Changelog
in Linux kernel
5.15.212
6lowpan:
fix NHC entry use-after-free on error path
ACPI:
CPPC: Suppress UBSAN warning caused by field misuse
ACPI:
IPMI: Fix message kref handling on dead device
ACPI:
NFIT: core: Fix acpi_nfit_init() error cleanup
ACPI:
resource: Amend kernel-doc style
afs:
Fix callback service message parsers to pass through -EAGAIN
afs:
Fix error code in afs_extract_vl_addrs()
afs:
Fix further netns teardown to cancel the preallocation charger
afs:
Fix netns teardown to cancel the preallocation charger
afs:
fix NULL pointer dereference in afs_get_tree()
afs:
Fix the volume AFS_VOLUME_RM_TREE is set on
afs:
Fix unchecked-length string display in debug statement
afs:
Fix vllist leak
alpha/PCI:
Add security_locked_down() check to pci_mmap_resource()
alpha/PCI:
Fix __pci_mmap_fits() overflow for zero-length BARs
ALSA:
aoa: check snd_ctl_new1() return value
ALSA:
caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser
ALSA:
es1938: check snd_ctl_new1() return value
ALSA:
firewire: isight: bound the sample count to the packet payload
ALSA:
seq: Add UMP support
ALSA:
seq: Avoid confusion of aligned read size
ALSA:
seq: Check UMP support for midi_version change
ALSA:
seq: Clear variable event pointer on read
ALSA:
seq: Fix uninitialised heap leak in snd_seq_event_dup()
ALSA:
seq: Introduce SNDRV_SEQ_IOCTL_USER_PVERSION ioctl
ALSA:
seq: Skip event type filtering for UMP events
ALSA:
usb-audio: avoid kobject path lookup in DualSense match
ALSA:
usb-audio: Propagate errors in scarlett_ctl_enum_put()
ALSA:
usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks
ALSA:
usb-audio: Roll back quirk control caches on write errors
ALSA:
usb-audio: Update Babyface Pro control caches only after successful writes
ALSA:
usb-audio: Update US-16x08 EQ/comp shadow state after successful writes
ALSA:
virtio: Add missing 384 kHz PCM rate mapping
apparmor:
aa_getprocattr free procattr leak on format failure
apparmor:
aa_label_alloc use aa_label_free on alloc failure
apparmor:
check label build before no_new_privs test
apparmor:
fix label can not be immediately before a declaration
apparmor:
fix potential UAF in aa_replace_profiles
apparmor:
fix use-after-free in rawdata dedup loop
apparmor:
grab ns lock and refresh when looking up changehat child profiles
apparmor:
mediate the implicit connect of TCP fast open sendmsg
apparmor:
put secmark label after secid lookup
arm64/hw_breakpoint:
reject unaligned watchpoints that would truncate BAS
arm64/mm:
Optimize TLB flush in unmap_hotplug_[pmd|pud]_range()
arm64:
dts: qcom: sdm630: describe adsp_mem region properly
ARM:
dts: am335x-sl50: Fix audio bitclock and frame master endpoint
ARM:
imx31: Fix IIM mapping leak in revision check
ARM:
imx3: Fix CCM node reference leak
ASoC:
adau1372: Clear PLL_EN on failed PLL lock without reset GPIO
ASoC:
codecs: hdac_hdmi: Validate written enum value
ASoC:
fsl: fsl_audmix: Validate written enum values
ASoC:
tegra: tegra210_ahub: Validate written enum value
ata:
pata_pxa: Fix DMA channel leak on probe error
ata:
sata_gemini: unwind clocks on IDE pinctrl errors
audit:
add audit_log_nf_skb helper function
audit:
Fix data races of skb_queue_len() readers on audit_queue
audit:
fix potential integer overflow in audit_log_n_hex()
batman-adv:
access unicast_ttvn skb->data only after skb realloc
batman-adv:
bla: reacquire gw address after skb realloc
batman-adv:
clean untagged VLAN on netdev registration failure
batman-adv:
dat: acquire ARP hw source only after skb realloc
batman-adv:
dat: ensure accessible eth_hdr proto field
batman-adv:
dat: fix tie-break for candidate selection
batman-adv:
ensure minimal ethernet header on TX
batman-adv:
fix VLAN priority offset
batman-adv:
frag: fix primary_if leak on failed linearization
batman-adv:
frag: free unfragmentable packet
batman-adv:
gw: acquire ethernet header only after skb realloc
batman-adv:
retrieve ethhdr after potential skb realloc on RX
batman-adv:
tt: avoid request storms during pending request
batman-adv:
tt: prevent TVLV OOB check overflow
binder:
fix UAF in binder_free_transaction()
binder:
fix UAF in binder_thread_release()
bitops:
make BYTES_TO_BITS() treewide-available
block:
Avoid mounting the bdev pseudo-filesystem in userspace
Bluetooth:
bnep: pin L2CAP connection during netdev registration
Bluetooth:
bpa10x: avoid OOB read of revision string in bpa10x_setup()
Bluetooth:
btrtl: validate firmware patch bounds
Bluetooth:
btusb: fix use-after-free on marvell probe failure
Bluetooth:
btusb: fix use-after-free on registration failure
Bluetooth:
btusb: fix wakeup source leak on probe failure
Bluetooth:
fix UAF in bt_accept_dequeue()
Bluetooth:
ISO: exclude RFU bits from ISO_SDU_Length
Bluetooth:
L2CAP: cancel pending_rx_work before taking conn->lock
Bluetooth:
L2CAP: Fix deadlock in l2cap_conn_del()
Bluetooth:
L2CAP: Fix not tracking outstanding TX ident
Bluetooth:
L2CAP: Fix regressions caused by reusing ident
Bluetooth:
L2CAP: validate option length before reading conf opt value
Bluetooth:
SCO: fix sleeping under spinlock in sco_conn_ready
Bluetooth:
SCO: hold sk properly in sco_conn_ready
bnx2x:
fix potential memory leak in bnx2x_alloc_mem_bp()
bonding:
3ad: fix mux port state on oper down
bpf, sockmap:
fix integer overflow in bpf_msg_pop_data() bounds check
bpf, sockmap:
reject overflowing copy + len in bpf_msg_push_data()
bpf:
Allow LPM map access from sleepable BPF programs
bpf:
Consistently use bpf_rcu_lock_held() everywhere
bpf:
Convert lpm_trie.c to rqspinlock
bpf:
Fix stack slot index in nospec checks
bpf:
fix UAF by restoring RCU-delayed inode freeing in bpffs
bpf:
Reject fragmented frames in devmap
bpf:
Run generic devmap egress prog on private skb
bpf:
Tighten cgroup storage cookie checks for prog arrays
bpf:
Update transport_header when encapsulating UDP tunnel in lwt
bpf:
zero-initialize the fib lookup flow struct
bpftool:
Use libbpf error code for flow dissector query
bridge:
cfm: reject invalid CCM interval at configuration time
bridge:
stp: Fix a potential use-after-free when deleting a bridge
btrfs:
do not trim a device which is not writeable
btrfs:
fix false IO failure after falling back to buffered write
btrfs:
fix incorrect buffered IO fallback for append direct writes
btrfs:
fix invalid pointer dereference in __btrfs_run_delayed_refs()
bus:
sunxi-rsb: Always check register address validity
can:
bcm: add missing rcu list annotations and operations
can:
bcm: fix lockless bound/ifindex race and silent RX_SETUP failure
can:
isotp: use unconditional synchronize_rcu() in isotp_release()
cgroup/cpuset:
rebind mm mempolicy to effective_mems, not mems_allowed
char:
tlclk: fix use-after-free in tlclk_cleanup()
cifs:
Add tracing for the cifs_tcon struct refcounting
cifs:
Create a new shared file holding smb2 pdu definitions
cifs:
remove check of list iterator against head past the loop body
cifs:
remove unused server parameter from calc_smb_size()
clk:
imx: Add check for kcalloc
clk:
qcom: a53: Corrected frequency multiplier for 1152MHz
clk:
scmi: Fix clock rate rounding
configfs:
fix lockless traversals of ->s_children
configfs_lookup():
don't leave ->s_dentry dangling on failure
coresight:
cti: Fix DT filter signals silently ignored
coresight:
etb10: restore atomic_t for shared reading state
coresight:
etm4x: Correct TRCVMIDCCTLR1 save and restore
cpu:
hotplug: Bound hotplug states sysfs output
cpu:
hotplug: Preserve per instance callback errors
cpufreq:
conservative: Simplify frequency limit handling
cpufreq:
Documentation: fix conservative governor freq_step description
cpufreq:
Documentation: fix sampling_down_factor range
cpufreq:
Fix hotplug-suspend race during reboot
cpufreq:
intel_pstate: Sync policy->cur during CPU offline
cpufreq:
pcc: fix use-after-free and double free in _OSC evaluation
crypto:
af_alg - Remove zero-copy support from skcipher and aead
crypto:
algif_skcipher - force synchronous processing on trees without ctx->state
crypto:
amlogic - avoid double cleanup in meson_crypto_probe()
crypto:
asymmetric_keys - fix OOB read in pefile_digest_pe_contents
crypto:
atmel - Drop explicit initialization of struct i2c_device_id::driver_data to 0
crypto:
atmel-sha204a - drop hwrng quality reduction for ATSHA204A
crypto:
atmel-sha204a - fix blocking and non-blocking rng logic
crypto:
atmel-sha204a - Mark OF related data as maybe unused
crypto:
caam - use print_hex_dump_devel to guard key hex dumps
crypto:
caam - use print_hex_dump_devel to guard key hex dumps again
crypto:
cavium/cpt - fix DMA cleanup using wrong loop index
crypto:
ccp - Treat zero-length cert chain as query for blob lengths
crypto:
crypto4xx - Remove ahash-related code
crypto:
crypto4xx - Remove insecure and unused rng_alg
crypto:
drbg - Fix drbg_max_addtl() on 64-bit kernels
crypto:
drbg - Fix returning success on failure in CTR_DRBG
crypto:
drbg - Fix the fips_enabled priority boost
crypto:
ecc - Fix carry overflow in vli multiplication
crypto:
ecrdsa - fix unknown OID check in ecrdsa_param_curve
crypto:
hisi-trng - Remove crypto_rng interface
crypto:
hisilicon/qm - disable error report before flr
crypto:
marvell/octeontx - fix DMA cleanup using wrong loop index
crypto:
pcrypt - restore callback for non-parallel fallback
crypto:
qat - fix restarting state leak on allocation failure
crypto:
qat - fix VF2PF work teardown race in adf_disable_sriov()
crypto:
qat - validate RSA CRT component lengths
crypto:
rng - Free default RNG on module exit
crypto:
sun4i-ss - Remove insecure and unused rng_alg
crypto:
talitos - use dma_sync_single_for_cpu() before reading descriptor header
cxgb4:
Fix decode strings dump for T6 adapters
dax/kmem:
account for partial discontiguous resource upon removal
debugobjects:
Plug race against a concurrent OOM disable
device property:
fix fwnode reference leak in fwnode_graph_get_endpoint_by_id()
device property:
initialize the remaining fields of fwnode_handle in fwnode_init()
dm era:
fix NULL pointer dereference in metadata_open()
dm era:
fix out-of-bounds memory access for non-zero start sector
dm thin metadata:
fix metadata snapshot consistency on commit failure
dm thin metadata:
fix superblock refcount leak on snapshot shadow failure
dm-bufio:
fix wrong count calculation in dm_bufio_issue_discard
dm-ioctl:
report an error if a device has no table
dm-log:
fix a bitset_size overflow on 32bit machines
dm-stats:
fix dm_jiffies_to_msec64
dm-stats:
fix merge accounting
dm-verity:
increase sprintf buffer size
dm_early_create:
fix freeing used table on dm_resume failure
dma-buf:
remove unused dma-fence-unwrap.c (stable/linux-5.15.y only)
dmaengine:
Fix possible use after free
dmaengine:
qcom: gpi: set DMA_PRIVATE capability
dpaa2-switch:
fix VLAN upper check not rejecting bridge join
drbd:
reject data replies with an out-of-range payload size
driver core:
use READ_ONCE() for dev->driver in dev_has_sync_state()
drm/amd/display:
Add missing kdoc for ALLM parameters
drm/edid:
fix OOB read in drm_parse_tiled_block()
drm/hisilicon/hibmc:
move display contrl config to hibmc_probe()
drm/hisilicon/hibmc:
use clock to look up the PLL value
drm/i2c/sil164:
Drop no-op remove function
drm/msm/dp:
fix HPD state status bit shift value
drm/msm/dp:
Fix the ISR_* enum values
drm/nouveau/bios:
specify correct display fuse register for Ampere and Ada
drm/radeon:
fix memory leak in radeon_ring_restore() on lock failure
drm/tegra:
dc: Fix device node reference leak in tegra_dc_has_output()
drm/tegra:
Fix iommu_map_sgtable() return value check
drm/tidss:
Drop extra drm_mode_config_reset() call
dt-bindings:
media: sun4i-a10-video-engine: Add interconnect properties
EDAC/{skx_common,skx}:
Fix UBSAN shift-out-of-bounds in skx_get_dimm_info
evm:
terminate and bound the evm_xattrs read buffer
exfat:
bound uniname advance in exfat_find_dir_entry()
ext4:
fix LOGFLUSH shutdown ordering to allow ordered-mode data writeback
f2fs:
adjust zone capacity when considering valid block count
f2fs:
bound i_inline_xattr_size for non-inline-xattr inodes
f2fs:
fix listxattr handling of corrupted xattr entries
f2fs:
fix potential deadlock in f2fs_balance_fs()
f2fs:
fix potential deadlock in gc_merge path of f2fs_balance_fs()
f2fs:
fix to detect corrupted meta ino
f2fs:
fix to round down start offset of fallocate for pin file
f2fs:
validate compress cache inode only when enabled
f2fs:
validate orphan inode entry count
fbcon:
fix NULL pointer dereference for a console without vc_data
fbdev:
broadsheetfb: fix potential memory leak in broadsheetfb_probe()
fbdev:
carminefb: fix potential memory leak in alloc_carmine_fb()
fbdev:
fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()
fbdev:
hecubafb: fix potential memory leak in hecubafb_probe()
fbdev:
i740fb: fix potential memory leak in i740fb_probe()
fbdev:
metronomefb: fix potential memory leak in metronomefb_probe()
fbdev:
nvidia: fix potential memory leak in nvidiafb_probe()
fbdev:
radeon: fix potential memory leak in radeonfb_pci_register()
fbdev:
s3fb: fix potential memory leak in s3_pci_probe()
fbdev:
sm501fb: Fix buffer errors in OF binding code
fbdev:
sm712: Fix operator precedence in big_swap macro
fbdev:
tdfxfb: fix potential memory leak in tdfxfb_probe()
fbdev:
tridentfb: fix potential memory leak in trident_pci_probe()
fbdev:
uvesafb: fix potential memory leak in uvesafb_probe()
firmware:
arm_scmi: Fix OOB in scmi_power_name_get()
firmware:
arm_scmi: Read sensor config as 32-bit value
firmware_loader:
Fix recursive lock in device_cache_fw_images()
fs/ntfs3:
add depth limit to indx_find_buffer to prevent stack overflow
fs/ntfs3:
bound attr_off in UpdateResidentValue against data_off
fs/ntfs3:
bound DeleteIndexEntryAllocation memmove length
fs/ntfs3:
bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation}
fs/ntfs3:
fix syncing wrong inode on DIRSYNC cross-directory rename
fs/ntfs3:
validate Dirty Page Table capacity in log_replay copy_lcns
fs/ntfs3:
validate lcns_follow in log_replay conversion
fs:
efs: remove unneeded debug prints
fsl/fman:
Free init resources on KeyGen failure in fman_init()
fuse:
fix device node leak in cuse_process_init_reply()
fuse:
re-lock request before returning from fuse_ref_folio()
gpio:
eic-sprd: use raw_spinlock_t in the irq startup path
gpio:
htc-egpio: use managed gpiochip registration
gpio:
mvebu: fail probe if gpiochip registration fails
gpio:
pca953x: Make platform teardown callback return void
gpio:
sch: use new GPIO line value setter callbacks
gpio:
sch: use raw_spinlock_t in the irq startup path
gpio:
timberdale: Return -ENOMEM on dynamic memory allocation in probe
gpios:
palmas: add .get_direction() op
gpu:
host1x: Fix device reference leak in host1x_device_parse_dt() error path
gue:
validate REMCSUM private option length
hfs/hfsplus:
fix u32 overflow in check_and_correct_requested_length
hfs/hfsplus:
prevent getting negative values of offset/length
hfs/hfsplus:
zero-initialize buffer in hfs_bnode_read
HID:
add haptics page defines
HID:
appleir: fix UAF on pending key_up_timer in remove()
HID:
core: Fix OOB read in hid_get_report for numbered reports
HID:
lg-g15: cancel pending work on remove to fix a use-after-free
HID:
logitech-hidpp: remove excess kernel-doc member in hidpp_scroll_counter
HID:
multitouch: fix out-of-bounds bit access on mt_io_flags
HID:
picolcd: prevent NULL pointer dereference in picolcd_send_and_wait()
HID:
sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte reads
HID:
wacom: stop hardware after post-start probe failures
hwmon:
(asus_atk0110) Check package count before accessing element
hwmon:
(ltc2992) add missing 'select REGMAP_I2C' to Kconfig
hwmon:
(w83627hf) remove VID sysfs files on error and remove
hwmon:
(w83793) remove vrm sysfs file on probe failure
hwmon:
adm1275: Prevent reading uninitialized stack
hwrng:
virtio: clamp device-reported used.len at copy_data()
hwspinlock:
qcom: avoid uninitialized struct members
i2c:
core: fix adapter debugfs creation
i2c:
core: fix adapter deregistration race
i2c:
core: fix adapter registration race
i2c:
core: fix hang on adapter registration failure
i2c:
core: fix irq domain leak on adapter registration failure
i2c:
core: fix NULL-deref on adapter registration failure
i2c:
mediatek: fix WRRD for SoCs without auto_restart option
i2c:
mlxbf: Fix use-after-free in mlxbf_i2c_init_resource()
i2c:
stm32f7: truncate clock period instead of rounding it
i3c:
master: Prevent reuse of dynamic address on device add failure
IB/cm:
Fix av cm device leak on an error path in cm_init_av_by_path()
IB/mlx4:
Fill in the access_flags if IB_MR_REREG_ACCESS is not specified
IB/mlx4:
Fix refcount leak in add_port() error path
IB/mlx5:
Don't take the rereg_mr fallback without a new translation
IB/mlx5:
Properly support implicit ODP rereg_mr
ieee802154:
admin-gate legacy LLSEC dump operations
ieee802154:
allow legacy LLSEC ADD/DEL ops to pass strict validation
ieee802154:
ca8210: fix cas_ctl leak on spi_async failure
ieee802154:
ca8210: fix pointer truncation in kfifo on 64-bit
ieee802154:
fix kernel-infoleak in dgram_recvmsg()
ieee802154:
Remove WARN_ON() in cfg802154_pernet_exit()
iio:
accel: bmc150: clamp the device-reported FIFO frame count
iio:
accel: kxsd9: fix runtime PM imbalance on write_raw() error
iio:
accel: mma8452: handle I2C read error(s) in mma8452_read()
iio:
adc: lpc32xx: Initialize completion before requesting IRQ
iio:
adc: spear: Initialize completion before requesting IRQ
iio:
adc: ti-ads124s08: Return reset GPIO lookup errors
iio:
chemical: scd30: Cleanup initializations and fix sign-extension bug
iio:
common: st_sensors: honour channel endianness in read_axis_data
iio:
event: Fix event FIFO reset race
iio:
gyro: bmg160: bail out when bandwidth/filter is not in table
iio:
gyro: bmg160: wait full startup time after mode change at probe
iio:
hid-sensor-rotation: Fix stale or zero output when reading raw values
iio:
imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ
iio:
imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ
iio:
imu: inv_icm42600: fix timestamp clock period by using lower value
iio:
imu: inv_icm42600: fix timestamping by limiting FIFO reading
iio:
imu: inv_icm42600: make timestamp module chip independent
iio:
imu: inv_icm42600: stabilized timestamp in interrupt
iio:
imu: inv_mpu6050: fix frequency setting when chip is off
iio:
imu: inv_mpu6050: use the common inv_sensors timestamp module
iio:
imu: st_lsm6dsx: deselect shub page before reading whoami
iio:
invensense: fix odr switching to same value
iio:
invensense: fix timestamp glitches when switching frequency
iio:
invensense: remove redundant initialization of variable period
iio:
light: al3010: fix incorrect scale for the highest gain range
iio:
light: gp2ap002: fix runtime PM leak on read error
iio:
light: opt3001: fix missing state reset on timeout
iio:
light: si1133: prevent race condition on timeout
iio:
light: si1133: reset counter to prevent race condition
iio:
light: tsl2591: return actual error from probe IRQ failure
iio:
light: veml6030: fix channel type when pushing events
iio:
magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call
iio:
magnetometer: ak8975: fix potential kernel stack memory leak
iio:
make invensense timestamp module generic
iio:
move inv_icm42600 timestamp module in common
iio:
temperature: ltc2983: Fix n_wires default bypassing rotation check
iio:
temperature: ltc2983: Fix reinit_completion() called after conversion start
inet:
allow ip_valid_fib_dump_req() to be called with RTNL or RCU
Input:
elan_i2c - prevent division by zero and arithmetic underflow
Input:
goodix - clamp the device-reported contact count
Input:
iforce - bound the device-reported force-feedback effect index
Input:
ims-pcu - add response length checks
Input:
ims-pcu - fix DMA mapping violation in line setup
Input:
ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging
Input:
ims-pcu - fix potential infinite loop in CDC union descriptor parsing
Input:
ims-pcu - fix type confusion in CDC union descriptor parsing
Input:
ims-pcu - fix use-after-free and double-free in disconnect
Input:
ims-pcu - release data interface on disconnect
Input:
ims-pcu - validate control endpoint type
Input:
maple_keyb - set driver data before registering input device
Input:
maplecontrol - set driver data before registering input device
Input:
maplemouse - fix NULL pointer dereference in open()
Input:
maplemouse - set driver data before registering input device
Input:
mms114 - fix multi-touch slot corruption
Input:
synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count
Input:
synaptics-rmi4 - bound the F3A keymap to the GPIO count
Input:
synaptics-rmi4 - unregister function handlers on physical driver registration failure
Input:
touchwin - reset the packet index on every complete packet
io_uring/io-wq:
re-check IO_WQ_BIT_EXIT for each linked work item
iommu/amd:
Fix a stale comment about which legacy mode is user visible
ipv4:
fib: Don't ignore error route in local/main tables.
ipv4:
igmp: remove multicast group from hash table on device destruction
ipv6:
addrconf: bail out of dad_failure when state is no longer POSTDAD
ipv6:
fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump
ipv6:
fix error handling in disable_ipv6 sysctl
ipv6:
fix error handling in disable_policy sysctl
ipv6:
fix error handling in forwarding sysctl
ipv6:
fix error handling in ignore_routes_with_linkdown sysctl
ipv6:
Fix null-ptr-deref in fib6_nh_mtu_change().
ipv6:
guard against possible NULL deref in __in6_dev_stats_get()
ipv6:
mcast: Fix potential UAF in MLD delayed work
ipv6:
mcast: Replace locking comments with lockdep annotations.
ipv6:
remove RTNL protection from inet6_dump_fib()
ipvs:
ensure inner headers in ICMP errors are in headroom
ipvs:
fix more places with wrong ipv6 transport offsets
ipvs:
fix PMTU for GUE/GRE tunnel ICMP errors
ipvs:
pass parsed transport offset to state handlers
ipvs:
reset full ip_vs_seq structs in ip_vs_conn_new
ipvs:
use parsed transport offset in SCTP state lookup
ipvs:
use parsed transport offset in TCP state lookup
irqchip/crossbar:
Fix parent domain resource leak
irqchip/crossbar:
Use correct index in crossbar_domain_free()
irqchip/gic-v3-its:
Fix OF node reference leak
isofs:
bound Rock Ridge symlink components to the SL record
jbd2:
fix integer underflow in jbd2_journal_initialize_fast_commit()
kcm:
use WRITE_ONCE() when changing lower socket callbacks
kconfig:
fix potential NULL pointer dereference in conf_askvalue
KEYS:
Use acquire when reading state in keyring search
ksmbd:
centralize ksmbd_conn final release to plug transport leak
ksmbd:
destroy async_ida in ksmbd_conn_free()
ksmbd:
fix mechToken leak when SPNEGO decode fails after token alloc
ksmbd:
fix out-of-bounds read in smb_check_perm_dacl()
ksmbd:
fix use-after-free in __ksmbd_close_fd() via durable scavenger
ksmbd:
fix use-after-free in same_client_has_lease()
ksmbd:
fix use-after-free of conn->preauth_info in concurrent SMB2 NEGOTIATE
ksmbd:
track the connection owning a byte-range lock
KVM:
arm64: vgic: Check the interrupt is still ours before migrating it
KVM:
Move kvm_io_bus_get_dev() locking responsibilities to callers
KVM:
Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned()
KVM:
VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode
leds:
lm3601x: Improve error reporting for problems during .remove()
leds:
lm3697: Remove duplicated error reporting in .remove()
leds:
uleds: Fix potential buffer overread
lib/test_meminit:
use && for bools
libbpf:
Fix UAF in strset__add_str()
Linux:
Linux 5.15.212
llc:
fix SAP refcount leak in llc_ui_autobind()
llc:
fix SAP refcount leak when creating incoming sockets
lockd:
Plug nlm_file leak when nlm_do_fopen() fails
lockd:
Plug nlm_file refcount leak on cached nlm_do_fopen() failure
locking/rtmutex:
Skip remove_waiter() when waiter is not enqueued
mac802154:
remove interfaces with RCU list deletion
macsec:
fix promiscuity refcount leak in macsec_dev_open()
md/raid10:
reset read_slot when reusing r10bio for discard
media:
atomisp: Fix memory leak in atomisp_fixed_pattern_table()
media:
cedrus: Fix failure to clean up hardware on probe failure
media:
qcom: venus: drop extra padding in NV12 raw size calculation
media:
qcom: venus: relax encoder frame/blur dimension steps on v4
media:
qcom: venus: relax encoder frame/blur step size on v6
media:
rockchip: rga: fix too small buffer size
media:
staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe
media:
uvcvideo: Avoid partial metadata buffers
media:
uvcvideo: Fix buffer sequence in frame gaps
memstick:
ms_block: reject a card that reports too many blocks
mfd:
cros_ec: Delay dev_set_drvdata() until probe success
mfd:
sm501: Fix reference leak on failed device registration
mfd:
tps6586x: Fix OF node refcount
MIPS:
DEC: Ensure 32-bit stack location for o32 prom_printf()
MIPS:
DEC: Remove do_IRQ() call indirection
MIPS:
Fix big-endian stack argument fetching in o32 wrapper
MIPS:
ip22-gio: fix device reference leak in probe
MIPS:
ip22-gio: fix gio device memory leak
MIPS:
ip22-gio: fix kfree() of static object
MIPS:
mm: Fix out-of-bounds write in maar_res_walk()
mips:
n64: add __iomem for writel call
mips:
ralink: mt7621: add missing __iomem
mips:
sched: Fix CPUMASK_OFFSTACK memory corruption
mlxsw:
fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace()
mm/fake-numa:
fix under-allocation detection in uniform split
mmc:
vub300: defer reset until cmd_mutex is unlocked
mtd:
maps: vmu-flash: fix NULL pointer dereference in initialization
mtd:
mchp23k256: use SPI match data for chip caps
mtd:
onenand: samsung: report DMA completion timeouts
mtd:
rawnand: fix condition in 'nand_select_target()'
mtd:
rawnand: fsl_ifc: return errors for failed page reads
mtd:
rawnand: lpc32xx_mlc: fail DMA transfers on timeout
mtd:
rawnand: lpc32xx_slc: fail DMA transfer on completion timeout
mtd:
rawnand: pl353: fix probe resource allocation
mtd:
slram: remove failed entries from the device list
mtd:
spi-nor: Drop duplicate Kconfig dependency
net, bpf:
check master for NULL in xdp_master_redirect()
net/9p:
fix infinite loop in p9_client_rpc on fatal signal
net/9p:
fix race condition on rdma->state in trans_rdma.c
net/mlx5:
Fix L3 tunnel entropy refcount leak
net/sched:
act_bpf: use rcu_dereference_bh() to read the filter
net/sched:
act_pedit: use NLA_POLICY for parsing 'ex' keys
net/sched:
cake: reject overhead values that underflow length
net/sched:
cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle
net/sched:
cls_bpf: prevent unbounded recursion in offload rollback
net/sched:
hhf: clear heavy-hitter state on reset
net/sched:
sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen
net/sched:
sch_drr: annotate data-races around cl->deficit
net/sched:
sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen
net/sched:
sch_hfsc: annotate data-races in hfsc_dump_class_stats()
net/sched:
sch_hfsc: Don't make class passive twice
net/sched:
sch_htb: annotate data-races (I)
net/sched:
sch_htb: do not change sch->flags in htb_dump()
net/sched:
sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked
net/smc:
fix UAF in smc_cdc_rx_handler() by pinning the socket
net:
af_key: initialize alg_key_len for IPComp states
net:
atm: reject out-of-range traffic classes in QoS validation
net:
Drop the lock in skb_may_tx_timestamp()
net:
dsa: sja1105: round up PTP perout pin duration
net:
dsa: tag_ksz: do not rely on skb_mac_header() in TX paths
net:
ena: clean up XDP TX queues when regular TX setup fails
net:
fib_rules: Don't dump dying fib_rule in fib_rules_dump().
net:
gianfar: dispose irq mappings on probe failure and device removal
net:
ife: require ETH_HLEN to be pullable in ife_decode()
net:
ip6_gre: require CAP_NET_ADMIN in the device netns for changelink
net:
ip6_vti: require CAP_NET_ADMIN in the device netns for changelink
net:
ip_gre: require CAP_NET_ADMIN in the device netns for changelink
net:
ip_vti: require CAP_NET_ADMIN in the device netns for changelink
net:
ipv4: bound TCP reordering sysctl writes and MTU probe sizes
net:
liquidio: fix BAR resource leak on PF number failure
net:
mana: guard TX wq object destroy with INVALID_MANA_HANDLE check
net:
mana: initialize gdma queue id to INVALID_QUEUE_ID
net:
mvneta: re-enable percpu interrupt on resume
net:
openvswitch: reject oversized nested action attrs
net:
psample: fix info leak in PSAMPLE_ATTR_DATA
net:
qrtr: fix 32-bit integer overflow in qrtr_endpoint_post()
net:
qualcomm: rmnet: add tx packets aggregation
net:
qualcomm: rmnet: validate MAP frame length before ingress parsing
net:
sit: require CAP_NET_ADMIN in the device netns for changelink
net:
skmsg: preserve sg.copy across SG transforms
net:
sparx5: unregister blocking notifier on init failure
net:
sungem: fix probe error cleanup
net:
usb: kalmia: bound RX frame length in kalmia_rx_fixup()
net:
usb: lan78xx: disable VLAN filter in promiscuous mode
net:
usb: net1080: validate packet_len before pad-byte access in rx_fixup
netfilter:
bridge: fix stale prevhdr pointer in br_ip6_fragment()
netfilter:
conntrack: call nf_ct_gre_keymap_destroy() if master helper is pptp
netfilter:
ebtables: module names must be null-terminated
netfilter:
ebtables: terminate table name before find_table_lock()
netfilter:
ebtables: Use vmalloc_array() to improve code
netfilter:
ebtables: zero chainstack array
netfilter:
ip6tables: mark malformed IPv6 extension headers for hotdrop
netfilter:
ipset: fix order of kfree_rcu() and rcu_assign_pointer()
netfilter:
ipset: fix race between dump and ip_set_list resize
netfilter:
nf_conncount: callers must hold rcu read lock
netfilter:
nf_conncount: fix zone comparison in tuple dedup
netfilter:
nf_conncount: prevent connlimit drops for early confirmed ct
netfilter:
nf_conntrack_irc: fix parse_dcc() off-by-one OOB read
netfilter:
nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag
netfilter:
nf_nat_sip: reload possible stale data pointer
netfilter:
nf_reject: skip iphdr options when looking for icmp header
netfilter:
nf_tables: restore set elements when delete set fails
netfilter:
nfnetlink_osf: fix mss parsing on big-endian architectures
netfilter:
nfnl_cthelper: apply per-class values when updating policies
netfilter:
nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak
netfilter:
nft_synproxy: stop bypassing the priv->info snapshot
netfilter:
synproxy: protect nf_ct_seqadj_init() with conntrack lock
netfilter:
xt_cluster: reject template conntracks in hash match
netfilter:
xt_connmark: reject invalid shift parameters
netfilter:
xt_nat: reject unsupported target families
netfilter:
xt_rateest: fix u64 truncation in xt_rateest_mt()
netfilter:
xt_u32: reject invalid shift counts
nfc:
llcp: protect nfc_llcp_sock_unlink() calls
nfsd:
change nfs4_client_to_reclaim() to allocate data
nfsd:
move name lookup out of nfsd4_list_rec_dir()
nfsd:
release layout stid on setlease failure
nfsd:
reset write verifier on deferred writeback errors
NFSv4/flexfiles:
honor FF_FLAGS_NO_IO_THRU_MDS in pg_get_mirror_count_write
NFSv4/flexfiles:
honor FF_FLAGS_NO_IO_THRU_MDS on fatal DS connect errors
NFSv4/flexfiles:
reject zero filehandle version count
NFSv4/pnfs:
defer return_range callbacks until after inode unlock
NFSv4:
include MAY_WRITE in open permission mask for O_TRUNC
nilfs2:
reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers
NTB:
epf: Avoid calling pci_irq_vector() from hardirq context
NTB:
epf: Fix request_irq() unwind in ntb_epf_init_isr()
NTB:
epf: Make db_valid_mask cover only real doorbell bits
ntfs3:
bound to_move in indx_insert_into_root before hdr_insert_head
ntfs3:
cap RESTART_TABLE free-chain walker at rt->used
ntfs3:
fix out-of-bounds read in decompress_lznt
nvdimm/btt:
Free arena sub-allocations on discover_arenas() error path
nvdimm/btt:
Free arenas on btt_init() error paths
nvme-multipath:
fix flex array size in struct nvme_ns_head
nvme-multipath:
set BIO_REMAPPED on bios remapped to per-path namespace disks
nvmet-rdma:
handle inline data with a nonzero offset
nvmet-tcp:
check INIT_FAILED before nvmet_req_uninit in digest error path
nvmet-tcp:
fix race between ICReq handling and queue teardown
ocfs2/dlm:
require a ref for locking_state debugfs open
ocfs2:
avoid moving extents to occupied clusters
ocfs2:
don't BUG_ON an invalid journal dinode
ocfs2:
fix buffer head management in ocfs2_read_blocks()
ocfs2:
fix circular locking dependency in ocfs2_dio_end_io_write
ocfs2:
fix NULL h_transaction deref in ocfs2_assure_trans_credits
ocfs2:
fix race between ocfs2_control_install_private() and ocfs2_control_release()
ocfs2:
kill osb->system_file_mutex lock
ocfs2:
rebase copied fsdlm LVB pointers in locking_state
ocfs2:
reject dinodes whose i_rdev disagrees with the file type
ocfs2:
reject dinodes with non-canonical i_mode type
ocfs2:
reject FITRIM ranges shorter than a cluster
ocfs2:
reject non-inline dinodes with i_size and zero i_clusters
ocfs2:
use kzalloc for quota recovery bitmap allocation
octeontx2-af:
Allow mkex profile without DMAC and add L2M/L2B header extraction support
octeontx2-af:
debugfs: Add channel and channel mask.
octeontx2-af:
devlink configuration support
octeontx2-af:
Drop rules for NPC MCAM
octeontx2-af:
Exact match scan from kex profile
octeontx2-af:
Exact match support
octeontx2-af:
FLR handler for exact match table.
octeontx2-af:
Use hashed field in MCAM key
octeontx2-pf:
Add additional checks while configuring ucast/bcast/mcast rules
octeontx2-pf:
check DMAC extraction support before filtering
octeontx2-pf:
Fix leak of SQ timestamp buffer on teardown
orangefs:
keep the readdir entry size 64-bit in fill_from_part()
partitions:
aix: bound the pp_count scan to the ppe array
PCI:
Add kerneldoc for pci_resize_resource()
PCI:
altera: Do not dispose parent IRQ mapping
PCI:
altera: Fix resource leaks on probe failure
PCI:
controller: Use dev_fwnode() instead of of_fwnode_handle()
PCI:
endpoint: pci-epf-ntb: Add check to detect 'db_count' value of 0
PCI:
endpoint: pci-epf-vntb: Add check to detect 'db_count' value of 0
PCI:
Fix restoring BARs on BAR resize rollback path
PCI:
Free saved list without holding pci_bus_sem
PCI:
host-common: Request bus reassignment when not probe-only
PCI:
imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling
PCI:
mediatek: Convert bool to single quirks entry and bitmap
PCI:
mediatek: Fix IRQ domain leak when port fails to enable
PCI:
mediatek: Fix operator precedence in PCIE_FTS_NUM_L0 macro
PCI:
mediatek: Fix possible truncation in mtk_pcie_parse_port()
PCI:
mediatek: Use actual physical address instead of virt_to_phys()
PCI:
Move Resizable BAR code to rebar.c
PCI:
Prevent resource tree corruption when BAR resize fails
PCI:
rcar-host: Remove unused LIST_HEAD(res)
PCI:
Skip Resizable BAR restore on read error
perf/x86/amd/core:
Always use the NMI latency mitigation
phy:
phy-can-transceiver: Check driver match and driver data against NULL
pinctrl:
mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39
pinctrl:
mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39
pinctrl:
sunxi: fix regulator leak in sunxi_pmx_request() error path
platform/x86:
xo15-ebook: Fix wakeup source and GPE handling
PM:
sleep: Use complete() in device_pm_sleep_init()
pNFS/filelayout:
fix cheking if a layout is striped
posix-cpu-timers:
Fix pid refcount leak in do_cpu_nanosleep() error path
posix-cpu-timers:
Use u64 multiplication in update_rlimit_cpu()
power:
supply: charger-manager: fix refcount leak in is_full_charged()
powerpc/kexec:
fix double get_cpu() imbalance in kexec_prepare_cpus
powerpc/perf:
fix preempt count underflow in fsl_emb_pmu_del
powerpc/powernv:
fix preempt count leak in pnv_kexec_wait_secondaries_down
powerpc/spufs:
fix out-of-bounds access in spufs_mem_mmap_access()
proc:
Move fdinfo PTRACE_MODE_READ check into the inode .permission operation
proc:
only bump parent nlink when registering directories
proc:
protect ptrace_may_access() with exec_update_lock (FD links)
proc:
protect ptrace_may_access() with exec_update_lock (part 1)
proc:
rename proc_setattr to proc_nochmod_setattr
proc:
use generic setattr() for /proc/$PID/net
pwm:
imx27: Fix variable truncation in .apply()
qede:
fix off-by-one in BD ring consumption on build_skb failure
qede:
fix out-of-bounds check for cqe->len_list[]
rapidio/tsi721:
prevent a bad dereference in tsi721_db_dpc()
RDMA/hns:
Fix arithmetic overflow in calc_hem_config()
RDMA/hns:
Fix warning in poll cq direct mode
RDMA/irdma:
Fix OOB read during CQ MR registration
RDMA/irdma:
Fix out-of-bounds write in irdma_copy_user_pgaddrs
RDMA/mlx5:
Fix devx subscribe-event unwind NULL dereference
RDMA/mlx5:
Fix undefined shift of user RQ WQE size
RDMA/mlx5:
Remove raw RSS QP restrack tracking
RDMA/rtrs-srv:
Bound RDMA-Write length to chunk size in rdma_write_sg
RDMA/siw:
bound Read Response placement to the RREAD length
RDMA/srpt:
fix integer overflow in immediate data length check
regulator:
core: Make regulator_lock_two() logic easier to follow
regulator:
core: regulator_lock_two() should test for EDEADLK not EDEADLOCK
regulator:
ltc3676: Fix incorrect IRQSTAT bit offsets
regulator:
scmi: fix of_node refcount leak in scmi_regulator_probe()
reset:
sunxi: fix memory region leak on ioremap failure
ring-buffer:
Fix event length with forced 8-byte alignment
riscv:
Prevent NULL pointer dereference in machine_kexec_prepare()
riscv:
stacktrace: Remove bogus -0x4 offset in non-FP walk_stackframe
rtc:
abx80x: fix the RTC_VL_CLR clearing all status flags
rtc:
cmos: unregister HPET IRQ handler on probe failure
rtc:
ds1307: Fix off-by-one issue with wday for rx8130
rtc:
ds1307: handle oscillator stop flag for ds1337/ds1339/ds3231
rtmutex:
Use waiter::task instead of current in remove_waiter()
rtnetlink:
add RTNL_FLAG_DUMP_UNLOCKED flag
rtnetlink:
change nlk->cb_mutex role
s390/monwriter:
Reject buffer reuse with different data length
s390/process:
Fix kernel thread function pointer type
sched/fair:
Only update stats for allowed CPUs when looking for dst group
sched/rt:
Have RT_PUSH_IPI be default off for non PREEMPT_RT
scsi:
elx: efct: Fix I/O leak on unsupported additional CDB
scsi:
elx: efct: Fix refcount leak in efct_hw_io_abort()
scsi:
hpsa: Fix DMA mapping leak on IOACCEL2 reset path
scsi:
pm8001: Fix error code in non_fatal_log_show()
scsi:
Revert "scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans"
scsi:
sg: Report request-table problems when any status is set
scsi:
smartpqi: Use shost_to_hba() in pqi_scan_finished()
scsi:
target: Bound PR-OUT TransportID parsing to the received buffer
scsi:
target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE
scsi:
xen: scsiback: Free the command tag on the TMR submit-failure path
scsi:
xen: scsiback: Free unsubmitted command instead of double-putting it
sctp:
hold socket lock when dumping endpoints in sctp_diag
sctp:
validate embedded address parameter length
sctp:
validate STALE_COOKIE cause length before reading staleness
seg6:
validate SRH length before reading fixed fields
selftests/bpf:
Fix bpf_iter/task_vma test
selftests/mm:
allow PUD-level entries in compound testcase of hmm tests
selftests/mm:
clarify alternate unmapping in compaction_test
selftests/mm:
fix exclusive_cow test fork() handling
serial:
8250_mid: Disable DMA for selected platforms
serial:
8250_mid: Remove 8250_pci usage
serial:
8250_omap: clear rx_running on zero-length DMA completes
serial:
msm: Disable DMA for kernel console UART
skmsg:
convert struct sk_msg_sg::copy to a bitmap
slimbus:
Convert to platform remove callback returning void
slimbus:
qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership
slimbus:
qcom-ngd-ctrl: Fix probe error path ordering
slimbus:
qcom-ngd-ctrl: Fix up platform_driver registration
slimbus:
qcom-ngd-ctrl: Register callbacks after creating the ngd
smb/client:
always return a value for FS_IOC_GETFLAGS
smb/client:
preserve errors from smb2_set_sparse()
smb2:
small refactor in smb2_check_message()
smb:
client: Fix next buffer leak in receive_encrypted_standard()
smb:
client: fix overflow in passthrough ioctl bounds check
smb:
client: harden POSIX SID length parsing
smb:
client: mask server-provided mode to 07777 in modefromsid
smb:
client: resolve SWN tcon from live registrations
smb:
client: restrict implied bcc[0] exemption to responses without data area
smb:
client: use unaligned reads in parse_posix_ctxt()
soc:
fsl: qe: panic on ioremap() failure in qe_reset()
soc:
ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy
sparc:
led: avoid trimming a newline from empty writes
spi:
ep93xx: fix double-free of zeropage on DMA setup failure
spi:
fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync()
spi:
fsl-lpspi: terminate the RX channel on TX prepare failure path
spi:
sh-msiof: abort transfers when reset times out
spi:
uniphier: Fix completion initialization order before devm_request_irq()
spi:
xilinx: use FIFO occupancy register to determine buffer size
staging:
media: atomisp: reduce load_primary_binaries() stack usage
staging:
most: video: avoid double free on video register failure
staging:
nvec: fix use-after-free in nvec_rx_completed()
staging:
rtl8723bs: core: move constants to right side in comparison
staging:
rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie()
staging:
rtl8723bs: Fix indentation issues
staging:
rtl8723bs: fix OOB read in OnAssocRsp() IE loop
staging:
rtl8723bs: fix OOB read in update_beacon_info() IE loop
staging:
rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl()
staging:
rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop
staging:
rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr()
staging:
rtl8723bs: fix OOB write in HT_caps_handler()
staging:
rtl8723bs: Fix space issues
staging:
rtl8723bs: fix spaces around binary operators
staging:
rtl8723bs: fix WEP length underflow and OOB read in OnAuth()
staging:
rtl8723bs: remove redundant braces in if statements
staging:
rtl8723bs: Remove redundant else branches.
sysfs:
clamp show() return value in sysfs_kf_read()
tcp:
ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF)
thermal:
hwmon: Fix critical temperature attribute removal
thermal:
intel: Fix dangling resources on thermal_throttle_online() failure
time:
Fix off-by-one in compat settimeofday() usec validation
tipc:
fix out-of-bounds read in broadcast Gap ACK blocks
tipc:
fix UAF in tipc_l2_send_msg()
tipc:
prevent snt_unacked underflow on CONN_ACK
tipc:
reject inverted service ranges from peer bindings
tipc:
require net admin for TIPCv2 netlink mutators
tools lib api:
Fix filename__write_int() writing uninitialized stack data
tools lib api:
Fix missing null termination in filename__read_int/ull()
tools lib api:
Fix mount_overload() snprintf truncation and toupper range
tools/mm/slabinfo:
fix total_objects attribute name
tools/virtio:
check mmap return value in vringh_test
tpm:
fix event_size output in tpm1_binary_bios_measurements_show
tpm:
Make the TPM character devices non-seekable
tracing/events:
Fix to check the simple_tsk_fn creation
tracing/probes:
Fix double addition of offset for @+FOFFSET
tracing:
eprobe: read the complete FILTER_PTR_STRING pointer
tracing:
Prevent out-of-bounds read in glob matching
tracing:
probes: fix typo in a log message
treewide:
Switch/rename to timer_delete[_sync]()
udf:
validate free block extents against the partition length
udf:
validate sparing table length as an entry count, not a byte count
udf:
validate VAT header length against the VAT inode size
udmabuf:
fix DMA direction mismatch in release_udmabuf()
usb:
atm: ueagle-atm: wait for pre-firmware load in .disconnect()
usb:
cdc_acm: Add quirk for Uniden BC125AT scanner
usb:
cdnsp: fix stream context array leak in cdnsp_alloc_stream_info()
USB:
chaoskey: Fix slab-use-after-free in chaoskey_release()
USB:
core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub
usb:
dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume()
usb:
dwc3: run gadget disconnect from sleepable suspend context
usb:
gadget: composite: fix dead empty check in the USB_DT_OTG handler
usb:
gadget: f_fs: initialize reset_work at allocation time
usb:
gadget: f_fs: Tie read_buffer lifetime to ffs_epfile
usb:
gadget: function: rndis: add length check for header
usb:
gadget: function: rndis: add length check to response query
usb:
gadget: udc: Fix use-after-free in gadget_match_driver
usb:
host: max3421: Fix shift-out-of-bounds in max3421_hub_control()
usb:
host: max3421: Reject hub port requests for non-existent ports
USB:
idmouse: fix use-after-free on disconnect race
USB:
iowarrior: fix use-after-free on disconnect
usb:
iowarrior: remove inherent race with minor number
USB:
ldusb: fix use-after-free on disconnect race
USB:
legousbtower: fix use-after-free on disconnect race
USB:
misc: uss720: unregister parport on probe failure
usb:
mtu3: unmap request DMA on queue failure
USB:
quirks: add NO_LPM for the Samsung T5 EVO Portable SSD
USB:
serial: digi_acceleport: fix broken rx after throttle
USB:
serial: digi_acceleport: fix hard lockup on disconnect
USB:
serial: digi_acceleport: fix write buffer corruption
USB:
serial: keyspan_pda: fix information leak
USB:
serial: option: add Telit Cinterion FE990D50 compositions
usb:
sl811-hcd: disable controller wakeup on remove
USB:
storage: include US_FL_NO_SAME in quirks mask
usb:
typec: tcpm: Fix VDM type for Enter Mode commands
usb:
typec: tcpm: Validate SVID index in svdm_consume_modes()
usb:
typec: ucsi: ccg: Fix use-after-free of ucsi on remove
usb:
typec: ucsi: Invert DisplayPort role assignment
usb:
typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode
USB:
ulpi: fix memory leak on registration failure
USB:
usb-storage: ene_ub6250: restore media-ready check
usb:
xhci: Fix sleep in atomic context in xhci_free_streams()
usbip:
tools: support SuperSpeedPlus devices
usbip:
vudc: fix NULL deref in vep_dequeue()
usbnet:
gl620a: fix out-of-bounds read in genelink_rx_fixup()
userfaultfd:
gate must_wait writability check on pte_present()
vduse:
Fix race in vduse_dev_msg_sync and vduse_dev_read_iter
vduse:
hold vduse_lock across IDR lookup in open path
vduse:
Requeue failed read to send_list head
veth:
fix NAPI leak in XDP enable error path
vfio/pci:
Release the VGA arbiter client on register_device() failure
vhost/vdpa:
validate virtqueue index in mmap and fault paths
virtio-mmio:
fix device release warning on module unload
virtio_net:
disable cb when NAPI is busy-polled
vmalloc:
fix NULL pointer dereference in is_vm_area_hugepages()
watchdog:
sp5100_tco: Use EFCH MMIO for newer Hygon FCH
watchdog:
sprd_wdt: Remove redundant sprd_wdt_disable() on register failure
watchdog:
unregister PM notifier on watchdog unregister
wifi:
ath9k: fix OOB access from firmware tx status queue ID
wifi:
mac80211: fix memory leak in ieee80211_register_hw()
wifi:
mac80211: free ack status frame on TX header build failure
wifi:
mwifiex: fix permanently busy scans after multiple roam iterations
wifi:
rt2x00: avoid full teardown before work setup in probe
wifi:
rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer
wifi:
wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication
workqueue:
drop spurious '*' from print_worker_info() fn declaration
X.509:
Fix validation of ASN.1 certificate header
x86/boot:
Reject too long acpi_rsdp= values
x86/boot:
Validate console=uart8250 baud rate to fix early boot hang
x86/platform/olpc:
xo15: Drop wakeup source on driver removal
xdp:
introduce flags field in xdp_buff/xdp_frame
xen/gntdev:
fix error handling in ioctl
xfrm:
use compat translator only for u64 alignment mismatch
xfrm:
validate selector family and prefixlen during match
xfrm:
xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink
xfs:
fail recovery on a committed log item with no regions
xfs:
fix unreachable BIGTIME check in dquot flush validation
xfs:
Remove dead code
xfs:
Remove redundant assignment of mp
xfs:
resample the data fork mapping after cycling ILOCK
xfs:
use null daddr for unset first bad log block
xprtrdma:
Fix bcall rep leak and unbounded peek