Changelog
in Linux kernel
7.2.7
accel/amdxdna:
Disable device buffer exporting
accel/amdxdna:
put the chained BO when its mapping fails
accel/amdxdna:
refuse to flush an imported BO
accel/amdxdna:
reject a command chain that carries no commands
accel/amdxdna:
Remove __counted_by from struct amdxdna_cmd_chain
accel/ivpu:
Limit firmware log name prints to field size
accel/ivpu:
Validate firmware log buffer metadata
accel/ivpu:
Validate full buffer range in ivpu_to_cpu_addr
accel/qaic:
Address potential out-of-bounds read in resp_worker()
accel:
ethosu: Don't read the U65 rounding mode as a storage mode
accel:
ethosu: Drop IRQF_SHARED flag
accel:
ethosu: Ensure cmd stream ends with a stop op
accel:
ethosu: Ensure SRAM region size matches job
accel:
ethosu: Ensure SRAM size is 0 on mapping failure
accel:
ethosu: Fix ethosu_job_open() return value
af_packet:
Don't cast tpacket_hdr.tp_len to int in tpacket_parse_header().
af_unix:
Return immediately when manage_oob() returns NULL for 0-length buffer.
af_unix:
Update last skb marker in manage_oob().
afs:
Clear stale peer app data after address list changes
afs:
Fix double-unmap of directory block
afs:
Fix incorrect free in candidate cleanup in afs_lookup_server()
afs:
Fix missing kunmap in afs_dir_search_bucket()
ALSA:
caiaq: Decoupling ep1_in_urb in caiaq dev
ALSA:
caiaq: Fix potential double-free at error path
ALSA:
ctxfi: Fix CA20K2 S/PDIF passthrough
ALSA:
dummy: Report a change when one capture switch channel moves
ALSA:
hda: Report a change when only the channel status bytes move
ALSA:
hda: restore MFG widget enumeration after core split
ALSA:
pcm: Serialize PCM mmap with buffer reallocation to fix page UAF
ALSA:
ump: do not touch legacy_rmidi before it exists
ALSA:
us122l: Prevent write upgrades for read mappings
ALSA:
usbusx2y: fix in04_last array size mismatch with in04_buf
ALSA:
usbusx2y: validate URB actual_length in interrupt callback
arm64:
trans_pgd: clone only the linear map that exists at runtime
ASoC:
ab8500: Correct digital interface format setup
ASoC:
ab8500: Remove the nonfunctional sidetone apply control
ASoC:
ab8500: Repair the DAPM capture graph
ASoC:
ab8500: Reset the audio block before configuring it
ASoC:
ab8500: Skip missing DMIC GPIOs on AB8505
ASoC:
ab8500: Validate and program TDM slots correctly
ASoC:
amd: acp-da7219-max98357a: don't bind on Raven/Picasso boards
ASoC:
amd: renoir: fix disable_pdm_interrupts() to clear mask bits
ASoC:
amd: yc: fix memory leak in acp6x_pdm_dma_close()
ASoC:
bcm: bcm63xx: Publish the OF module aliases
ASoC:
codecs: ab8500: Use guard() for mutex locks
ASoC:
cs35l56: Fix probe deadlock waiting for SoundWire enumeration
ASoC:
cs35l56: Fix race between kexec and snd_soc_register_component()
ASoC:
cs35l56: Request IRQ in cs35l56_common_probe()
ASoC:
fsl_micfil: balance mclk enable/disable
ASoC:
Intel: avs: Clean up the bus when fetching ML caps fails
ASoC:
Intel: avs: Do not ignore -ENOENT when loading a topology
ASoC:
Intel: avs: Fix unbalanced module reference count
ASoC:
Intel: avs: Refactor and fix init_config access
ASoC:
Intel: SST: Publish the PCI module aliases
ASoC:
mt6351: Publish the OF module alias
ASoC:
sprd: validate compress buffer sizes against fixed allocations
ASoC:
sti: initialize IRQ lock before requesting IRQ
ASoC:
ux500: Allow repeated MSP prepare calls
ASoC:
ux500: Correct MSP frame and bit clock setup
ASoC:
ux500: Deassert the MSP reset during probe
ASoC:
ux500: Fix MSP stream lifecycle handling
ASoC:
ux500: Program the MSP FIFO watermarks
ASoC:
ux500: Propagate MSP setup errors
ASoC:
ux500: Remove obsolete PRCMU QoS calls
ASoC:
ux500: Request the MSP MMIO resource
ASoC:
ux500: Validate MSP DAI configuration
ata:
pata_legacy: remove documentation for removed module parameters
block:
Fix start and length check added to iov_iter_extract_bvecs()
block:
save page offset gaps in cloned bio
Bluetooth:
btintel: bound firmware ID by TLV length
Bluetooth:
btintel: validate version TLV value lengths
Bluetooth:
btintel_pcie: Clear automask on spurious interrupts
Bluetooth:
btintel_pcie: fix tx_handle bounds off-by-one
Bluetooth:
btintel_pcie: validate packet_len before skb_put_data
Bluetooth:
btmtk: Declare MT7920 (MT7961 1a) Bluetooth firmware
Bluetooth:
btqcomsmd: destroy RPMsg endpoints before freeing hci_dev
Bluetooth:
btrtl: Don't leak return code when parsing firmware format v2
Bluetooth:
btusb: Fix leaked runtime PM reference in btusb_reset
Bluetooth:
btusb: Fix UAF of btusb_data by rx_work
Bluetooth:
btusb: mediatek: Fix leaked runtime PM reference in reset
Bluetooth:
hci_core: Fix race condition during device registration
Bluetooth:
hci_mrvl: Fix wrong return value check of wait_on_bit_timeout()
Bluetooth:
hci_sysfs: Fix NULL pointer dereference in device_del()
Bluetooth:
L2CAP: clear FLAG_DEFER_SETUP only for same PID/PSM
Bluetooth:
L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan
Bluetooth:
L2CAP: fix out-of-bounds write in l2cap_ecred_connect
Bluetooth:
Properly disable remote wakeup for MT7922/MT7925 on Ryzen platform
bnxt_en:
Bound SW TPA IDs to prevent crashes
bnxt_en:
Don't free the live ring's TPA state on queue restart failure
bnxt_en:
Handle buffer allocation failure in bnxt_rx_ring_reset()
bnxt_en:
Only restore LRO if the device supports TPA
bnxt_en:
Prevent queue stop with deferred completions
bnxt_en:
Propagate RX ring init failures in bnxt_init_nic()
bnxt_en:
Propagate TPA buffer allocation failures in bnxt_queue_mem_alloc()
bonding:
alb: fix uninitialized transport header access in alb_determine_nd()
bonding:
do not clear curr_active_slave prematurely when releasing all slaves
bonding:
use skb_cow_head() in bond_do_alb_xmit() and rlb_arp_xmit()
bootconfig:
Fix integer overflow in initrd size check
bpf:
backtrack_insn(): Handle ld_{abs,ind} subprog exit edge
bpf:
backtracking shouldn't clear outer frame R1-R5 for callbacks
bpf:
Cancel special fields when recycling rhtab elements
bpf:
Check ancestor frames for rbtree callbacks
bpf:
check_cond_jmp_op(): properly infer if register is null
bpf:
don't downgrade half-dead scalar zero spills to STACK_ZERO
bpf:
Don't infer non-NULL from a pointer with an unbounded offset
bpf:
Don't predict JMP32 pointer vs zero comparisons
bpf:
Don't resurrect a scalar id dropped by collect_linked_regs()
bpf:
don't rewrite bpf_fastcall patterns entered by a jump
bpf:
Fix BPF_F_CPU validation for sparse CPU IDs
bpf:
Fix NULL-ptr-deref in btf_var_show()
bpf:
Fix NULL-ptr-deref when showing a void BTF type
bpf:
Fix percpu map update indexing with sparse CPU IDs
bpf:
Fix REG INVARIANTS VIOLATION on speculative pointer arithmetic
bpf:
Keep refcount_acquire nullable for borrowed RCU kptrs
bpf:
mark a NULL call argument precise
bpf:
Mark bpf_btf_find_by_name_kind() as sleepable
bpf:
Mark faultable stack helpers as sleepable
bpf:
Mark NULL kptr stores precise
bpf:
Mark sched_process_wait argument as nullable
bpf:
Mark signal tracepoint siginfo arguments as scalar
bpf:
Mark syscall helpers as sleepable
bpf:
Mark the zero register precise for a register-form NULL check
bpf:
Preserve inner map identity in callback frames
bpf:
Preserve special fields in recycled rhtab elements
bpf:
propagate mark_chain_precision() errors out of loop_flag_is_zero()
bpf:
reject BPF_PSEUDO_FUNC reference to the main program
bpf:
Reject key-less BTF for hash maps
bpf:
Reject legacy packet loads from callbacks
bpf:
Reject non-scalar bpf_loop iteration counts
bpf:
Reject resilient lock operations in rbtree callbacks
bpf:
Reject tail calls directly from callback frames
bpf:
Reject untrusted allocated-object pointers
bpf:
Require MEM_PERCPU for percpu kptr stores
bpf:
Track verifier instruction stats for each subprogram
bpf:
zero extend the result of an arena 32-bit cmpxchg
btrfs:
detach failed sprout device from transaction update list
btrfs:
do not force reloc root creation during qgroup_account_snapshot()
btrfs:
fix the possible bioc_list memory leak during error
btrfs:
fix transaction use-after-free in raid stripe insertion
btrfs:
fix unnecessary transaction commit fallback from btrfs_log_all_parents()
btrfs:
restore active device pointers after failed sprout
btrfs:
return proper negative error code for update_raid_extent_item()
btrfs:
scrub: report the failing sector's address, not the stripe base
btrfs:
send: fix lost error return value in will_overwrite_ref()
btrfs:
zoned: finish active block group cleanup if call_zone_finish() fails
btrfs:
zstd: fix lost wakeup when waiting for a workspace
cachefiles:
Fix potential UAF/KASAN warning
cgroup/cpuset:
Preserve boot-isolated CPUs on partition release
configfs:
pin the symlink target's dirent instead of chasing ->ci_dentry
configfs:
unhash the dentry before dropping the item in rmdir
cpufreq:
initialize policy rwsem before sysfs publication
cpufreq:
zero-initialize policy cpumask before sysfs publication
crypto:
x86/aria - add missing vzeroupper in AVX-512 code
crypto:
x86/aria - add missing vzeroupper in AVX2 code
dibs:
Unregister dibs_class after error
dm/amdgpu:
fix malformed link_settings debugfs output
dma-buf:
fix some kernel-doc warnings
Documentation/hwmon:
Document hwmon_notify_event()
Documentation:
hwmon: replace full-width colon by a standard ASCII colon
drm/adp:
Drop the select of the nonexistent CONFIG_DRM_KMS_DMA_HELPER
drm/amd/display:
Exit IPS before connector detection on resume
drm/amd/display:
Honor Broadcast RGB for BT.2020 RGB output
drm/amd/display:
Propagate HDMI RGB quantization selectability
drm/amd/display:
Rebuild InfoFrames on output color space changes
drm/amd/pm:
fix gpu metrics energy accumulator for smu 13.0.0/13.0.7
drm/amdgpu/userq:
fix struct drm_amdgpu_info_device padding for 32bit compile
drm/amdgpu:
skip gfx switch_power_profile during GPU reset
drm/amdgpu:
skip the VMID 0 flush for VRAM
drm/bridge:
tc358768: Enforce input bus flags via atomic_check
drm/bridge:
ti-sn65dsi83: Fix error handling in sn65dsi83_reset_work()
drm/cirrus-qemu:
Validate BAR0 size during probe
drm/drm_exec:
fix up contended obj when num_objects is 0
drm/gud:
validate GUD_ROTATION_0 is present in supported rotations
drm/i915/cdclk:
Avoid spurious cdclk sanitization on PTL+
drm/i915/cdclk:
Fix dg2_power_well_count() return type
drm/i915/dp:
Gate UHBR SST SDP splitting on sink capability
drm/i915/dp_mst:
Remove duplicate intel_pfit_compute_config() call
drm/i915:
Fix memory leak in query_perf_config_list()
drm/logicvc:
Drop the select of the nonexistent CONFIG_DRM_KMS_DMA_HELPER
drm/pagemap:
Prevent double migration of device pages
drm/pagemap:
Reset migration page count on eviction retry
drm/panic:
clean new `clippy::needless_range_loop` lint for Rust 1.100.0
drm/rockchip:
analogix_dp: fix unchecked bound endpoint name length
drm/rockchip:
dw_dp: Select DRM_BRIDGE_CONNECTOR
drm/rockchip:
rk3066_hdmi: Add missing Kconfig selects
drm/sched:
Create a fake device for KUnit tests
drm/virtio:
Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create()
drm/virtio:
use the DMA API for resource backing on Xen
drm/xe/i2c:
Fix the interrupt handling
drm/xe/oa:
Remove sysfs entry on idr_alloc failure in xe_oa_add_config_ioctl()
drm/xe:
Flush LSC untyped L1 dataport cache after rcs/ccs batches
drm/xe:
Guard page-fault worker with runtime PM check
EDAC/altera:
Use parent device for devres in altr_portb_setup()
EDAC/device_sysfs:
Use kstrtouint() for poll_msec to prevent truncation
EDAC/igen6:
Fix channel address decode for non-hash mode
EDAC/igen6:
Fix channel selection hash
EDAC/igen6:
Fix interleave boundary condition
EDAC/igen6:
Fix Raptor Lake-P logged error address
erofs:
add missing buf->off in erofs_bread()
erofs:
add sysfs feature entry for xattr prefixes
erofs:
delimit inode_share cache key components
erofs:
disable LZ4 rolling decompression for now
erofs:
preserve LZMA decoders on resize failure
eth:
ice: don't dereference pointers from TP_printk()
eth:
nfp: bound the ntuple rule dump by the caller's buffer size
eth:
nfp: drop the replaced rule from the list when reprogramming fails
exec:
do_close_on_exec() before taking exec_update_lock
exit:
hold a reference to thread_pid across proc_flush_pid
f2fs:
accurately adjust free_sections during free_segment_range
f2fs:
fix to reset all pinned status during fggc
f2fs:
fix to shrink gc_lock coverage in f2fs_gc_range()
fbdev:
vfb: defer cleanup until the last reference
fs:
autofs: fix memory leak in autofs_fill_super()
fs:
don't return -EINVAL for successful nested thaw
ftrace:
fork: Initialize function graph state before copy_exec_state()
ftrace:
Use rcu_assign_pointer() for tmp_ops filter hash
function_graph:
Use the saved entry's size when reprinting it
genetlink:
pin family module during policy dump
hrtimer:
Use hard expiry when updating timers on the same base
hwmon:
(applesmc) fix key backlight workqueue leak on register failure
hwmon:
(aspeed-pwm-tacho) Propagate reset deassert errors
hwmon:
(asus_rog_ryujin) Add per-device configuration
hwmon:
(asus_rog_ryujin) Synchronize HID command and report handling
hwmon:
(asus_rog_ryujin) Validate HID report lengths
hwmon:
(chipcap2) fix channels in humidity alarm notifications
hwmon:
(corsair-cpro) Create debugfs entries after hwmon registration
hwmon:
(corsair-cpro) Remove debugfs entries when probe fails
hwmon:
(gpio-fan) Fix use-after-free in alarm work
hwmon:
(gpio-fan) take fan_data->lock in gpio_fan_shutdown()
hwmon:
(ina2xx) Acquire hwmon_lock in shunt_resistor_show()
hwmon:
(ina2xx) Decouple in0 and curr1 alarms
hwmon:
(ina2xx) Parameterize ina2xx_data in ina226_alert_read()
hwmon:
(ina2xx) Replace masks with enum in alert functions
hwmon:
(ltc4282) Make sure clk_init_data is fully initialized
hwmon:
(mcp9982) Propagate one-shot polling errors
hwmon:
(nct6694) do not expose enable on DTIN temperature channels
hwmon:
(pmbus) Clear generic status alarms with CLEAR_FAULTS
hwmon:
(sht4x) Add missing locks
hwmon:
(sht4x) Fix return value from heater_enable_store()
hwmon:
(yogafan) fix non-kernel-doc comment
hwmon:
Fix potential UAF in pec_store
i2c:
designware: Global register definitions
ice:
add missing xa_destroy for sched_node_ids
idpf:
account for VLAN header when parsing RSC packet header
idpf:
disable DIM work before freeing q_vectors
ieee802154:
6lowpan: fix NULL dereference in lowpan_newlink
ieee802154:
cc2520: fix FIFOP work use-after-free
ieee802154:
hwsim: serialize pib updates to fix double-free
igmp:
convert struct ip_sf_list to RCU
inet:
frags: invalidate queues before flushing them
io_uring/net:
don't overconsume buffers when using MSG_TRUNC
io_uring/net:
let io_recv_buf_select return the length of the buffer region
io_uring/rw:
end write accounting from ->ki_complete
iommu/amd:
Do not reallocate GA log buffers on resume
iommu/amd:
Fix ineffective error check in nested domain allocation
iommu/amd:
Fix premature break in init_iommu_one() again
iommu/arm-smmu-v3:
Disable implementations during devm teardown
iommu/riscv:
Add command queue lock
iommu/riscv:
Avoid waiting on failed command enqueue
iommu/riscv:
Serialize command queue publishing
iommu/s390:
Fix NULL dereference in iova_to_phys() with ZPCI_TABLE_TYPE_RFX
ionic:
use netif_txq_maybe_stop() in ionic_tx()
ip6_gre:
check tunnel info before xmit in ip6gre_tunnel_xmit
ipmr:
account multicast table and route memory
ipv4:
fib: bound automatic table ID allocation
ipv6:
fix fib6 walker UAF on seq stop
ipv6:
flowlabel: cap duplicate leases per socket
ipv6:
mcast: fix delay calculation in igmp6_join_group()
ipv6:
mcast: fix RCU list diversion in ip6_mc_del1_src()
ipv6:
mcast: use copy-on-write RCU updates in ip6_mc_source()
ipv6:
mcast: use jiffies_delta_to_clock_t() in igmp6_mc_seq_show()
ipv6:
mcast: use rcu_assign_pointer() for __rcu list updates
ipv6:
null-check fib6_node before accessing in __ip6_del_rt_siblings()
ipv6:
sr: restore network header before routing and forwarding
ipvs:
fix reversed sequence option serialization
ipvs:
reject invalid states in connection template sync records
irqchip/gic-v5:
Preserve ICC_CR0_EL1 state
klp-build:
Fix wrong index in funcs cleanup error path
ksmbd:
fix listener task lifetime on netdev events
ksmbd:
fix sparc build with atomic work state
ksmbd:
propagate DACL parsing errors
ksmbd:
rate limit unmapped SID errors
ksmbd:
safely drain sessions during logoff
KVM:
PPC: Book3S HV: Set irqfd->producer only on success
landlock:
Fix use-after-free of the source's parent directory
leds:
st1202: Validate pattern input before stopping the sequence
Linux:
Linux 7.2.7
locking/lockdep:
Invalidate stale class_cache entries for zapped classes
mac802154:
fix use-after-free of sdata via queued RX frames
media:
as102: do not rely on id table address comparison
media:
hevc: add bounded tile-count helpers
media:
ipu-bridge: do not use the CVS device lookup for IVSC
media:
mediatek: vcodec: bound AV1 tile-start copy to the array capacity
media:
qcom: iris: fix runtime PM reference leaks
media:
remove conditional return with no effect
media:
rkvdec: bound HEVC tile loops and PPS id to the array capacity
media:
v4l2-ctrls: validate AV1 tile counts
media:
v4l2-ctrls: validate HEVC tile counts
media:
v4l2-h264: Fix memcmp() size in B1 reference list comparison
media:
verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity
media:
verisilicon: rockchip: guard VPU981 AV1 divisor and tile buffer
media:
verisilicon: rockchip: reject AV1 frames exceeding the tile capacity
mfd:
db8500-prcmu: Fold dbx500 header into db8500
misc:
amd-sbi: Add null check for devm_kasprintf()
mlxsw:
spectrum_ptp: Fix napi_gro_receive() call from GC workqueue context
mm/slab:
take n->list_lock in __slab_try_return_freelist() to avoid race
mptcp:
avoid unneeded actions on subflow reset
mptcp:
close race between scheduler and state change
mptcp:
do not reschedule the RTX timer for fallback sockets
mptcp:
fix bad accounting in __mptcp_subflow_push_pending()
mptcp:
move the stale logic out of retrans scheduler
mptcp:
options: fix uninit-value in mptcp_write_data_fin
mptcp:
options: handle MPC data + csum reqd + no csum
mptcp:
pm: kernel: drop pending ADD_ADDR when removing ID0
mptcp:
pm: reset retrans_time when ADD_ADDR entry is reused
mptcp:
pm: userspace: fix address ID overflow
mptcp:
prevent race between disconnect() and rtx
mptcp:
remove unneeded READ_ONCE() annotation
mptcp:
subflow: no need to copy thmac during ulp_clone
mptcp:
syncookies: remember the request backup flag
net/mlx5:
E-Switch, prevent mc_list repopulation during vport disable
net/mlx5:
E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put
net/mlx5:
LAG, use local tracker to update active ports
net/mlx5e:
Fix ETS zero BW reporting when one TC holds 100%
net/mlx5e:
Fix missing FEC mode mapping for RS_544_514_INTERLEAVED_QUAD
net/mlx5e:
Fix reporting support for all RS FEC variants
net/mlx5e:
Fix setting RS FEC after remapping
net/mlx5e:
Fix use-after-free race in sample_restore_put()
net/mlx5e:
Keep HW timestamp stats monotonic across reconfiguration
net/mlx5e:
Move representor vnic reporter to eswitch devlink port
net/rds:
acquire RDS_IN_XMIT in rds_tcp_reset_callbacks()
net/rds:
acquire the fastpath locks in rds_conn_shutdown()
net/rds:
clear cp_flags bits individually in rds_conn_path_reset()
net/rds:
don't let rds_conn_shutdown() consume a concurrent drop
net/rds:
fix tcp stream corruption with large pages
net/rds:
tcp: don't force RDS_CONN_RESETTING over a concurrent shutdown
net/rds:
use clear_bit_unlock() in release_refill()
net/rds:
use wq_has_sleeper() in release_in_xmit()
net/sched:
act_api: budget all shared attributes in notify skbs
net/sched:
act_api: fix skb sizing and action leak on reoffload delete
net/sched:
act_api: release all action references on NEWACTION failure
net/sched:
act_api: size the RTM_GETACTION reply from the actions
net/sched:
cls_api: Don't replay RTM_GETCHAIN in tc_ctl_chain().
net/sched:
cls_route: Fix in-place replace
net/sched:
cls_route: free emptied bucket on filter move
net/sched:
cls_route: Reject handle aliasing
net/sched:
cls_u32: fix duplicate handle when node ID pool is exhausted
net/sched:
defer qdisc freeing after failed creation
net/sched:
drr: clamp quantum in change class
net/sched:
dualpi2: clamp psched_mtu at all call sites
net/sched:
ets: clamp quantum in parse and fallback paths
net/sched:
fq_pie: clamp quantum in change path
net/sched:
hhf: clamp quantum in change and init paths
net/sched:
pie: clamp psched_mtu in pie_drop_early
net/sched:
sfq: clamp quantum in change path
net:
airoha: enable RX_DONE interrupt for RX queue 31
net:
amd-xgbe: discard rx packets with bad FCS
net:
bcmasp: clear txcb->last before writing each descriptor
net:
bcmasp: fix tx_spb_ring_full() checking same slot cnt times
net:
bonding: annotate lockless writes with WRITE_ONCE()
net:
bridge: mcast: properly convert mglist to rcu
net:
bridge: use option bits for CFM/MRP frame handlers
net:
cap tx_queue_len at S16_MAX to prevent oversized ring allocations
net:
dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size
net:
dsa: lantiq_gswip: fix GSWIP_MDIO_PHY_FCONTX_EN value
net:
dsa: mt7530: add EN7528 support
net:
dsa: mt7530: populate lpi_interfaces to fix EEE support
net:
dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size
net:
dsa: tag_brcm: legacy FCS: request needed tailroom
net:
ethernet: cortina: Count dropped frames as NAPI work
net:
ethernet: cortina: Count RX descriptors for freeq refill
net:
ethernet: cortina: Count RX drops once per frame
net:
ethernet: cortina: Finish RX updates before NAPI completion
net:
ethernet: cortina: Fix budget accounting
net:
ethernet: mtk_eth_soc: populate lpi_interfaces to fix EEE support
net:
ethernet: oa_tc6: Add the OA_TC6_ prefix to standard registers
net:
ethernet: oa_tc6: Disable tx queues on fatal error
net:
ethernet: oa_tc6: Export standard defined registers
net:
ethernet: oa_tc6: Fix for the wrong data type
net:
ethernet: oa_tc6: Handle the OA TC6 SPI protected mode
net:
ethernet: oa_tc6: Improve the error recovery
net:
ethernet: oa_tc6: Protect skb pointer used by two different kernel instances
net:
gro: Fix nesting of TCP GSO SKBs in skb_gro_receive_list()
net:
hinic: fix mailbox segment buffer overflow
net:
hso: fix TIOCMIWAIT race
net:
hsr: enable promiscuous mode on interlink port with fwd offload
net:
icmp: avoid invalid transport header access in icmp_send tracepoint
net:
iptunnel: fix stale transport header during tunnel decapsulation
net:
ipv4: Fix UDP length overflow with PMTU discover and big MTU
net:
ipv6: Clamp to IP6_MAX_MTU in ip6_dst_mtu_maybe_forward
net:
ipv6: Fix UDP length overflow with PMTU discover and big MTU
net:
ks8851: Fix receiver error in 100BASE-TX mode following software power-down
net:
macb: destroy the phylink instance on the probe error path
net:
macb: exclude software FCS from TX byte statistics
net:
macb: fix NULL pointer dereference on unbind with fixed-link
net:
macb: initialize PTP state before registering clock
net:
macb: put the "mdio" child node reference on success
net:
macb: reject an unknown link speed in the taprio setup
net:
macb: unify device pointer naming convention
net:
macb: zero the link settings taprio reads back
net:
mana: Clear RDMA teardown and suspend state in mana_rdma_probe()
net:
mana: Reserve extra CQ slot for the fence completion CQE
net:
mana: restore the XDP program pointer when pre-allocation fails
net:
mctp: i3c: serialize probe with bus removal
net:
mpls: clear inner_protocol when the last label is popped
net:
net_failover: Fix the deadlock in net_failover_slave_name_change()
net:
openvswitch: fix use-after-free of the flow table mask array
net:
phy: dp83867: handle the active-high LED polarity mode
net:
phy: dp83td510: handle the active-high LED polarity mode
net:
phy: mediatek-ge: disable EEE on the MT7530 PHY
net:
phylink: initialise link_state before a forced major config
net:
reject oversized tx_queue_len at netlink parse time
net:
Remove conflicting altnames for dying netns in __dev_change_net_namespace().
net:
stmmac: fix dma mapping leak in stmmac_tso_xmit()
net:
stmmac: fix TX descriptor availability check for TSO traffic
net:
stmmac: initialize ptp_lock at probe time
net:
stmmac: reconfigure RX packet parser table in stmmac_hw_setup() after reset
net:
sun4i-emac: fix missing of_node_put() for phy_node
net:
usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow
net:
usb: pegasus: don't rely on id table pointer arithmetic
netfilter:
cttimeout: prevent UAF during module unload
netfilter:
ip6_tables: set F_PROTO when proto value is nonzero
netfilter:
nf_conntrack_sip: fix OOB read in sip_skip_whitespace()
netfilter:
nf_log: unregister loggers before per-net teardown
netfilter:
nfnetlink_log: cope with concurrent instance destruction
netfilter:
report NLM_F_DUMP_FILTERED when all is filtered out
netfs:
break unbuffered write when netfs_alloc_subrequest() fails
netfs:
Fix error vs transferred passed to ->ki_complete()
netfs:
Fix i_size update for partial transfer
netfs:
Fix read progress reporting
netfs:
Fix readahead synchronisation issues by loading all folios upfront
netfs:
Fix subreq ref leak
netfs:
Fix unbuffered/DIO write partial transfer error return
netfs:
Fix uninitialized return value in netfs_unbuffered_write()
netfs:
Mark folios with COPY_TO_CACHE whilst issuing subreqs
nexthop:
Initialize extack in remove_nh_grp_entry()
nstree:
check listing permission before taking a namespace reference
ntfs:
bound $AttrDef table walk to the loaded table size
ntfs:
do not mark the volume clean in sync_fs when errors were recorded
ntfs:
fix kmap_local leak in write_mft_record_nolock() error paths
ntfs:
leave HasEA flag untouched on setxattr failure
ntfs:
only count successfully cleared runs when freeing clusters
ntfs:
preserve error code in ntfs_resident_attr_record_add()
ntfs:
propagate reparse index insertion failure
ntfs:
reject invalid sectors_per_cluster in the boot sector
ntfs:
return -ERANGE for undersized xattr buffer
ntfs:
return DT_UNKNOWN on inode lookup failure in readdir
ntfs:
return real error from ntfs_non_resident_attr_record_add()
ntfs:
skip free cluster decrement when rollback fails
ntfs:
treat any nonzero dio zero-range return as an error
nvme-rdma:
fix -EIO cleanup order in queue_rq
nvme-tcp:
defer TLS inline send to io_work
nvme:
add context annotations for nvme_subsystem::lock
nvme:
fix racy access to FDP placement id array
nvme:
print namespace IDs as unsigned 32bit value
nvme:
remove stale namespaces by NSID range during scan
nvme:
set ns->head in nvme_alloc_ns_head
nvmet-rdma:
fix queue leak when connect backlog is exceeded
nvmet:
print namespace IDs as unsigned 32bit value
objtool/klp:
Fix checksums for constant pool references
octeontx2-af:
fix CN20K default MCAM rule removal on port cleanup
octeontx2-af:
Fix limiting SRIOV VF count logic
octeontx2-af:
fix PF/CGX debugfs PCI bus lookup
octeontx2-af:
mcs: Clear stale X2P calibration state before calibration
octeontx2-pf:
reset HTB scheduler topology before freeing queues
openvswitch:
fix wrong flag value in get_ipv6_ext_hdrs()
OPP:
of: Fix potential multiplication overflow when calculating freq
ovl:
return EINVAL instead of EIO in case of mismatched user_ns
pds_core:
don't release PCI regions for VFs on reset
pds_core:
fix cmd_regs access racing BAR unmap on reset
perf powerpc-vpadtl:
Fix raw_size of DTL samples
perf symbol:
Do not use debug file as the binary type
perf/core:
Allow list_del during perf_event_overflow()
perf/core:
Skip empty AUX records with only format flags
perf/x86/intel:
Correct pt_regs->flags update for PEBS path
perf/x86/intel:
Prevent drain_pebs() reentry
perf:
RISC-V: check cpu_hw_evt before dereference in overflow IRQ
perf:
RISC-V: store available counter mask as bitmap
perf:
RISC-V: use BIT_ULL for u64 overflow masks
platform/x86:
asus-laptop: Fix ACPI event handling
platform/x86:
hp-wmi: Fix board_params typo for 8DD6 board
platform/x86:
hp-wmi: Introduce board-specific feature data
platform/x86:
x86-android-tablets: fix gpio_secondary_fwnode_init() not working
platform/x86:
x86-android-tablets: hold device reference for secondary fwnode teardown
powerpc/eeh:
Fix recursive locking on devices without EEH sensitive driver
powerpc/entry:
Fix double accounting of user time on interrupt entry
powerpc/entry:
Fix irq_soft_mask corruption on replayed interrupt exit
powerpc/kexec_file:
Use inclusive range checks for excluded memory
powerpc/kexec_file:
Use inclusive range checks in add_usable_mem()
powerpc/ps3:
Fix repository.c build failure
powerpc:
Do not restore KUAP in arch_exit_to_user_mode_prepare()
powerpc:
Don't drop _TIF_RESTOREALL on syscall restart
powerpc:
pci-ioda: Fix the stale irq chip reference
ppp:
ppp_async: simplify tty disc_data access
ppp:
ppp_synctty: simplify tty disc_data access
ppp_async:
drop the errored frame instead of resetting its headroom
ppp_synctty:
ensure a writeable skb header
printk/nbcon:
Change nbcon_irq_work to IRQ_WORK_LAZY
printk:
Don't WARN on kthread_run failure.
RAS/AMD/ATL, EDAC/amd64:
Only load ATL when needed
raw:
annotate disconnect-side IPv4 match writers
reboot:
fix cad_pid use-after-free race
regulator:
pf1550: fix which regulator is notified
Revert "riscv:
Reset pmm when PR_TAGGED_ADDR_ENABLE is not set"
ring-buffer:
Acquire the lock with irqsave in rb_wake_up_waiters()
ring-buffer:
Add checking nr_subbufs to persistent ring buffer validation
ring-buffer:
Cap static ring buffer nr_pages
ring-buffer:
Check resize_disabled before publishing the new subbuf order
ring-buffer:
Remove ring_buffer_per_cpu::mapped
riscv:
hwprobe: initialize pair->value in hwprobe_one_pair()
rust:
allow `clippy::as_underscore` in the generated bindings
rust:
allow `unknown_lints` in generated bindings for Rust < 1.88
rust:
num: seal Integer
rust:
pin-init: use irrefutable pattern for `stack_pin_init`
rust:
samples: add missing newlines in rust_print_main
s390/boot:
Avoid IPL parameter append past command line
s390/boot:
Fix physical memory search range
s390/crypto:
Fix handling of EBUSY in PHMAC when req is pushed to crypto engine
s390/crypto:
Fix missing cra_flags in paes_s390
s390/crypto:
Fix missing scrub of temp buffers with AES ctr and gcm algorithm
s390/crypto:
Fix missing scrub of temp buffers with PAES algorithm
s390/crypto:
Fix skcipher_walk return code handling in aes_s390
s390/crypto:
Fix use of mutex in atomic context
s390/crypto:
Fix wrong return code to engine in asynch callbacks
s390/crypto:
Map EBUSY to EIO when key conversion fails repeatedly
s390/debug:
Fix NULL pointer dereference in debug_set_level()
s390/diag324:
Preserve -EBUSY return code
s390/ipl:
Fix NULL deref in dump_reipl without re-IPL parm block
s390/ipl:
Fix NULL deref in kdump without re-IPL parm block
s390/ism:
folio_put() after error
s390/pai:
Move locking to event init and delete
s390/pai:
Reduce excessive debug feature size
s390/pai:
Support CPU hotplug for PMU PAI
s390/pai:
Use PAI PMU index as parameter replacing event
s390/qeth:
allow bridgeport queries despite OS_MISMATCH
s390/time:
Use jiffies instead of jiffies_64
sched/core:
Call wq_worker_tick() for the execution context
sched/core:
Skip rq->avg_idle update without a valid idle_stamp
sched/eevdf:
Fix augmented max_slice
sched/eevdf:
Fix rb augmented with multi fields
sched/rt,dl:
Skip migrate-disabled tasks when picking a push candidate
sched:
Account cgroup CPU time to the execution context
sched_ext:
Fix nonexistent field in sched-ext.rst example
sched_ext:
Fix spurious aborts in scx_bpf_dsq_move() on ownership change races
sched_ext:
Fix timer pinning and return value in scx_central
sched_ext:
Fix vtime delta loss in scx_flatcg cgroup migration
scripts/mksysmap:
drop the MODULE_INFO() symbols from kallsyms
scripts/mksysmap:
fix escape of '$' in the __pi_ pattern
scripts/sorttable:
Mark long_size as __maybe_unused
scsi:
mpi3mr: Fix NULL pointer dereference in mpi3mr_sas_port_add()
scsi:
mpi3mr: Fix target device refcount leak in mpi3mr_sas_port_add()
scsi:
mpt3sas: Avoid out-of-bounds cpumask_of_node() call in _base_assign_reply_queues()
scsi:
qla2xxx: Bound VP index against VP_CTRL IOCB bitmap size
scsi:
qla2xxx: Clamp max_npiv_vports to VP_CTRL bitmap capacity
scsi:
qla2xxx: Fix 64G link speed reporting in get_data_rate
scsi:
qla2xxx: Fix queue teardown NULL dma_free and bitmap locking
scsi:
qla2xxx: Fix soft lockup polling continuation IOCB signature
scsi:
qla2xxx: Fix use-after-free of qpair work on queue teardown
scsi:
qla2xxx: Null out freed pointers in qla2x00_mem_alloc() error path
scsi:
qla2xxx: Serialize NVMe unsol ctx list with a per-fcport lock
scsi:
qla2xxx: Skip vport under deletion in report ID acquisition
scsi:
qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error
scsi:
qla2xxx: Use memset_io() to clear QLAFX00 request ring slot
scsi:
qla2xxx: Use ring-slot helpers in __qla2x00_alloc_iocbs
scsi:
qla2xxx: Validate BSG request_len before reading vendor_cmd[]
scsi:
target: iscsi: Fix hang for aborted WRITE_PENDING commands
scsi:
ufs: ufs-pci: Add MCQ support for Intel UFS 4.0 controllers
scsi:
ufs: ufs-pci: Add support for Intel UFS 4.0 HS-Gear5
sctp:
fix a TOCTOU race in SCTP_CMD_TIMER_START
sctp:
fix soft lockup from unpadded ASCONF-ACK parameter iteration
selftests/alsa:
Fix the step check for INTEGER controls
selftests/bpf:
Fix flaky bpf_nf test when random NAT port is 0
selftests/cgroup:
Drop invalid boot isolation comparison
selftests/cgroup:
Fix cg_run_in_subcgroups ignoring arg parameter
selftests/cgroup:
set the test plan after the setup checks
selftests/powerpc/tm:
Fix tcheck() reading uninitialised CR value
selftests:
mptcp: fix an UAF in mptcp_connect.c
selftests:
mptcp: lib: dump nstat for the right test
selftests:
mptcp: lib: get counters for the right test
selftests:
ublk: install test_common.sh and trace/ scripts
smb/client:
fix data corruption in emulated insert range
smb/client:
fix integer truncation in collapse range
smb/client:
fix stale page cache in insert/collapse range
smb/client:
invalidate fscache for fallocate range operations
smb/client:
mark file sparse before emulating insert range
smb/client:
validate new EOF for insert range
smb/client:
validate new EOF for zero range
smb/server:
cancel async requests when closing connection
smb:
client: avoid leaking refcount in cifs_queue_oplock_break()
smb:
client: avoid leaking refcount when cifs_sb_tlink() fails
smb:
client: avoid using uninitialized SIDs in cifs_posix_to_fattr()
smb:
client: fail DACL rewrite when the new DACL exceeds 64K
smb:
client: fix cifsFileInfo reference leak in deferred close
smb:
client: fix file type corruption in cifs_reparse_point_to_fattr()
smb:
client: fix file type corruption in posix_reparse_to_fattr()
smb:
client: fix file type corruption in wsl_to_fattr()
smb:
client: fix heap overflow in DACL owner/group rewrite
smb:
client: fix one-byte OOB read in smb2_parse_native_symlink()
smb:
client: fix uid/gid override in getattr with posix extensions
smb:
client: fix WSL reparse point uid/gid override
smb:
client: honor forceuid/forcegid when mapping SIDs to uid/gid
smb:
client: pin DFS superblock in iterator callback
smb:
client: reject out-of-bounds DataOffset in CIFSSMBRead()
smb:
client: reject short READ responses in CIFSSMBRead()
smb:
client: reject userspace cifs.idmap descriptions
smb:
client: transport: Fix debug printing in __release_mid()
staging:
fbtft: make dirty_lock IRQ-safe
sunvdc:
unmap LDC cookies when the descriptor send fails
tcp:
use GFP_ATOMIC in tcp_send_active_reset()
thermal:
sysfs: switch to use scnprintf() to suppress truncation warning
tick/broadcast:
Plug clockevents replacement race
tipc:
Dont send random pad bytes in RESET/ACTIVATE messages
tipc:
fix NULL deref in tipc_named_node_up() on empty publication list
tools/bootconfig:
Fix integer overflow and truncation in size checks
tracing/probes:
Fix use-after-free on field name/type of events with multiple probes
tracing/remotes:
Account for ring buffer page header in size calculation
tracing/remotes:
Catch nr_page_va overflow in ring_buffer_desc sizing
tracing/user_events:
Don't destroy fields when event removal fails
tracing:
Don't dereference trace_event_file in deferred trigger free
tracing:
Fix comment in tracing_buffers_splice_read()
tracing:
Fix memory corruption from a "STACKTRACE" histogram key
tracing:
Fix memory corruption from the histogram stacktrace modifier
tracing:
Fix ring_buffer_read_page_size() kernel-doc
tracing:
Fix subbuf resize races with trace_pipe_raw readers
tracing:
Fix to avoid creating trace instances with duplicate names
tracing:
Free histogram the field rejected for a bad modifier
tracing:
Free histogram the var ref when its initialization fails
tracing:
Free histogram var refs regardless of how often they are referenced
tracing:
Keep the entry count when the histogram stats allocation fails
tracing:
Let histogram values keep the percent and graph modifiers
tracing:
Restore :mod: trailer after parsing in ftrace_set_clr_event()
tracing:
Set the trace clock before registering the histogram trigger
tracing:
Take the reference before publishing the named histogram trigger
tracing:
Take trace_array reference when opening a tracer options file
tracing:
Undo the registration when enabling the histogram trigger fails
tunnels:
Drop stale dst when building an ICMP error for PMTUD
ublk:
clear force_abort in ublk_queue_reset_io_flags()
ufs:
create the root dentry after loading cylinder metadata
ufs:
do not treat unreadable directory blocks as empty
ufs:
validate cylinder group metadata before caching it
usb:
serial: spcp8x5: don't store usb_device_id
usb:
usbtmc: don't store usb_device_id
usb:
xusbatm: don't rely on id table pointer arithmetic
vdpa:
ifcvf: Put device on unsupported feature error
vdpa:
solidrun: Free IRQs after request failure
vdpa_sim_blk:
reject out-of-range sector starts
vdpa_sim_net:
check TX pull result before RX copy
vduse:
return compat ioctl results directly
vduse:
validate virtqueue alignment
vhost-vdpa:
don't install the eventfd_ctx_fdget() error in config_ctx
vhost-vdpa:
protect config_ctx from being freed under the config callback
vhost/vdpa:
reject VRING_NUM larger than device max
vhost:
invalidate vring access on IOTLB transitions
virtio-pci:
return IRQ_HANDLED after non-zero ISR
virtio:
fix use-after-free in unregister_virtio_device()
virtio_console:
do not free control-out buffers on remove
virtio_input:
reset device if input_register_device() fails
virtio_input:
stop callbacks before unregistering input device
virtio_mmio:
disable IRQ wake before free_irq
virtio_ring:
fix stale descriptor flags after a failed packed add
vxlan:
initialize _md in vxlan_xmit_one()
vxlan:
mdb: Fix use-after-free in vxlan_mdb_remote_src_del()
vxlan:
reject dynamic fdb entries that reference a nexthop id
watchdog:
fix hrtimer start when pretimeout is zero
watchdog:
msc313e: Avoid division by zero
watchdog:
msc313e: Enable clock before accessing hardware registers
watchdog:
msc313e: Fix clock leak and spurious timer in settimeout()
watchdog:
msc313e: Fix NULL pointer dereference in PM callbacks
watchdog:
msc313e: Fix spurious reset on suspend
watchdog:
msc313e: Fix undefined behavior
watchdog:
msc313e: Sync timeout value if WDT was running at boot
watchdog:
sunxi_wdt: preserve boot-enabled watchdog
wifi:
ath9k_htc: don't store usb_device_id
wifi:
mt76: mt7921: skip unknown CLC firmware records
wifi:
mt76: mt7921: validate CLC firmware records
workqueue:
reject watchdog thresholds that overflow jiffies
x86/alternatives:
Exclude text poking against change_page_attr()
x86/amd_node:
Avoid divide by zero on virtualized systems
x86/amd_node:
Fix PCI device reference counting in amd_smn_init()
x86/amd_node:
Fix potential NULL pointer dereference
x86/cfi:
Fix FineIBT hash offset in cfi_get_func_hash()
x86/itmt:
Don't make ITMT enablement depend on debugfs
x86/MCE/AMD:
Fix inverted interrupt enablement during storm handling
x86/mm/pat:
Acquire init_mm read lock on attribute changes to avoid UAF
x86/mm/pat:
Acquire init_mm write lock on collapse to avoid UAF
x86/mm/pat:
Allocate split page tables as kernel page tables
x86/mm/pat:
Don't gate cpa_lock on debug_pagealloc_enabled()
x86/mm:
Fix and document DEBUG_PAGEALLOC
x86/mm:
Fix user-space data loss with MADV_FREE and THP
xfs:
actually check internal-rtdev fields in the superblock
xfs:
actually recover intended file sizes in xfs_xmi_item_recover_intent
xfs:
advance the findparent inode scan cursor while holding ILOCK
xfs:
always set xfs_healthmon::first_event when inserting at front of list
xfs:
bail out on bitmap errors in xrep_agfl_fill
xfs:
bump lost_prev_errors if we lose even the healthmon lost event
xfs:
check healthmon outbuffer space correctly
xfs:
compute dquot checksum after resetting dd_lsn in repair
xfs:
count escaped corruption errors in scrub stats
xfs:
cross-reference the rtgroup superblock extent, not block
xfs:
destroy seen inode bitmap when we fail to add a dirpath
xfs:
don't leak dqacct if rhashtable insertion fails
xfs:
don't leak new_bp if xfs_btree_bload_drop_buf fails
xfs:
don't modify file attributes or poke fsnotify for dry runs
xfs:
don't spin forever on zero-length dirents when salvaging them
xfs:
don't stash removename operations with unknown ftype
xfs:
fix backwards mergeability logic in refcount scrubber
xfs:
fix backwards skipping logic in xrep_quota_block
xfs:
fix bnobt repair space reservation disposal failure
xfs:
fix exchange-range reflink flag clearing issue with INO1_WRITTEN
xfs:
fix media verification ioctl for internal rt volumes
xfs:
fix name string recording in slowpath pptr tracepoints
xfs:
fix parent rec lookup initialization in xrep_metapath_unlink
xfs:
fix reclaimed page accounting in xfs_buf_free
xfs:
fix replaying dirent removals into the temporary directory
xfs:
fix rtrefcount btree block counting in scrub
xfs:
fix rtrmap cross-referencing elision logic
xfs:
fix short ifork reaping computation in xreap_bmapi_binval
xfs:
fix the rtrmap and rtrefcount _maxlevels_ondisk functions
xfs:
fix under-reservation of blocks when repairing sf directories
xfs:
fix unit conversions in per_binval computation
xfs:
fix xfs_rtrmapbt_mem_cursor for non-rmap filesystems
xfs:
initialise args->total for parent pointer updates
xfs:
initialise error in xfs_defer_finish_one()
xfs:
lock the healthmon when inserting unmount event
xfs:
log the tempip after we convert it to extents format
xfs:
make the rtsummary repair fix the file size too
xfs:
preserve owner on in-memory btree creation
xfs:
release alleged child inode on metapath unlink error
xfs:
report healthy filesystem events in scrub stats
xfs:
report nonexistent parents as a filesystem corruption
xfs:
reset parent pointer args before each dir tree unlink repair
xfs:
signal inode btree xref error if get_rec returns an error
xfs:
snapshot old AGFL before rewriting it
xfs:
snapshot scrub stats when rendering them
xfs:
strengthen the "is cow staging" helpers in scrub
xfs:
truncate quota file correctly when repairing quota file
xfs:
use the rtgroup extent count to find rtrefcount gaps