write
283283
request:
284284
attributes: *ns-binding
285285

@@ -309,8 +309,8 @@ operations:
309309
flags: [admin-perm]
310310

311311
do:
312-
pre: net-shaper-nl-pre-doit
313-
post: net-shaper-nl-post-doit
312+
pre: net-shaper-nl-pre-doit-write
313+
post: net-shaper-nl-post-doit-write
314314
request:
315315
attributes:
316316
- ifindex

Documentation/virt/kvm/api.rst

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8403,6 +8403,14 @@ KVM_X86_QUIRK_IGNORE_GUEST_PAT By default, on Intel platforms, KVM ignores
84038403
guest software, for example if it does not
84048404
expose a bochs graphics device (which is
84058405
known to have had a buggy driver).
8406+
8407+
KVM_X86_QUIRK_VMCS12_ALLOW_FREEZE_IN_SMM By default, KVM relaxes the consistency
8408+
check for GUEST_IA32_DEBUGCTL in vmcs12
8409+
to allow FREEZE_IN_SMM to be set. When
8410+
this quirk is disabled, KVM requires this
8411+
bit to be cleared. Note that the vmcs02
8412+
bit is still completely controlled by the
8413+
host, regardless of the quirk setting.
84068414
=================================== ============================================
84078415

84088416
7.32 KVM_CAP_MAX_VCPU_ID

Makefile

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
# SPDX-License-Identifier: GPL-2.0
22
VERSION = 6
33
PATCHLEVEL = 18
4-
SUBLEVEL = 18
4+
SUBLEVEL = 21
55
EXTRAVERSION =
66
NAME = Baby Opossum Posse
77

@@ -473,6 +473,7 @@ KBUILD_USERLDFLAGS := $(USERLDFLAGS)
473473
export rust_common_flags := --edition=2021 \
474474
-Zbinary_dep_depinfo=y \
475475
-Astable_features \
476+
-Aunused_features \
476477
-Dnon_ascii_idents \
477478
-Dunsafe_op_in_unsafe_fn \
478479
-Wmissing_docs \
@@ -1440,13 +1441,13 @@ ifneq ($(wildcard $(resolve_btfids_O)),)
14401441
$(Q)$(MAKE) -sC $(srctree)/tools/bpf/resolve_btfids O=$(resolve_btfids_O) clean
14411442
endif
14421443

1443-
PHONY += objtool_clean
1444+
PHONY += objtool_clean objtool_mrproper
14441445

14451446
objtool_O = $(abspath $(objtree))/tools/objtool
14461447

1447-
objtool_clean:
1448+
objtool_clean objtool_mrproper:
14481449
ifneq ($(wildcard $(objtool_O)),)
1449-
$(Q)$(MAKE) -sC $(abs_srctree)/tools/objtool O=$(objtool_O) srctree=$(abs_srctree) clean
1450+
$(Q)$(MAKE) -sC $(abs_srctree)/tools/objtool O=$(objtool_O) srctree=$(abs_srctree) $(patsubst objtool_%,%,$@)
14501451
endif
14511452

14521453
tools/: FORCE
@@ -1587,7 +1588,7 @@ CLEAN_FILES += vmlinux.symvers modules-only.symvers \
15871588
modules.builtin.ranges vmlinux.o.map vmlinux.unstripped \
15881589
compile_commands.json rust/test \
15891590
rust-project.json .vmlinux.objs .vmlinux.export.c \
1590-
.builtin-dtbs-list .builtin-dtb.S
1591+
.builtin-dtbs-list .builtin-dtbs.S
15911592

15921593
# Directories & files removed with 'make mrproper'
15931594
MRPROPER_FILES += include/config include/generated \
@@ -1623,7 +1624,7 @@ PHONY += $(mrproper-dirs) mrproper
16231624
$(mrproper-dirs):
16241625
$(Q)$(MAKE) $(clean)=$(patsubst _mrproper_%,%,$@)
16251626

1626-
mrproper: clean $(mrproper-dirs)
1627+
mrproper: clean objtool_mrproper $(mrproper-dirs)
16271628
$(call cmd,rmfiles)
16281629
@find . $(RCS_FIND_IGNORE) \
16291630
\( -name '*.rmeta' \) \

arch/arm64/boot/dts/freescale/imx8mn-tqma8mqnl-mba8mx.dts

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -69,6 +69,10 @@
6969
samsung,esc-clock-frequency = <20000000>;
7070
};
7171

72+
&reg_usdhc2_vqmmc {
73+
status = "okay";
74+
};
75+
7276
&sai3 {
7377
assigned-clocks = <&clk IMX8MN_CLK_SAI3>;
7478
assigned-clock-parents = <&clk IMX8MN_AUDIO_PLL1_OUT>;
@@ -216,8 +220,7 @@
216220
<MX8MN_IOMUXC_SD2_DATA0_USDHC2_DATA0 0x1d4>,
217221
<MX8MN_IOMUXC_SD2_DATA1_USDHC2_DATA1 0x1d4>,
218222
<MX8MN_IOMUXC_SD2_DATA2_USDHC2_DATA2 0x1d4>,
219-
<MX8MN_IOMUXC_SD2_DATA3_USDHC2_DATA3 0x1d4>,
220-
<MX8MN_IOMUXC_GPIO1_IO04_USDHC2_VSELECT 0x84>;
223+
<MX8MN_IOMUXC_SD2_DATA3_USDHC2_DATA3 0x1d4>;
221224
};
222225

223226
pinctrl_usdhc2_100mhz: usdhc2-100mhzgrp {
@@ -226,8 +229,7 @@
226229
<MX8MN_IOMUXC_SD2_DATA0_USDHC2_DATA0 0x1d4>,
227230
<MX8MN_IOMUXC_SD2_DATA1_USDHC2_DATA1 0x1d4>,
228231
<MX8MN_IOMUXC_SD2_DATA2_USDHC2_DATA2 0x1d4>,
229-
<MX8MN_IOMUXC_SD2_DATA3_USDHC2_DATA3 0x1d4>,
230-
<MX8MN_IOMUXC_GPIO1_IO04_USDHC2_VSELECT 0x84>;
232+
<MX8MN_IOMUXC_SD2_DATA3_USDHC2_DATA3 0x1d4>;
231233
};
232234

233235
pinctrl_usdhc2_200mhz: usdhc2-200mhzgrp {
@@ -236,8 +238,7 @@
236238
<MX8MN_IOMUXC_SD2_DATA0_USDHC2_DATA0 0x1d4>,
237239
<MX8MN_IOMUXC_SD2_DATA1_USDHC2_DATA1 0x1d4>,
238240
<MX8MN_IOMUXC_SD2_DATA2_USDHC2_DATA2 0x1d4>,
239-
<MX8MN_IOMUXC_SD2_DATA3_USDHC2_DATA3 0x1d4>,
240-
<MX8MN_IOMUXC_GPIO1_IO04_USDHC2_VSELECT 0x84>;
241+
<MX8MN_IOMUXC_SD2_DATA3_USDHC2_DATA3 0x1d4>;
241242
};
242243

243244
pinctrl_usdhc2_gpio: usdhc2-gpiogrp {

0 commit comments

Comments
 (0)