GKI (arm64) relevant 50 out of 186 changes, affecting 60 files +397/-205
56c4353ce4 jbd2: increase IO priority for writing revoke records [1 file, +1/-1]
a5bc868610 jbd2: flush filesystem device before updating tail sequence [1 file, +2/-2]
7adf7df4bb iomap: pass byte granular end position to iomap_add_to_ioend [1 file, +12/-9]
82c59a86a2 iomap: fix zero padding data issue in concurrent append writes [2 files, +46/-1]
88ecdfea1b netfs: Fix enomem handling in buffered reads [1 file, +16/-12]
2c3348864a netfs: Fix missing barriers by using clear_and_wake_up_bit() [2 files, +4/-8]
43b8d3249b netfs: Fix ceph copy to cache on write-begin [1 file, +4/-2]
ba37bdfe59 netfs: Fix the (non-)cancellation of copy when cache is temporarily disabled [1 file, +4/-0]
6f153055ba netfs: Fix is-caching check in read-retry [2 files, +1/-2]
d9ea94f5cd exfat: fix the infinite loop in exfat_readdir() [1 file, +2/-1]
942c6f91ab exfat: fix the new buffer was not zeroed before writing [1 file, +6/-0]
0bebeb6672 exfat: fix the infinite loop in __exfat_free_cluster() [1 file, +10/-0]
c0f613f214 fuse: respect FOPEN_KEEP_CACHE on opendir [1 file, +2/-0]
668d8dea2c ovl: pass realinode to ovl_encode_real_fh() instead of realdentry [4 files, +12/-10]
3c7c90274a ovl: support encoding fid from inode with no alias [1 file, +25/-21]
a3a9630d4d net: 802: LLC+SNAP OID:PID lookup on start of skb data [1 file, +2/-2]
e4a92f0d51 tcp/dccp: allow a connection when sk_max_ack_backlog is zero [1 file, +1/-1]
6fde663f73 net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute [1 file, +2/-1]
61b437faf2 net: don't dump Tx and uninitialized NAPIs [1 file, +3/-2]
52a24538d5 ipvlan: Fix use-after-free in ipvlan_get_iflink(). [1 file, +7/-3]
ccc1ef1884 Bluetooth: hci_sync: Fix not setting Random Address when required [1 file, +6/-5]
1f88b53135 Bluetooth: MGMT: Fix Add Device to responding before completing [1 file, +36/-2]
8b800ea3f3 tcp: Annotate data-race around sk->sk_mark in tcp_v4_send_reset [1 file, +1/-1]
f559357d03 netfilter: conntrack: clamp maximum hashtable size to INT_MAX [1 file, +4/-1]
9f3a265836 netfs: Fix kernel async DIO [1 file, +6/-1]
3f545392e9 netfs: Fix read-retry for fs with no ->prepare_read() [1 file, +2/-1]
adcde2872f fs: relax assertions on failure to encode file handles [2 files, +3/-6]
8790d511d4 fs: fix is_mnt_ns_file() [1 file, +8/-2]
fc89438866 dm-verity FEC: Fix RS FEC repair for roots unaligned to block size (take 2) [1 file, +26/-14]
dc63fd2e47 cgroup/cpuset: Prevent leakage of isolated CPUs into sched domains [2 files, +28/-15]
5b80f2fe8a thermal: of: fix OF node leak in of_thermal_zone_find() [1 file, +1/-0]
11cb1d643a cgroup/cpuset: remove kernfs active break [1 file, +0/-25]
2b30bffd9a io_uring/timeout: fix multishot updates [1 file, +3/-1]
aa7496d668 io_uring/sqpoll: zero sqd->thread on tctx errors [1 file, +5/-1]
360596e7fe topology: Keep the cpumask unchanged when printing cpumap [1 file, +20/-4]
07f09383b1 tty: serial: 8250: Fix another runtime PM usage counter underflow [1 file, +3/-0]
8e122d780a usb: gadget: u_serial: Disable ep before setting port to null to fix the crash caused by port being null [1 file, +4/-4]
e982fcb440 USB: core: Disable LPM only for non-suspended ports [1 file, +4/-3]
4fb62dea06 usb: fix reference leak in usb_new_device() [1 file, +4/-2]
8586d6ea62 usb: typec: tcpci: fix NULL pointer issue on shared irq case [1 file, +15/-10]
4bb6450bfd usb: gadget: f_uac2: Fix incorrect setting of bNumEndpoints [1 file, +1/-0]
a8b6a18b9b usb: gadget: f_fs: Remove WARN_ON in functionfs_bind [1 file, +1/-1]
62aa896683 usb: gadget: configfs: Ignore trailing LF for user strings to cdev [1 file, +5/-1]
a25f1e6f60 usb: host: xhci-plat: set skip_phy_initialization if software node has XHCI_SKIP_PHY_INIT property [1 file, +2/-1]
b44c99621d iio: inkern: call iio_device_put() only on mapped devices [1 file, +1/-1]
a7085c3ae4 io_uring/eventfd: ensure io_eventfd_signal() defers another RCU period [1 file, +1/-1]
bc2aeb35ff block, bfq: fix waker_bfqq UAF after bfq_split_bfqq() [1 file, +10/-2]
810aad1d7f firewall: remove misplaced semicolon from stm32_firewall_get_firewall [1 file, +1/-1]
476e4c4a1a io_uring: don't touch sqd->thread off tw add [1 file, +1/-4]
b683ba0df1 netdev: prevent accessing NAPI instances from another namespace [3 files, +33/-17]
Changes in 6.12.10
jbd2: increase IO priority for writing revoke records
jbd2: flush filesystem device before updating tail sequence
fs/writeback: convert wbc_account_cgroup_owner to take a folio
iomap: pass byte granular end position to iomap_add_to_ioend
iomap: fix zero padding data issue in concurrent append writes
dm array: fix releasing a faulty array block twice in dm_array_cursor_end
dm array: fix unreleased btree blocks on closing a faulty array cursor
dm array: fix cursor index when skipping across block boundaries
netfs: Fix enomem handling in buffered reads
nfs: Fix oops in nfs_netfs_init_request() when copying to cache
netfs: Fix missing barriers by using clear_and_wake_up_bit()
netfs: Fix ceph copy to cache on write-begin
netfs: Fix the (non-)cancellation of copy when cache is temporarily disabled
netfs: Fix is-caching check in read-retry
exfat: fix the infinite loop in exfat_readdir()
exfat: fix the new buffer was not zeroed before writing
exfat: fix the infinite loop in __exfat_free_cluster()
fuse: respect FOPEN_KEEP_CACHE on opendir
ovl: pass realinode to ovl_encode_real_fh() instead of realdentry
ovl: support encoding fid from inode with no alias
ASoC: rt722: add delay time to wait for the calibration procedure
ASoC: mediatek: disable buffer pre-allocation
selftests/alsa: Fix circular dependency involving global-timer
ieee802154: ca8210: Add missing check for kfifo_alloc() in ca8210_probe()
net: 802: LLC+SNAP OID:PID lookup on start of skb data
tcp/dccp: allow a connection when sk_max_ack_backlog is zero
net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute
net: libwx: fix firmware mailbox abnormal return
btrfs: avoid NULL pointer dereference if no valid extent tree
pds_core: limit loop over fw name list
bnxt_en: Fix possible memory leak when hwrm_req_replace fails
bnxt_en: Fix DIM shutdown
cxgb4: Avoid removal of uninserted tid
net: don't dump Tx and uninitialized NAPIs
ice: fix max values for dpll pin phase adjust
ice: fix incorrect PHY settings for 100 GB/s
igc: return early when failing to read EECD register
tls: Fix tls_sw_sendmsg error handling
ipvlan: Fix use-after-free in ipvlan_get_iflink().
eth: gve: use appropriate helper to set xdp_features
Bluetooth: hci_sync: Fix not setting Random Address when required
Bluetooth: MGMT: Fix Add Device to responding before completing
Bluetooth: btnxpuart: Fix driver sending truncated data
Bluetooth: btmtk: Fix failed to send func ctrl for MediaTek devices.
tcp: Annotate data-race around sk->sk_mark in tcp_v4_send_reset
net: hns3: fixed reset failure issues caused by the incorrect reset type
net: hns3: fix missing features due to dev->features configuration too early
net: hns3: Resolved the issue that the debugfs query result is inconsistent.
net: hns3: don't auto enable misc vector
net: hns3: initialize reset_timer before hclgevf_misc_irq_init()
net: hns3: fixed hclge_fetch_pf_reg accesses bar space out of bounds issue
net: hns3: fix kernel crash when 1588 is sent on HIP08 devices
mctp i3c: fix MCTP I3C driver multi-thread issue
netfilter: nf_tables: imbalance in flowtable binding
netfilter: conntrack: clamp maximum hashtable size to INT_MAX
sched: sch_cake: add bounds checks to host bulk flow fairness counts
net: stmmac: dwmac-tegra: Read iommu stream id from device tree
rtase: Fix a check for error in rtase_alloc_msix()
net/mlx5: Fix variable not being completed when function returns
drm/mediatek: Set private->all_drm_private[i]->drm to NULL if mtk_drm_bind returns err
drm/mediatek: Move mtk_crtc_finish_page_flip() to ddp_cmdq_cb()
drm/mediatek: Add support for 180-degree rotation in the display driver
drm/mediatek: stop selecting foreign drivers
drm/mediatek: Fix YCbCr422 color format issue for DP
drm/mediatek: Fix mode valid issue for dp
drm/mediatek: mtk_dsi: Add registers to pdata to fix MT8186/MT8188
gpio: virtuser: fix missing lookup table cleanups
gpio: virtuser: fix handling of multiple conn_ids in lookup table
drm/mediatek: Add return value check when reading DPCD
ksmbd: fix a missing return value check bug
afs: Fix the maximum cell name length
platform/x86/amd/pmc: Only disable IRQ1 wakeup where i8042 actually enabled it
platform/x86: intel/pmc: Fix ioremap() of bad address
ksmbd: fix unexpectedly changed path in ksmbd_vfs_kern_path_locked
riscv: module: remove relocation_head rel_entry member allocation
cpuidle: riscv-sbi: fix device node release in early exit of for_each_possible_cpu
riscv: mm: Fix the out of bound issue of vmemmap address
riscv: stacktrace: fix backtracing through exceptions
riscv: use local label names instead of global ones in assembly
drm/xe: Fix tlb invalidation when wedging
netfs: Fix kernel async DIO
netfs: Fix read-retry for fs with no ->prepare_read()
drivers/perf: riscv: Fix Platform firmware event data
drivers/perf: riscv: Return error for default case
dm thin: make get_first_thin use rcu-safe list first function
scsi: ufs: qcom: Power off the PHY if it was already powered on in ufs_qcom_power_up_sequence()
vfio/pci: Fallback huge faults for unaligned pfn
fs: relax assertions on failure to encode file handles
fs: fix is_mnt_ns_file()
dm-ebs: don't set the flag DM_TARGET_PASSES_INTEGRITY
dm-verity FEC: Fix RS FEC repair for roots unaligned to block size (take 2)
mptcp: sysctl: avail sched: remove write access
mptcp: sysctl: sched: avoid using current->nsproxy
mptcp: sysctl: blackhole timeout: avoid using current->nsproxy
sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy
sctp: sysctl: rto_min/max: avoid using current->nsproxy
sctp: sysctl: auth_enable: avoid using current->nsproxy
sctp: sysctl: udp_port: avoid using current->nsproxy
sctp: sysctl: plpmtud_probe_interval: avoid using current->nsproxy
rds: sysctl: rds_tcp_{rcv,snd}buf: avoid using current->nsproxy
ksmbd: Implement new SMB3 POSIX type
btrfs: zlib: fix avail_in bytes for s390 zlib HW compression path
Revert "drm/mediatek: dsi: Correct calculation formula of PHY Timing"
drm/amd/display: Remove unnecessary amdgpu_irq_get/put
drm/amd/display: Add check for granularity in dml ceil/floor helpers
cgroup/cpuset: Prevent leakage of isolated CPUs into sched domains
thermal: of: fix OF node leak in of_thermal_zone_find()
sched_ext: Replace rq_lock() to raw_spin_rq_lock() in scx_ops_bypass()
sched_ext: switch class when preempted by higher priority scheduler
cgroup/cpuset: remove kernfs active break
sched_ext: idle: Refresh idle masks during idle-to-idle transitions
arm64: dts: qcom: x1e80100: Fix up BAR space size for PCIe6a
arm64: dts: qcom: sa8775p: Fix the size of 'addr_space' regions
smb: client: sync the root session and superblock context passwords before automounting
fs: kill MNT_ONRB
riscv: Fix sleeping in invalid context in die()
riscv: kprobes: Fix incorrect address calculation
gpio: loongson: Fix Loongson-2K2000 ACPI GPIO register offset
ACPI: resource: Add TongFang GM5HG0A to irq1_edge_low_force_override[]
ACPI: resource: Add Asus Vivobook X1504VAP to irq1_level_low_skip_override[]
drm/amdgpu: Add a lock when accessing the buddy trim function
drm/amd/pm: fix BUG: scheduling while atomic
drm/amdkfd: fixed page fault when enable MES shader debugger
drm/amdkfd: wq_release signals dma_fence only when available
drm/amd/display: fix divide error in DM plane scale calcs
drm/amd/display: fix page fault due to max surface definition mismatch
drm/amd/display: increase MAX_SURFACES to the value supported by hw
io_uring/timeout: fix multishot updates
io_uring/sqpoll: zero sqd->thread on tctx errors
USB: serial: option: add MeiG Smart SRM815
USB: serial: option: add Neoway N723-EA support
staging: iio: ad9834: Correct phase range check
staging: iio: ad9832: Correct phase range check
usb-storage: Add max sectors quirk for Nokia 208
USB: serial: cp210x: add Phoenix Contact UPS Device
usb: dwc3: gadget: fix writing NYET threshold
topology: Keep the cpumask unchanged when printing cpumap
misc: microchip: pci1xxxx: Resolve kernel panic during GPIO IRQ handling
misc: microchip: pci1xxxx: Resolve return code mismatch during GPIO set config
tty: serial: 8250: Fix another runtime PM usage counter underflow
serial: stm32: use port lock wrappers for break control
usb: gadget: u_serial: Disable ep before setting port to null to fix the crash caused by port being null
x86/fpu: Ensure shadow stack is active before "getting" registers
usb: dwc3-am62: Disable autosuspend during remove
USB: usblp: return error when setting unsupported protocol
USB: core: Disable LPM only for non-suspended ports
usb: fix reference leak in usb_new_device()
usb: gadget: midi2: Reverse-select at the right place
usb: chipidea: ci_hdrc_imx: decrement device's refcount in .remove() and in the error path of .probe()
usb: typec: tcpci: fix NULL pointer issue on shared irq case
usb: gadget: f_uac2: Fix incorrect setting of bNumEndpoints
usb: typec: tcpm/tcpci_maxim: fix error code in max_contaminant_read_resistance_kohm()
usb: gadget: f_fs: Remove WARN_ON in functionfs_bind
usb: gadget: configfs: Ignore trailing LF for user strings to cdev
usb: host: xhci-plat: set skip_phy_initialization if software node has XHCI_SKIP_PHY_INIT property
usb: typec: fix pm usage counter imbalance in ucsi_ccg_sync_control()
iio: pressure: zpa2326: fix information leak in triggered buffer
iio: dummy: iio_simply_dummy_buffer: fix information leak in triggered buffer
iio: light: vcnl4035: fix information leak in triggered buffer
iio: light: bh1745: fix information leak in triggered buffer
iio: imu: kmx61: fix information leak in triggered buffer
iio: adc: rockchip_saradc: fix information leak in triggered buffer
iio: adc: ti-ads8688: fix information leak in triggered buffer
iio: adc: ti-ads1119: fix information leak in triggered buffer
iio: adc: ti-ads1119: fix sample size in scan struct for triggered buffer
iio: gyro: fxas21002c: Fix missing data update in trigger handler
iio: adc: ti-ads1298: Add NULL check in ads1298_init
iio: imu: inv_icm42600: fix timestamps after suspend if sensor is on
iio: adc: ti-ads124s08: Use gpiod_set_value_cansleep()
iio: adc: at91: call input_free_device() on allocated iio_dev
iio: inkern: call iio_device_put() only on mapped devices
iio: adc: ad7173: fix using shared static info struct
iio: adc: ad7124: Disable all channels at probe time
io_uring/eventfd: ensure io_eventfd_signal() defers another RCU period
arm64: dts: imx95: correct the address length of netcmix_blk_ctrl
ARM: dts: imxrt1050: Fix clocks for mmc
arm64: dts: qcom: sa8775p: fix the secure device bootup issue
hwmon: (drivetemp) Fix driver producing garbage data when SCSI errors occur
block, bfq: fix waker_bfqq UAF after bfq_split_bfqq()
arm64: dts: rockchip: add hevc power domain clock to rk3328
firewall: remove misplaced semicolon from stm32_firewall_get_firewall
drm/mediatek: Only touch DISP_REG_OVL_PITCH_MSB if AFBC is supported
io_uring: don't touch sqd->thread off tw add
iio: imu: inv_icm42600: fix spi burst write not supported
netdev: prevent accessing NAPI instances from another namespace
Linux 6.12.10
Change-Id: Ie2f94fe090d61be2389c21427b56a19ec5f88bd6
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
commit 974e3fe0ac61de85015bbe5a4990cf4127b304b2 upstream.
Encoding file handles is usually performed by a filesystem >encode_fh()
method that may fail for various reasons.
The legacy users of exportfs_encode_fh(), namely, nfsd and
name_to_handle_at(2) syscall are ready to cope with the possibility
of failure to encode a file handle.
There are a few other users of exportfs_encode_{fh,fid}() that
currently have a WARN_ON() assertion when ->encode_fh() fails.
Relax those assertions because they are wrong.
The second linked bug report states commit 16aac5ad1f ("ovl: support
encoding non-decodable file handles") in v6.6 as the regressing commit,
but this is not accurate.
The aforementioned commit only increases the chances of the assertion
and allows triggering the assertion with the reproducer using overlayfs,
inotify and drop_caches.
Triggering this assertion was always possible with other filesystems and
other reasons of ->encode_fh() failures and more particularly, it was
also possible with the exact same reproducer using overlayfs that is
mounted with options index=on,nfs_export=on also on kernels < v6.6.
Therefore, I am not listing the aforementioned commit as a Fixes commit.
Backport hint: this patch will have a trivial conflict applying to
v6.6.y, and other trivial conflicts applying to stable kernels < v6.6.
Reported-by: syzbot+ec07f6f5ce62b858579f@syzkaller.appspotmail.com
Tested-by: syzbot+ec07f6f5ce62b858579f@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/linux-unionfs/671fd40c.050a0220.4735a.024f.GAE@google.com/
Reported-by: Dmitry Safonov <dima@arista.com>
Closes: https://lore.kernel.org/linux-fsdevel/CAGrbwDTLt6drB9eaUagnQVgdPBmhLfqqxAf3F+Juqy_o6oP8uw@mail.gmail.com/
Cc: stable@vger.kernel.org
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Link: https://lore.kernel.org/r/20241219115301.465396-1-amir73il@gmail.com
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
GKI (arm64) relevant 129 out of 468 changes, affecting 180 files +1843/-980
e0964a5778 ptp: Add error handling for adjfine callback in ptp_clock_adjtime [1 file, +2/-1]
a007f8895f net/sched: tbf: correct backlog statistic for GSO packets [1 file, +12/-6]
9545011e7b net: Fix icmp host relookup triggering ip_rt_bug [1 file, +3/-0]
01f95357e4 ipv6: avoid possible NULL deref in modify_prefix_route() [1 file, +7/-6]
8b591bd522 net/ipv6: release expired exception dst cached in socket [1 file, +3/-3]
e48b211c4c tipc: Fix use-after-free of kernel socket in cleanup_bearer(). [1 file, +1/-1]
da5cc778e7 netfilter: nft_inner: incorrect percpu area handling under softirq [2 files, +46/-12]
a36a6d7037 Revert "udp: avoid calling sock_def_readable() if possible" [1 file, +3/-11]
22074dc1d4 ethtool: Fix wrong mod state in case of verbose and no_mask bitset [1 file, +44/-4]
316183d583 net: avoid potential UAF in default_operstate() [1 file, +6/-1]
c00372e41b mmc: sd: SDUC Support Recognition [7 files, +27/-15]
19e22f1e68 mmc: core: Adjust ACMD22 to SDUC [1 file, +18/-6]
42311846d3 mmc: core: Use GFP_NOIO in ACMD22 [1 file, +4/-0]
4e51552bc5 zram: do not mark idle slots that cannot be idle [1 file, +18/-7]
0ab037634b zram: clear IDLE flag in mark_idle() [1 file, +2/-0]
405b6d5f90 ntp: Remove invalid cast in time offset math [1 file, +1/-1]
6358df316d f2fs: clean up w/ F2FS_{BLK_TO_BYTES,BTYES_TO_BLK} [1 file, +29/-39]
e6a91ed4b9 f2fs: fix to adjust appropriate length for fiemap [2 files, +4/-3]
8e9fec7f79 f2fs: fix to requery extent which cross boundary of inquiry [1 file, +15/-5]
815d8f0e52 i3c: master: Replace hard code 2 with macro I3C_ADDR_SLOT_STATUS_BITS [2 files, +5/-3]
c3806cf647 i3c: master: Extend address status bit to 4 and add I3C_ADDR_SLOT_EXT_DESIRED [2 files, +59/-13]
1117462773 i3c: master: Fix dynamic address leak when 'assigned-address' is present [1 file, +5/-10]
7d4e5e33ea scsi: ufs: core: Always initialize the UIC done completion [1 file, +4/-7]
3ad69f2f08 scsi: ufs: core: Add ufshcd_send_bsg_uic_cmd() for UFS BSG [3 files, +38/-1]
47f4ad956b bpf, vsock: Fix poll() missing a queue [1 file, +3/-0]
a222e48fea bpf, vsock: Invoke proto::close on close() [1 file, +40/-27]
dabaf26846 xsk: always clear DMA mapping information when unmapping the pool [1 file, +2/-3]
5c9e3bb43a tcp_bpf: Fix the sk_mem_uncharge logic in tcp_bpf_sendmsg [1 file, +4/-7]
7bc37dd9ea ALSA: usb-audio: Notify xrun for low-latency mode [1 file, +11/-3]
a78af11806 pmdomain: core: Add missing put_device() [1 file, +1/-0]
913a3f1c06 pmdomain: core: Fix error path in pm_genpd_init() when ida alloc fails [1 file, +19/-17]
5548887987 nvme: don't apply NVME_QUIRK_DEALLOCATE_ZEROES when DSM is not supported [1 file, +2/-1]
bdbf87486d bpf: Ensure reg is PTR_TO_STACK in process_iter_arg [2 files, +7/-2]
2459a0b149 drivers/virt: pkvm: Don't fail ioremap() call if MMIO_GUARD fails [1 file, +1/-5]
0da7d4b7ca bpf: Don't mark STACK_INVALID as STACK_MISC in mark_stack_slot_misc [1 file, +6/-3]
f9f2a2739e bpf: Fix narrow scalar spill onto 64-bit spilled scalar slots [1 file, +1/-0]
845cc4ee8e nvme-fabrics: handle zero MAXCMD without closing the connection [1 file, +3/-2]
c2277e2859 scatterlist: fix incorrect func name in kernel-doc [1 file, +1/-1]
81ec3c6ceb bpf: Handle BPF_EXIST and BPF_NOEXIST for LPM trie [1 file, +20/-3]
6dc076a257 bpf: Remove unnecessary kfree(im_node) in lpm_trie_update_elem [1 file, +1/-3]
7218e441ad bpf: Handle in-place update for full LPM trie correctly [1 file, +21/-23]
412bf01fd5 bpf: Fix exact match conditions in trie_get_next_key() [1 file, +2/-2]
e689bc6697 HID: wacom: fix when get product name maybe null pointer [1 file, +2/-1]
3b0c5bb437 can: dev: can_set_termination(): allow sleeping GPIOs [1 file, +1/-1]
ba0ee489cd tracing: Fix cmp_entries_dup() to respect sort() comparison rules [1 file, +1/-5]
ec643064ab arm64: mm: Fix zone_dma_limit calculation [1 file, +8/-9]
34b6197867 arm64: Ensure bits ASID[15:8] are masked out when the kernel uses 8-bit ASIDs [1 file, +2/-2]
abd614bbfc arm64: ptrace: fix partial SETREGSET for NT_ARM_TAGGED_ADDR_CTRL [1 file, +5/-1]
8ab73c34e3 arm64: ptrace: fix partial SETREGSET for NT_ARM_FPMR [1 file, +2/-0]
4105dd76bc arm64: ptrace: fix partial SETREGSET for NT_ARM_POE [1 file, +2/-0]
7f1292f8d4 ALSA: usb-audio: Fix a DMA to stack memory bug [1 file, +27/-15]
39c5d89b56 ALSA: usb-audio: Add extra PID for RME Digiface USB [3 files, +176/-168]
9c191055c7 scsi: ufs: core: sysfs: Prevent div by zero [1 file, +6/-0]
2e7a3bb033 scsi: ufs: core: Cancel RTC work during ufshcd_remove() [1 file, +1/-0]
5a717f43c2 scsi: ufs: core: Add missing post notify for power mode change [2 files, +10/-7]
793e560a6b io_uring: Change res2 parameter type in io_uring_cmd_done [2 files, +3/-3]
85351e4941 Revert "readahead: properly shorten readahead when falling back to do_page_cache_ra()" [1 file, +2/-3]
95e197354e cacheinfo: Allocate memory during CPU hotplug if not done from the primary CPU [1 file, +8/-6]
bc031095d1 modpost: Add .irqentry.text to OTHER_SECTIONS [1 file, +1/-1]
178e31df1f bpf: fix OOB devmap writes when deleting elements [1 file, +3/-3]
3dcc20418e dma-buf: fix dma_fence_array_signaled v4 [1 file, +27/-1]
f3dbb097d6 dma-fence: Fix reference leak on fence merge failure path [1 file, +2/-0]
4715555964 dma-fence: Use kernel's sort for merging fences [1 file, +61/-67]
d486b5741d xsk: fix OOB map writes when deleting elements [1 file, +1/-1]
14258211d6 regmap: detach regmap from dev on regmap_exit [1 file, +12/-0]
d562b457e1 mmc: core: Further prevent card detect during shutdown [2 files, +5/-0]
9bfeeeff2c stackdepot: fix stack_depot_save_flags() in NMI context [2 files, +12/-4]
a71ddd5b87 sched/numa: fix memory leak due to the overwritten vma->numab_state [1 file, +9/-3]
835ca042df kasan: make report_lock a raw spinlock [1 file, +3/-3]
69d319450d mm/gup: handle NULL pages in unpin_user_pages() [1 file, +10/-1]
1dde3fde62 mm: open-code PageTail in folio_flags() and const_folio_flags() [1 file, +2/-2]
bd4d2333a3 mm: open-code page_folio() in dump_page() [1 file, +5/-2]
536ffb4014 mm: fix vrealloc()'s KASAN poisoning logic [1 file, +2/-1]
fe1a34e92a mm: respect mmap hint address when aligning for THP [1 file, +1/-0]
5c63e24b1b scsi: ufs: pltfrm: Drop PM runtime reference count after ufshcd_remove() [6 files, +2/-5]
2cec2d916a memblock: allow zero threshold in validate_numa_converage() [1 file, +2/-2]
d222934627 epoll: annotate racy check [2 files, +5/-3]
493326c4f1 block: RCU protect disk->conv_zones_bitmap [2 files, +32/-13]
b6ce2dbe98 ext4: partial zero eof block on unaligned inode size extension [2 files, +42/-16]
ff599ad2d2 cleanup: Adjust scoped_guard() macros to avoid potential warning [1 file, +42/-10]
3946e07552 gpio: free irqs that are still requested when the chip is being removed [1 file, +41/-0]
ea74e9675b HID: add per device quirk to force bind to hid-generic [3 files, +8/-2]
17db6ed5a3 media: uvcvideo: RealSense D421 Depth module metadata [1 file, +9/-0]
0c20fadfd0 media: uvcvideo: Add a quirk for the Kaiweets KTI-W02 infrared camera [1 file, +11/-0]
3cc5228d5b media: uvcvideo: Force UVC version to 1.0a for 0408:4033 [1 file, +11/-0]
4150f22342 drm: panel-orientation-quirks: Add quirk for AYA NEO 2 model [1 file, +6/-0]
5d7f35ed5f drm: panel-orientation-quirks: Add quirk for AYA NEO Founder edition [1 file, +6/-0]
187d5ff497 drm: panel-orientation-quirks: Add quirk for AYA NEO GEEK [1 file, +6/-0]
fd09880b16 af_packet: avoid erroring out after sock_init_data() in packet_create() [1 file, +6/-6]
61686abc2f Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create() [1 file, +1/-0]
32df687e12 Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc() [1 file, +5/-5]
8df832e6b9 net: af_can: do not leave a dangling sk pointer in can_create() [1 file, +1/-0]
03caa9bfb9 net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() [1 file, +7/-5]
691d6d816f net: inet: do not leave a dangling sk pointer in inet_create() [1 file, +10/-12]
f44fceb71d net: inet6: do not leave a dangling sk pointer in inet6_create() [1 file, +10/-12]
987aa730ba bpf: Prevent tailcall infinite loop caused by freplace [5 files, +81/-17]
051f49d517 net/tcp: Add missing lockdep annotations for TCP-AO hlist traversals [4 files, +29/-23]
920159e1bf ALSA: usb-audio: Make mic volume workarounds globally applicable [3 files, +45/-48]
a50b4aa300 bpf: Call free_htab_elem() after htab_unlock_bucket() [1 file, +39/-17]
da561d5fb6 Bluetooth: hci_conn: Reduce hci_conn_drop() calls in two functions [1 file, +3/-10]
c55a4c5a04 Bluetooth: hci_conn: Use disable_delayed_work_sync [1 file, +3/-3]
93a6160dc1 Bluetooth: hci_core: Fix not checking skb length on hci_acldata_packet [1 file, +9/-4]
b04b4fb91d Bluetooth: Add new quirks for ATS2851 [2 files, +20/-4]
359fc41e3c Bluetooth: Support new quirks for ATS2851 [2 files, +15/-1]
166cf43070 net/neighbor: clear error in case strict check is not set [1 file, +1/-0]
f63a1caae9 tracing/ftrace: disable preemption in syscall probe [2 files, +44/-4]
d1133dd57e tracing: Use atomic64_inc_return() in trace_clock_counter() [1 file, +1/-1]
09c083fbea ring-buffer: Limit time with disabled interrupts in rb_check_pages() [1 file, +72/-26]
c11e2ec9a7 pinmux: Use sequential access to access desc->pinmux data [3 files, +100/-77]
b865d4e569 scsi: ufs: core: Make DMA mask configuration more flexible [3 files, +13/-9]
2fcb921c27 bpf: put bpf_link's program when link is safe to be deallocated [1 file, +17/-5]
bb4a6236a4 leds: class: Protect brightness_show() with led_cdev->led_access mutex [2 files, +12/-4]
7214d3a64e tracing: Fix function name for trampoline [3 files, +36/-8]
9e28513fd2 f2fs: fix f2fs_bug_on when uninstalling filesystem call f2fs_evict_inode. [1 file, +3/-1]
b51aa6a07e PCI: qcom: Add support for IPQ9574 [1 file, +1/-0]
617bd1e6c3 PCI: Add ACS quirk for Wangxun FF5xxx NICs [1 file, +9/-6]
1f51ae217d i3c: Use i3cdev->desc->info instead of calling i3c_device_get_info() to avoid deadlock [1 file, +2/-1]
6d41a2d5c1 f2fs: print message if fscorrupted was found in f2fs_new_node_page() [1 file, +6/-1]
924f7dd1e8 f2fs: fix to shrink read extent node in batches [1 file, +41/-28]
1648c7000f serial: 8250_dw: Add Sophgo SG2044 quirk [1 file, +3/-2]
950210c9c7 Revert "nvme: make keep-alive synchronous operation" [1 file, +10/-7]
d5b2ddf1f9 io_uring/tctx: work around xa_store() allocation error issue [1 file, +12/-1]
cd188519d2 scsi: ufs: pltfrm: Dellocate HBA during ufshcd_pltfrm_remove() [1 file, +1/-0]
a39ad4f507 sched/core: Remove the unnecessary need_resched() check in nohz_csd_func() [1 file, +1/-1]
f9e144a544 sched/fair: Check idle_cpu() before need_resched() to detect ilb CPU turning busy [1 file, +1/-1]
b4ec68868c sched/core: Prevent wakeup of ksoftirqd during idle load balance [1 file, +1/-1]
364dc8070b tracing/eprobe: Fix to release eprobe when failed to add dyn_event [1 file, +5/-0]
1a678f6829 clocksource: Make negative motion detection more robust [4 files, +20/-7]
6aeef0214d softirq: Allow raising SCHED_SOFTIRQ from SMP-call-function on RT kernel [1 file, +11/-4]
Changes in 6.12.5
iTCO_wdt: mask NMI_NOW bit for update_no_reboot_bit() call
watchdog: xilinx_wwdt: Calculate max_hw_heartbeat_ms using clock frequency
watchdog: apple: Actually flush writes after requesting watchdog restart
watchdog: mediatek: Make sure system reset gets asserted in mtk_wdt_restart()
can: gs_usb: add usb endpoint address detection at driver probe step
can: c_can: c_can_handle_bus_err(): update statistics if skb allocation fails
can: sun4i_can: sun4i_can_err(): call can_change_state() even if cf is NULL
can: hi311x: hi3110_can_ist(): fix potential use-after-free
can: m_can: m_can_handle_lec_err(): fix {rx,tx}_errors statistics
can: ifi_canfd: ifi_canfd_handle_lec_err(): fix {rx,tx}_errors statistics
can: hi311x: hi3110_can_ist(): fix {rx,tx}_errors statistics
can: sja1000: sja1000_err(): fix {rx,tx}_errors statistics
can: sun4i_can: sun4i_can_err(): fix {rx,tx}_errors statistics
can: ems_usb: ems_usb_rx_err(): fix {rx,tx}_errors statistics
can: f81604: f81604_handle_can_bus_errors(): fix {rx,tx}_errors statistics
ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init()
netfilter: x_tables: fix LED ID check in led_tg_check()
netfilter: nft_socket: remove WARN_ON_ONCE on maximum cgroup level
selftests: hid: fix typo and exit code
net: enetc: Do not configure preemptible TCs if SIs do not support
ptp: Add error handling for adjfine callback in ptp_clock_adjtime
net/sched: tbf: correct backlog statistic for GSO packets
net: hsr: avoid potential out-of-bound access in fill_frame_info()
bnxt_en: ethtool: Supply ntuple rss context action
net: Fix icmp host relookup triggering ip_rt_bug
ipv6: avoid possible NULL deref in modify_prefix_route()
can: j1939: j1939_session_new(): fix skb reference counting
platform/x86: asus-wmi: Ignore return value when writing thermal policy
net: phy: microchip: Reset LAN88xx PHY to ensure clean link state on LAN7800/7850
net/ipv6: release expired exception dst cached in socket
dccp: Fix memory leak in dccp_feat_change_recv
tipc: Fix use-after-free of kernel socket in cleanup_bearer().
net/smc: initialize close_work early to avoid warning
net/smc: fix LGR and link use-after-free issue
net/qed: allow old cards not supporting "num_images" to work
net: hsr: must allocate more bytes for RedBox support
ice: fix PHY Clock Recovery availability check
ice: fix PHY timestamp extraction for ETH56G
ice: Fix VLAN pruning in switchdev mode
idpf: set completion tag for "empty" bufs associated with a packet
ixgbevf: stop attempting IPSEC offload on Mailbox API 1.5
ixgbe: downgrade logging of unsupported VF API version to debug
ixgbe: Correct BASE-BX10 compliance code
igb: Fix potential invalid memory access in igb_init_module()
netfilter: nft_inner: incorrect percpu area handling under softirq
Revert "udp: avoid calling sock_def_readable() if possible"
net: sched: fix erspan_opt settings in cls_flower
netfilter: ipset: Hold module reference while requesting a module
netfilter: nft_set_hash: skip duplicated elements pending gc run
ethtool: Fix wrong mod state in case of verbose and no_mask bitset
mlxsw: spectrum_acl_flex_keys: Constify struct mlxsw_afk_element_inst
mlxsw: spectrum_acl_flex_keys: Use correct key block on Spectrum-4
geneve: do not assume mac header is set in geneve_xmit_skb()
net/mlx5: HWS: Fix memory leak in mlx5hws_definer_calc_layout
net/mlx5: HWS: Properly set bwc queue locks lock classes
net/mlx5e: SD, Use correct mdev to build channel param
net/mlx5e: Remove workaround to avoid syndrome for internal port
vsock/test: fix failures due to wrong SO_RCVLOWAT parameter
vsock/test: fix parameter types in SO_VM_SOCKETS_* calls
net: avoid potential UAF in default_operstate()
gpio: grgpio: use a helper variable to store the address of ofdev->dev
gpio: grgpio: Add NULL check in grgpio_probe
mmc: mtk-sd: use devm_mmc_alloc_host
mmc: mtk-sd: Fix error handle of probe function
mmc: mtk-sd: fix devm_clk_get_optional usage
mmc: mtk-sd: Fix MMC_CAP2_CRYPTO flag setting
mmc: sd: SDUC Support Recognition
mmc: core: Adjust ACMD22 to SDUC
mmc: core: Use GFP_NOIO in ACMD22
zram: do not mark idle slots that cannot be idle
zram: clear IDLE flag in mark_idle()
ntp: Remove invalid cast in time offset math
f2fs: clean up w/ F2FS_{BLK_TO_BYTES,BTYES_TO_BLK}
f2fs: fix to adjust appropriate length for fiemap
f2fs: fix to requery extent which cross boundary of inquiry
i3c: master: Replace hard code 2 with macro I3C_ADDR_SLOT_STATUS_BITS
i3c: master: Extend address status bit to 4 and add I3C_ADDR_SLOT_EXT_DESIRED
i3c: master: Fix dynamic address leak when 'assigned-address' is present
drm/amd/display: calculate final viewport before TAP optimization
drm/amd/display: Ignore scalar validation failure if pipe is phantom
scsi: ufs: core: Always initialize the UIC done completion
scsi: ufs: core: Add ufshcd_send_bsg_uic_cmd() for UFS BSG
bpf, vsock: Fix poll() missing a queue
bpf, vsock: Invoke proto::close on close()
xsk: always clear DMA mapping information when unmapping the pool
bpftool: fix potential NULL pointer dereferencing in prog_dump()
drm/sti: Add __iomem for mixer_dbg_mxn's parameter
tcp_bpf: Fix the sk_mem_uncharge logic in tcp_bpf_sendmsg
ALSA: seq: ump: Fix seq port updates per FB info notify
ALSA: usb-audio: Notify xrun for low-latency mode
tools: Override makefile ARCH variable if defined, but empty
spi: mpc52xx: Add cancel_work_sync before module remove
ASoC: SOF: ipc3-topology: Convert the topology pin index to ALH dai index
ASoC: SOF: ipc3-topology: fix resource leaks in sof_ipc3_widget_setup_comp_dai()
pmdomain: core: Add missing put_device()
pmdomain: core: Fix error path in pm_genpd_init() when ida alloc fails
nvme: don't apply NVME_QUIRK_DEALLOCATE_ZEROES when DSM is not supported
x86/pkeys: Change caller of update_pkru_in_sigframe()
x86/pkeys: Ensure updated PKRU value is XRSTOR'd
bpf: Ensure reg is PTR_TO_STACK in process_iter_arg
irqchip/stm32mp-exti: CONFIG_STM32MP_EXTI should not default to y when compile-testing
drivers/virt: pkvm: Don't fail ioremap() call if MMIO_GUARD fails
bpf: Don't mark STACK_INVALID as STACK_MISC in mark_stack_slot_misc
bpf: Fix narrow scalar spill onto 64-bit spilled scalar slots
nvme-fabrics: handle zero MAXCMD without closing the connection
nvme-tcp: fix the memleak while create new ctrl failed
nvme-rdma: unquiesce admin_q before destroy it
scsi: sg: Fix slab-use-after-free read in sg_release()
scsi: scsi_debug: Fix hrtimer support for ndelay
ASoC: mediatek: mt8188-mt6359: Remove hardcoded dmic codec
drm/v3d: Enable Performance Counters before clearing them
ocfs2: free inode when ocfs2_get_init_inode() fails
scatterlist: fix incorrect func name in kernel-doc
iio: magnetometer: yas530: use signed integer type for clamp limits
smb: client: fix potential race in cifs_put_tcon()
bpf: Handle BPF_EXIST and BPF_NOEXIST for LPM trie
bpf: Remove unnecessary kfree(im_node) in lpm_trie_update_elem
bpf: Handle in-place update for full LPM trie correctly
bpf: Fix exact match conditions in trie_get_next_key()
x86/CPU/AMD: WARN when setting EFER.AUTOIBRS if and only if the WRMSR fails
rust: allow `clippy::needless_lifetimes`
HID: i2c-hid: Revert to using power commands to wake on resume
HID: wacom: fix when get product name maybe null pointer
LoongArch: Add architecture specific huge_pte_clear()
LoongArch: KVM: Protect kvm_check_requests() with SRCU
ksmbd: fix Out-of-Bounds Read in ksmbd_vfs_stream_read
ksmbd: fix Out-of-Bounds Write in ksmbd_vfs_stream_write
watchdog: rti: of: honor timeout-sec property
can: dev: can_set_termination(): allow sleeping GPIOs
can: mcp251xfd: mcp251xfd_get_tef_len(): work around erratum DS80000789E 6.
tracing: Fix cmp_entries_dup() to respect sort() comparison rules
net :mana :Request a V2 response version for MANA_QUERY_GF_STAT
iommufd: Fix out_fput in iommufd_fault_alloc()
arm64: mm: Fix zone_dma_limit calculation
arm64: Ensure bits ASID[15:8] are masked out when the kernel uses 8-bit ASIDs
arm64: ptrace: fix partial SETREGSET for NT_ARM_TAGGED_ADDR_CTRL
arm64: ptrace: fix partial SETREGSET for NT_ARM_FPMR
arm64: ptrace: fix partial SETREGSET for NT_ARM_POE
ALSA: usb-audio: Fix a DMA to stack memory bug
ALSA: usb-audio: Add extra PID for RME Digiface USB
ALSA: hda/realtek: fix micmute LEDs don't work on HP Laptops
ALSA: usb-audio: add mixer mapping for Corsair HS80
ALSA: hda/realtek: Enable mute and micmute LED on HP ProBook 430 G8
ALSA: hda/realtek: Add support for Samsung Galaxy Book3 360 (NP730QFG)
scsi: qla2xxx: Fix abort in bsg timeout
scsi: qla2xxx: Fix NVMe and NPIV connect issue
scsi: qla2xxx: Supported speed displayed incorrectly for VPorts
scsi: qla2xxx: Fix use after free on unload
scsi: qla2xxx: Remove check req_sg_cnt should be equal to rsp_sg_cnt
scsi: ufs: core: sysfs: Prevent div by zero
scsi: ufs: core: Cancel RTC work during ufshcd_remove()
scsi: ufs: qcom: Only free platform MSIs when ESI is enabled
scsi: ufs: pltfrm: Disable runtime PM during removal of glue drivers
scsi: ufs: core: Add missing post notify for power mode change
nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry()
fs/smb/client: avoid querying SMB2_OP_QUERY_WSL_EA for SMB3 POSIX
fs/smb/client: Implement new SMB3 POSIX type
fs/smb/client: cifs_prime_dcache() for SMB3 POSIX reparse points
smb3.1.1: fix posix mounts to older servers
io_uring: Change res2 parameter type in io_uring_cmd_done
bcache: revert replacing IS_ERR_OR_NULL with IS_ERR again
Revert "readahead: properly shorten readahead when falling back to do_page_cache_ra()"
pmdomain: imx: gpcv2: Adjust delay after power up handshake
selftests/damon: add _damon_sysfs.py to TEST_FILES
selftest: hugetlb_dio: fix test naming
cacheinfo: Allocate memory during CPU hotplug if not done from the primary CPU
x86/cacheinfo: Delete global num_cache_leaves
drm/amdkfd: hard-code cacheline for gc943,gc944
drm/dp_mst: Fix MST sideband message body length check
drm/amdkfd: add MEC version that supports no PCIe atomics for GFX12
drm/amd/pm: fix and simplify workload handling
drm/dp_mst: Verify request type in the corresponding down message reply
drm/dp_mst: Fix resetting msg rx state after topology removal
drm/amd/display: Correct prefetch calculation
drm/amd/display: Limit VTotal range to max hw cap minus fp
drm/amd/display: Add a left edge pixel if in YCbCr422 or YCbCr420 and odm
drm/amdgpu/hdp6.0: do a posting read when flushing HDP
drm/amdgpu/hdp4.0: do a posting read when flushing HDP
drm/amdgpu/hdp5.0: do a posting read when flushing HDP
drm/amdgpu/hdp7.0: do a posting read when flushing HDP
drm/amdgpu/hdp5.2: do a posting read when flushing HDP
modpost: Add .irqentry.text to OTHER_SECTIONS
x86/kexec: Restore GDT on return from ::preserve_context kexec
bpf: fix OOB devmap writes when deleting elements
dma-buf: fix dma_fence_array_signaled v4
dma-fence: Fix reference leak on fence merge failure path
dma-fence: Use kernel's sort for merging fences
xsk: fix OOB map writes when deleting elements
regmap: detach regmap from dev on regmap_exit
arch_numa: Restore nid checks before registering a memblock with a node
mmc: sdhci-pci: Add DMI quirk for missing CD GPIO on Vexia Edu Atla 10 tablet
mmc: core: Further prevent card detect during shutdown
x86/cpu: Add Lunar Lake to list of CPUs with a broken MONITOR implementation
ocfs2: update seq_file index in ocfs2_dlm_seq_next
stackdepot: fix stack_depot_save_flags() in NMI context
lib: stackinit: hide never-taken branch from compiler
sched/numa: fix memory leak due to the overwritten vma->numab_state
kasan: make report_lock a raw spinlock
mm/gup: handle NULL pages in unpin_user_pages()
mm/mempolicy: fix migrate_to_node() assuming there is at least one VMA in a MM
x86/cpu/topology: Remove limit of CPUs due to disabled IO/APIC
x86/mm: Add _PAGE_NOPTISHADOW bit to avoid updating userspace page tables
mm/damon: fix order of arguments in damos_before_apply tracepoint
mm: memcg: declare do_memsw_account inline
mm: open-code PageTail in folio_flags() and const_folio_flags()
mm: open-code page_folio() in dump_page()
mm: fix vrealloc()'s KASAN poisoning logic
mm: respect mmap hint address when aligning for THP
scsi: ufs: pltfrm: Drop PM runtime reference count after ufshcd_remove()
memblock: allow zero threshold in validate_numa_converage()
rust: enable arbitrary_self_types and remove `Receiver`
s390/pci: Sort PCI functions prior to creating virtual busses
s390/pci: Use topology ID for multi-function devices
s390/pci: Ignore RID for isolated VFs
epoll: annotate racy check
kselftest/arm64: Log fp-stress child startup errors to stdout
s390/cpum_sf: Handle CPU hotplug remove during sampling
block: RCU protect disk->conv_zones_bitmap
btrfs: don't take dev_replace rwsem on task already holding it
btrfs: avoid unnecessary device path update for the same device
btrfs: canonicalize the device path before adding it
btrfs: do not clear read-only when adding sprout device
kselftest/arm64: Don't leak pipe fds in pac.exec_sign_all()
ext4: partial zero eof block on unaligned inode size extension
crypto: ecdsa - Avoid signed integer overflow on signature decoding
kcsan: Turn report_filterlist_lock into a raw_spinlock
hwmon: (nct6775) Add 665-ACE/600M-CL to ASUS WMI monitoring list
ACPI: x86: Make UART skip quirks work on PCI UARTs without an UID
ACPI: x86: Add adev NULL check to acpi_quirk_skip_serdev_enumeration()
ACPI: video: force native for Apple MacbookPro11,2 and Air7,2
perf/x86/amd: Warn only on new bits set
cleanup: Adjust scoped_guard() macros to avoid potential warning
iio: magnetometer: fix if () scoped_guard() formatting
timekeeping: Always check for negative motion
gpio: free irqs that are still requested when the chip is being removed
spi: spi-fsl-lpspi: Adjust type of scldiv
soc: qcom: llcc: Use designated initializers for LLC settings
HID: add per device quirk to force bind to hid-generic
firmware: qcom: scm: Allow QSEECOM on Lenovo Yoga Slim 7x
soc: qcom: pd-mapper: Add QCM6490 PD maps
media: uvcvideo: RealSense D421 Depth module metadata
media: uvcvideo: Add a quirk for the Kaiweets KTI-W02 infrared camera
media: uvcvideo: Force UVC version to 1.0a for 0408:4033
media: cx231xx: Add support for Dexatek USB Video Grabber 1d19:6108
mmc: core: Add SD card quirk for broken poweroff notification
mmc: sdhci-esdhc-imx: enable quirks SDHCI_QUIRK_NO_LED
firmware: qcom: scm: Allow QSEECOM on Dell XPS 13 9345
soc: imx8m: Probe the SoC driver as platform driver
regmap: maple: Provide lockdep (sub)class for maple tree's internal lock
selftests/resctrl: Protect against array overflow when reading strings
sched_ext: add a missing rcu_read_lock/unlock pair at scx_select_cpu_dfl()
HID: magicmouse: Apple Magic Trackpad 2 USB-C driver support
drm/xe/pciids: separate RPL-U and RPL-P PCI IDs
drm/xe/pciids: separate ARL and MTL PCI IDs
drm/vc4: hdmi: Avoid log spam for audio start failure
drm/vc4: hvs: Set AXI panic modes for the HVS
drm/xe/pciids: Add PVC's PCI device ID macros
wifi: rtw88: use ieee80211_purge_tx_queue() to purge TX skb
drm/xe/pciid: Add new PCI id for ARL
drm: panel-orientation-quirks: Add quirk for AYA NEO 2 model
drm: panel-orientation-quirks: Add quirk for AYA NEO Founder edition
drm: panel-orientation-quirks: Add quirk for AYA NEO GEEK
drm/bridge: it6505: Enable module autoloading
drm/mcde: Enable module autoloading
wifi: rtw89: check return value of ieee80211_probereq_get() for RNR
drm/amd/display: Fix out-of-bounds access in 'dcn21_link_encoder_create'
drm/radeon/r600_cs: Fix possible int overflow in r600_packet3_check()
ASoC: Intel: sof_rt5682: Add HDMI-In capture with rt5682 support for MTL.
dlm: fix possible lkb_resource null dereference
drm/amd/display: skip disable CRTC in seemless bootup case
drm/amd/display: Fix garbage or black screen when resetting otg
drm/amd/display: disable SG displays on cyan skillfish
drm/xe/ptl: L3bank mask is not available on the media GT
drm/xe/xe3: Add initial set of workarounds
drm/display: Fix building with GCC 15
ALSA: hda: Use own quirk lookup helper
ALSA: hda/conexant: Use the new codec SSID matching
ALSA: hda/realtek: Use codec SSID matching for Lenovo devices
r8169: don't apply UDP padding quirk on RTL8126A
samples/bpf: Fix a resource leak
wifi: ath12k: fix atomic calls in ath12k_mac_op_set_bitrate_mask()
accel/qaic: Add AIC080 support
drm/amd/display: Full exit out of IPS2 when all allow signals have been cleared
net: fec_mpc52xx_phy: Use %pa to format resource_size_t
net: ethernet: fs_enet: Use %pa to format resource_size_t
net/sched: cbs: Fix integer overflow in cbs_set_port_rate()
af_packet: avoid erroring out after sock_init_data() in packet_create()
Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create()
Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc()
net: af_can: do not leave a dangling sk pointer in can_create()
net: ieee802154: do not leave a dangling sk pointer in ieee802154_create()
net: inet: do not leave a dangling sk pointer in inet_create()
net: inet6: do not leave a dangling sk pointer in inet6_create()
wifi: ath10k: avoid NULL pointer error during sdio remove
wifi: ath5k: add PCI ID for SX76X
wifi: ath5k: add PCI ID for Arcadyan devices
fanotify: allow reporting errors on failure to open fd
bpf: Prevent tailcall infinite loop caused by freplace
ASoC: sdw_utils: Add support for exclusion DAI quirks
ASoC: sdw_utils: Add a quirk to allow the cs42l43 mic DAI to be ignored
ASoC: Intel: sof_sdw: Add quirk for cs42l43 system using host DMICs
ASoC: Intel: sof_sdw: Add quirks for some new Lenovo laptops
drm/xe/guc/ct: Flush g2h worker in case of g2h response timeout
drm/panel: simple: Add Microchip AC69T88A LVDS Display panel
net: sfp: change quirks for Alcatel Lucent G-010S-P
net: stmmac: Programming sequence for VLAN packets with split header
drm/sched: memset() 'job' in drm_sched_job_init()
drm/amd/display: Adding array index check to prevent memory corruption
drm/amdgpu/gfx9: Add cleaner shader for GFX9.4.2
drm/amdgpu: clear RB_OVERFLOW bit when enabling interrupts for vega20_ih
drm/amdgpu: Dereference the ATCS ACPI buffer
netlink: specs: Add missing bitset attrs to ethtool spec
drm/amdgpu: refine error handling in amdgpu_ttm_tt_pin_userptr
ASoC: sdw_utils: Add quirk to exclude amplifier function
ASoC: Intel: soc-acpi-intel-arl-match: Add rt722 and rt1320 support
drm/amd/display: Fix underflow when playing 8K video in full screen mode
mptcp: annotate data-races around subflow->fully_established
dma-debug: fix a possible deadlock on radix_lock
jfs: array-index-out-of-bounds fix in dtReadFirst
jfs: fix shift-out-of-bounds in dbSplit
jfs: fix array-index-out-of-bounds in jfs_readdir
jfs: add a check to prevent array-index-out-of-bounds in dbAdjTree
fsl/fman: Validate cell-index value obtained from Device Tree
net/tcp: Add missing lockdep annotations for TCP-AO hlist traversals
drm/panic: Add ABGR2101010 support
drm/amd/display: Remove hw w/a toggle if on DP2/HPO
drm/amd/display: parse umc_info or vram_info based on ASIC
drm/amd/display: Prune Invalid Modes For HDMI Output
drm/amdgpu: skip amdgpu_device_cache_pci_state under sriov
virtio-net: fix overflow inside virtnet_rq_alloc
ALSA: usb-audio: Make mic volume workarounds globally applicable
drm/amdgpu: set the right AMDGPU sg segment limitation
wifi: ipw2x00: libipw_rx_any(): fix bad alignment
wifi: brcmfmac: Fix oops due to NULL pointer dereference in brcmf_sdiod_sglist_rw()
bpf: Call free_htab_elem() after htab_unlock_bucket()
mptcp: fix possible integer overflow in mptcp_reset_tout_timer
dsa: qca8k: Use nested lock to avoid splat
i2c: i801: Add support for Intel Panther Lake
Bluetooth: hci_conn: Reduce hci_conn_drop() calls in two functions
Bluetooth: btusb: Add RTL8852BE device 0489:e123 to device tables
Bluetooth: btusb: Add USB HW IDs for MT7920/MT7925
Bluetooth: hci_conn: Use disable_delayed_work_sync
Bluetooth: hci_core: Fix not checking skb length on hci_acldata_packet
Bluetooth: Add new quirks for ATS2851
Bluetooth: Support new quirks for ATS2851
Bluetooth: Set quirks for ATS2851
Bluetooth: btusb: Add new VID/PID 0489/e111 for MT7925
Bluetooth: btusb: Add new VID/PID 0489/e124 for MT7925
Bluetooth: btusb: Add 3 HWIDs for MT7925
ASoC: hdmi-codec: reorder channel allocation list
rocker: fix link status detection in rocker_carrier_init()
net/neighbor: clear error in case strict check is not set
netpoll: Use rcu_access_pointer() in __netpoll_setup
pinctrl: freescale: fix COMPILE_TEST error with PINCTRL_IMX_SCU
rtla: Fix consistency in getopt_long for timerlat_hist
tracing/ftrace: disable preemption in syscall probe
tracing: Use atomic64_inc_return() in trace_clock_counter()
tools/rtla: fix collision with glibc sched_attr/sched_set_attr
rtla/timerlat: Make timerlat_top_cpu->*_count unsigned long long
rtla/timerlat: Make timerlat_hist_cpu->*_count unsigned long long
scsi: hisi_sas: Add cond_resched() for no forced preemption model
scsi: hisi_sas: Create all dump files during debugfs initialization
ring-buffer: Limit time with disabled interrupts in rb_check_pages()
pinmux: Use sequential access to access desc->pinmux data
scsi: ufs: core: Make DMA mask configuration more flexible
iommu/amd: Fix corruption when mapping large pages from 0
bpf: put bpf_link's program when link is safe to be deallocated
scsi: lpfc: Call lpfc_sli4_queue_unset() in restart and rmmod paths
scsi: lpfc: Check SLI_ACTIVE flag in FDMI cmpl before submitting follow up FDMI
scsi: lpfc: Prevent NDLP reference count underflow in dev_loss_tmo callback
clk: qcom: rcg2: add clk_rcg2_shared_floor_ops
clk: qcom: rpmh: add support for SAR2130P
clk: qcom: tcsrcc-sm8550: add SAR2130P support
clk: qcom: dispcc-sm8550: enable support for SAR2130P
clk: qcom: clk-alpha-pll: Add NSS HUAYRA ALPHA PLL support for ipq9574
leds: class: Protect brightness_show() with led_cdev->led_access mutex
scsi: st: Don't modify unknown block number in MTIOCGET
scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device reset
pinctrl: qcom-pmic-gpio: add support for PM8937
pinctrl: qcom: spmi-mpp: Add PM8937 compatible
thermal/drivers/qcom/tsens-v1: Add support for MSM8937 tsens
nvdimm: rectify the illogical code within nd_dax_probe()
smb: client: memcpy() with surrounding object base address
tracing: Fix function name for trampoline
tools/rtla: Enhance argument parsing in timerlat_load.py
verification/dot2: Improve dot parser robustness
mailbox: pcc: Check before sending MCTP PCC response ACK
f2fs: fix f2fs_bug_on when uninstalling filesystem call f2fs_evict_inode.
KMSAN: uninit-value in inode_go_dump (5)
i3c: mipi-i3c-hci: Mask ring interrupts before ring stop request
PCI: qcom: Add support for IPQ9574
PCI: vmd: Add DID 8086:B06F and 8086:B60B for Intel client SKUs
PCI: vmd: Set devices to D0 before enabling PM L1 Substates
PCI: Detect and trust built-in Thunderbolt chips
PCI: starfive: Enable controller runtime PM before probing host bridge
PCI: Add 'reset_subordinate' to reset hierarchy below bridge
PCI: Add ACS quirk for Wangxun FF5xxx NICs
remoteproc: qcom: pas: enable SAR2130P audio DSP support
i3c: Use i3cdev->desc->info instead of calling i3c_device_get_info() to avoid deadlock
f2fs: print message if fscorrupted was found in f2fs_new_node_page()
f2fs: fix to shrink read extent node in batches
f2fs: add a sysfs node to limit max read extent count per-inode
ACPI: x86: Add skip i2c clients quirk for Acer Iconia One 8 A1-840
ACPI: x86: Clean up Asus entries in acpi_quirk_skip_dmi_ids[]
LoongArch: Fix sleeping in atomic context for PREEMPT_RT
fs/ntfs3: Fix warning in ni_fiemap
fs/ntfs3: Fix case when unmarked clusters intersect with zone
regulator: qcom-rpmh: Update ranges for FTSMPS525
usb: chipidea: add CI_HDRC_HAS_SHORT_PKT_LIMIT flag
usb: chipidea: udc: limit usb request length to max 16KB
usb: chipidea: udc: create bounce buffer for problem sglist entries if possible
usb: chipidea: udc: handle USB Error Interrupt if IOC not set
usb: typec: ucsi: Do not call ACPI _DSM method for UCSI read operations
iio: adc: ad7192: properly check spi_get_device_match_data()
iio: light: ltr501: Add LTER0303 to the supported devices
usb: typec: ucsi: glink: be more precise on orientation-aware ports
ASoC: amd: yc: fix internal mic on Redmi G 2022
drm/amdgpu/vcn: reset fw_shared when VCPU buffers corrupted on vcn v4.0.3
MIPS: Loongson64: DTS: Really fix PCIe port nodes for ls7a
ASoC: amd: yc: Add quirk for microphone on Lenovo Thinkpad T14s Gen 6 21M1CTO1WW
powerpc/prom_init: Fixup missing powermac #size-cells
misc: eeprom: eeprom_93cx6: Add quirk for extra read clock cycle
rtc: cmos: avoid taking rtc_lock for extended period of time
serial: 8250_dw: Add Sophgo SG2044 quirk
Revert "nvme: make keep-alive synchronous operation"
irqchip/gicv3-its: Add workaround for hip09 ITS erratum 162100801
smb: client: don't try following DFS links in cifs_tree_connect()
setlocalversion: work around "git describe" performance
io_uring/tctx: work around xa_store() allocation error issue
scsi: ufs: pltfrm: Dellocate HBA during ufshcd_pltfrm_remove()
drm/xe/devcoredump: Use drm_puts and already cached local variables
drm/xe/devcoredump: Improve section headings and add tile info
drm/xe/devcoredump: Add ASCII85 dump helper function
drm/xe/guc: Copy GuC log prior to dumping
drm/xe/forcewake: Add a helper xe_force_wake_ref_has_domain()
drm/xe/devcoredump: Update handling of xe_force_wake_get return
drm/amd/display: Add option to retrieve detile buffer size
sched: fix warning in sched_setaffinity
sched/core: Remove the unnecessary need_resched() check in nohz_csd_func()
sched/fair: Check idle_cpu() before need_resched() to detect ilb CPU turning busy
sched/core: Prevent wakeup of ksoftirqd during idle load balance
sched/deadline: Fix warning in migrate_enable for boosted tasks
btrfs: drop unused parameter options from open_ctree()
btrfs: drop unused parameter data from btrfs_fill_super()
btrfs: fix mount failure due to remount races
btrfs: fix missing snapshot drew unlock when root is dead during swap activation
clk: en7523: Initialize num before accessing hws in en7523_register_clocks()
tracing/eprobe: Fix to release eprobe when failed to add dyn_event
x86: Fix build regression with CONFIG_KEXEC_JUMP enabled
Revert "unicode: Don't special case ignorable code points"
vfio/mlx5: Align the page tracking max message size with the device capability
selftests/ftrace: adjust offset for kprobe syntax error test
KVM: x86/mmu: Ensure that kvm_release_pfn_clean() takes exact pfn from kvm_faultin_pfn()
jffs2: Prevent rtime decompress memory corruption
jffs2: Fix rtime decompressor
media: ipu6: use the IPU6 DMA mapping APIs to do mapping
ocfs2: Revert "ocfs2: fix the la space leak when unmounting an ocfs2 volume"
net/mlx5: unique names for per device caches
ASoC: Intel: avs: Fix return status of avs_pcm_hw_constraints_init()
drm/amdgpu: rework resume handling for display (v2)
ALSA: hda: Fix build error without CONFIG_SND_DEBUG
Revert "drm/amd/display: parse umc_info or vram_info based on ASIC"
s390/pci: Fix leak of struct zpci_dev when zpci_add_device() fails
ALSA: hda/realtek: Fix spelling mistake "Firelfy" -> "Firefly"
timekeeping: Remove CONFIG_DEBUG_TIMEKEEPING
clocksource: Make negative motion detection more robust
softirq: Allow raising SCHED_SOFTIRQ from SMP-call-function on RT kernel
Linux 6.12.5
Change-Id: If1b834954ed2ee1a16886f9a9909c6ca62d93b6c
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
[ Upstream commit 522249f05c5551aec9ec0ba9b6438f1ec19c138d ]
When working in "fd mode", fanotify_read() needs to open an fd
from a dentry to report event->fd to userspace.
Opening an fd from dentry can fail for several reasons.
For example, when tasks are gone and we try to open their
/proc files or we try to open a WRONLY file like in sysfs
or when trying to open a file that was deleted on the
remote network server.
Add a new flag FAN_REPORT_FD_ERROR for fanotify_init().
For a group with FAN_REPORT_FD_ERROR, we will send the
event with the error instead of the open fd, otherwise
userspace may not get the error at all.
For an overflow event, we report -EBADF to avoid confusing FAN_NOFD
with -EPERM. Similarly for pidfd open errors we report either -ESRCH
or the open error instead of FAN_NOPIDFD and FAN_EPIDFD.
In any case, userspace will not know which file failed to
open, so add a debug print for further investigation.
Reported-by: Krishna Vivek Vitta <kvitta@microsoft.com>
Link: https://lore.kernel.org/linux-fsdevel/SI2P153MB07182F3424619EDDD1F393EED46D2@SI2P153MB0718.APCP153.PROD.OUTLOOK.COM/
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Link: https://patch.msgid.link/20241003142922.111539-1-amir73il@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
GKI (arm64) relevant 159 out of 815 changes, affecting 226 files +2434/-822
a11e7e3d2a arm64: probes: Disable kprobes/uprobes on MOPS instructions [2 files, +6/-2]
78de864e8a block/fs: Pass an iocb to generic_atomic_write_valid() [3 files, +7/-7]
cfe3e04e9a fs/block: Check for IOCB_DIRECT in generic_atomic_write_valid() [3 files, +19/-14]
63dfd728b3 brd: defer automatic disk creation until module initialization succeeds [1 file, +44/-22]
26cc5063e3 ext4: avoid remount errors with 'abort' mount option [1 file, +8/-3]
fb83b093f7 initramfs: avoid filename buffer overrun [1 file, +15/-0]
de56fa09a0 arm64: Expose ID_AA64ISAR1_EL1.XS to sanitised feature consumers [1 file, +1/-0]
582d9ed999 nvme-pci: fix freeing of the HMB descriptor table [1 file, +9/-7]
8ae5e37357 loop: fix type of block size [1 file, +3/-3]
7044259018 block: take chunk_sectors into account in bio_split_write_zeroes [1 file, +23/-12]
731d5bdc74 block: fix bio_split_rw_at to take zone_write_granularity into account [1 file, +9/-1]
61832ee7fa ext4: fix race in buffer_head read fault injection [10 files, +29/-29]
9abae59243 nvme-pci: reverse request order in nvme_queue_rqs [1 file, +17/-22]
475404eac5 virtio_blk: reverse request order in virtio_queue_rqs [1 file, +21/-25]
d01d9005fb thermal: core: Initialize thermal zones before registering them [1 file, +1/-1]
933ef9360a thermal: core: Rearrange PM notification code [1 file, +46/-42]
f52dc3c757 thermal: core: Represent suspend-related thermal zone flags as bits [2 files, +12/-10]
39a5ad6b63 thermal: core: Mark thermal zones as initializing to start with [2 files, +14/-3]
79cb9952e1 thermal: core: Fix race between zone registration and system suspend [1 file, +16/-2]
5ced426d97 rcu/kvfree: Fix data-race in __mod_timer / kvfree_call_rcu [1 file, +12/-2]
94f4e7b0eb cleanup: Remove address space of returned pointer [1 file, +2/-2]
5c3a9f6f7f time: Partially revert cleanup on msecs_to_jiffies() documentation [1 file, +1/-1]
b62a8825d3 time: Fix references to _msecs_to_jiffies() handling of values [2 files, +2/-2]
1dfa6c5200 timers: Add missing READ_ONCE() in __run_timer_base() [1 file, +2/-1]
8dbd7603e4 kcsan, seqlock: Fix incorrect assumption in read_seqbegin() [1 file, +1/-11]
0916201308 sched/ext: Remove sched_fork() hack [2 files, +1/-7]
351bb7f9ec soc: qcom: geni-se: fix array underflow in geni_se_clk_tbl_get() [1 file, +2/-1]
c365c1456e efi/libstub: fix efi_parse_options() ignoring the default command line [1 file, +1/-1]
30e42ac0bd tpm: fix signed/unsigned bug when checking event logs [1 file, +9/-8]
dd6ade970d Revert "cgroup: Fix memory leak caused by missing cgroup_bpf_offline" [1 file, +1/-3]
f390525e49 cgroup/bpf: only cgroup v2 can be attached by bpf programs [1 file, +11/-6]
a5b7bc2747 regmap: irq: Set lockdep class for hierarchical IRQ domains [1 file, +4/-0]
9beaff47bc firmware: arm_scpi: Check the DVFS OPP count returned by the firmware [1 file, +3/-0]
e369246067 pwm: Assume a disabled PWM to emit a constant inactive output [1 file, +7/-3]
f9aaa841ac drm/mm: Mark drm_mm_interval_tree*() functions with __maybe_unused [1 file, +1/-1]
4d8621151b bpf, arm64: Remove garbage frame for struct_ops trampoline [1 file, +31/-16]
aa51be3fa9 bpf: Tighten tail call checks for lingering locks, RCU, preempt_disable [1 file, +15/-0]
3634d4a310 bpf: Mark raw_tp arguments with PTR_MAYBE_NULL [4 files, +87/-9]
e883c475c4 drm: use ATOMIC64_INIT() for atomic64_t [1 file, +1/-1]
bc23584768 netlink: typographical error in nlmsg_type constants definition [1 file, +1/-1]
ce06c450ac bpf, sockmap: Several fixes to bpf_msg_push_data [1 file, +33/-20]
275a9f3ef8 bpf, sockmap: Several fixes to bpf_msg_pop_data [1 file, +9/-6]
08baa3f0a1 bpf, sockmap: Fix sk_msg_reset_curr [1 file, +9/-11]
0e4c6faaef ipv6: release nexthop on device removal [1 file, +3/-3]
36ede57f0c bpf: Allow return values 0 and 1 for kprobe session [1 file, +9/-0]
9ff1b95ccd bpf: Force uprobe bpf program to always return 0 [1 file, +2/-3]
34a949e7a0 ipv6: Fix soft lockups in fib6_select_path under high next hop churn [4 files, +297/-19]
9c44c06123 bpf: Use function pointers count as struct_ops links count [1 file, +25/-10]
449b1a7178 bpf: Add kernel symbol for struct_ops trampoline [4 files, +89/-5]
3397001cfa Bluetooth: btbcm: fix missing of_node_put() in btbcm_get_board_name() [1 file, +1/-3]
a58d0f5dac Bluetooth: ISO: Use kref to track lifetime of iso_conn [1 file, +71/-17]
67ead8f86a Bluetooth: ISO: Do not emit LE PA Create Sync if previous is pending [4 files, +139/-40]
91d19383b7 Bluetooth: ISO: Do not emit LE BIG Create Sync if previous is pending [5 files, +125/-16]
1360e5b6ce Bluetooth: ISO: Send BIG Create Sync via hci_sync [2 files, +25/-1]
7b277bd569 Bluetooth: fix use-after-free in device_for_each_child() [1 file, +4/-11]
d5d346deb6 xsk: Free skb when TX metadata options are invalid [1 file, +6/-5]
5036f2f024 erofs: fix file-backed mounts over FUSE [2 files, +7/-4]
679d8537e5 erofs: fix blksize < PAGE_SIZE for file-backed mounts [1 file, +5/-1]
daaf68fef4 erofs: handle NONHEAD !delta[1] lclusters gracefully [1 file, +9/-8]
6b8b9d9b06 netpoll: Use rcu_access_pointer() in netpoll_poll_lock [1 file, +1/-1]
f84c5ef6ca bpf: fix recursive lock when verdict program return SK_PASS [1 file, +2/-2]
89933f8ab3 unicode: Fix utf8_load() error path [1 file, +1/-1]
b746a3afa2 trace/trace_event_perf: remove duplicate samples on the first tracepoint event [1 file, +6/-0]
e691826a3d kasan: move checks to do_strncpy_from_user [1 file, +3/-2]
843d366ff1 zram: fix NULL pointer in comp_algorithm_show() [1 file, +2/-3]
fe6fae61f3 PCI: Fix reset_method_store() memory leak [1 file, +3/-2]
a26ace3c6e f2fs: compress: fix inconsistent update of i_blocks in release_compress_blocks and reserve_compress_blocks [1 file, +1/-1]
9e11b1d5fd f2fs: fix null-ptr-deref in f2fs_submit_page_bio() [1 file, +6/-6]
2bc07714dc virtiofs: use pages instead of pointer for kernel direct IO [3 files, +50/-19]
c31c7b81c1 i3c: master: Remove i3c_dev_disable_ibi_locked(olddev) on device hotjoin [1 file, +9/-4]
9b57a3f7e3 f2fs: fix the wrong f2fs_bug_on condition in f2fs_do_replace_block [1 file, +1/-1]
abfd2c13ba f2fs: check curseg->inited before write_sum_page in change_curseg [1 file, +2/-1]
5e69964251 f2fs: Fix not used variable 'index' [1 file, +2/-2]
801092a2c9 f2fs: fix to avoid potential deadlock in f2fs_record_stop_reason() [3 files, +9/-9]
a16e6f7966 PCI: qcom: Enable MSI interrupts together with Link up if 'Global IRQ' is supported [1 file, +3/-1]
c631207897 f2fs: fix race in concurrent f2fs_stop_gc_thread [1 file, +6/-3]
a10cc033b2 f2fs: fix to map blocks correctly for direct write [1 file, +2/-1]
bbe48e47b9 f2fs: fix to avoid forcing direct write to use buffered IO on inline_data inode [1 file, +5/-1]
45438da843 f2fs: fix to do cast in F2FS_{BLK_TO_BYTES, BTYES_TO_BLK} to avoid overflow [2 files, +4/-4]
f7f7f22dbb power: supply: core: Remove might_sleep() from power_supply_put() [1 file, +0/-2]
28af028a71 netlink: fix false positive warning in extack during dumps [1 file, +11/-10]
ad6e5bdca3 exfat: fix file being changed by unaligned direct write [1 file, +10/-0]
a487cc8986 net/l2tp: fix warning in l2tp_exit_net found by syzbot [1 file, +19/-3]
cb74207ef9 net/ipv6: delete temporary address if mngtmpaddr is removed or unmanaged [1 file, +29/-12]
87819234aa Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync [1 file, +9/-2]
cac34e4428 Bluetooth: MGMT: Fix possible deadlocks [1 file, +18/-9]
6d84502860 tcp: Fix use-after-free of nreq in reqsk_timer_handler(). [1 file, +1/-1]
ead7c1263e ip6mr: fix tables suspicious RCU usage [1 file, +27/-11]
14367e7170 usb: gadget: uvc: wake pump everytime we update the free list [1 file, +4/-0]
f380f895db firmware_loader: Fix possible resource leak in fw_log_firmware_info() [1 file, +2/-3]
98b8725630 f2fs: fix fiemap failure issue when page size is 16KB [1 file, +1/-21]
d716851d0a net_sched: sch_fq: don't follow the fast path if Tx is behind now [1 file, +6/-0]
b521b53ac6 ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices [1 file, +21/-6]
096bb5b43e ALSA: usb-audio: Fix out of bounds reads when finding clock sources [1 file, +23/-1]
ec56ada623 ext4: supress data-race warnings in ext4_free_inodes_{count,set}() [1 file, +4/-4]
ad34d9c738 ext4: fix FS_IOC_GETFSMAP handling [3 files, +68/-5]
f594a5683a KVM: arm64: vgic-v3: Sanitise guest writes to GICR_INVLPIR [1 file, +6/-1]
8b6916f4cf KVM: arm64: Ignore PMCNTENSET_EL0 while checking for overflow status [1 file, +0/-1]
d0571c3add KVM: arm64: Don't retire aborted MMIO instruction [1 file, +30/-2]
eabd7ef140 KVM: arm64: vgic-its: Clear ITE when DISCARD frees an ITE [1 file, +5/-1]
fe425d5239 KVM: arm64: Get rid of userspace_irqchip_in_use [3 files, +4/-19]
46018a04c5 KVM: arm64: vgic-its: Add a data length check in vgic_its_save_* [2 files, +31/-12]
1059f1e5f5 KVM: arm64: vgic-its: Clear DTE when MAPD unmaps a device [1 file, +4/-2]
69d2ceac11 PCI: Fix use-after-free of slot->bus on hot remove [1 file, +3/-1]
a6b283526b fsnotify: fix sending inotify event with unexpected filename [1 file, +13/-10]
83af1cfa10 fsnotify: Fix ordering of iput() and watched_objects decrement [1 file, +9/-3]
53bbfa6896 tty: ldsic: fix tty_ldisc_autoload sysctl's proc_handler [1 file, +1/-1]
88232a223a locking/lockdep: Avoid creating new name string literals in lockdep_set_subclass() [1 file, +1/-1]
a4fc6966d8 fcntl: make F_DUPFD_QUERY associative [1 file, +3/-0]
c500b0cca2 exfat: fix uninit-value in __exfat_get_dentry_set [1 file, +1/-0]
3ddd1cb2b4 exfat: fix out-of-bounds access of directory entries [1 file, +16/-4]
9258c9ed32 xhci: Fix control transfer error on Etron xHCI host [1 file, +14/-0]
218796e95a xhci: Combine two if statements for Etron xHCI host [1 file, +2/-6]
a92cd42097 xhci: Don't perform Soft Retry for Etron xHCI host [1 file, +1/-0]
827f963a0b xhci: Don't issue Reset Device command to Etron xHCI host [3 files, +21/-0]
33209e6f29 Bluetooth: Fix type of len in rfcomm_sock_getsockopt{,_old}() [1 file, +6/-4]
2637e8c5fb usb: xhci: Limit Stop Endpoint retries [3 files, +27/-4]
61bce2d8ff usb: xhci: Fix TD invalidation under pending Set TR Dequeue [1 file, +13/-5]
6debdd82c3 usb: xhci: Avoid queuing redundant Stop Endpoint commands [3 files, +29/-4]
13111945c2 Revert "fs: don't block i_writecount during exec" [5 files, +49/-14]
0586f12896 Revert "f2fs: remove unreachable lazytime mount option parsing" [1 file, +10/-0]
ca82b37c47 Revert "usb: gadget: composite: fix OS descriptors w_value logic" [1 file, +15/-3]
d222fd21dd io_uring: fix corner case forgetting to vunmap [1 file, +3/-1]
aaa90844af io_uring: check for overflows in io_pin_pages [1 file, +6/-1]
37c2ca4e89 blk-settings: round down io_opt to physical_block_size [1 file, +7/-0]
97b68bda72 spi: Fix acpi deferred irq probe [1 file, +10/-3]
e881c8f0a7 serial: amba-pl011: Fix RX stall when DMA is used [1 file, +5/-0]
1fae444a61 serial: amba-pl011: fix build regression [1 file, +2/-0]
7baf942326 Revert "block, bfq: merge bfq_release_process_ref() into bfq_put_cooperator()" [2 files, +5/-2]
43375e9bb7 block: Prevent potential deadlock in blk_revalidate_disk_zones() [1 file, +10/-4]
4ef8b6f7c4 ublk: fix ublk_ch_mmap() for 64K page size [1 file, +12/-3]
e4d1f38bc0 arm64: tls: Fix context-switching of tpidrro_el0 when kpti is enabled [1 file, +1/-1]
8b25c0a165 block: fix missing dispatching request when queue is started or unquiesced [1 file, +2/-0]
2094bd1b52 block: fix ordering between checking QUEUE_FLAG_QUIESCED request adding [1 file, +34/-13]
4170346747 block: fix ordering between checking BLK_MQ_S_STOPPED request adding [2 files, +19/-0]
aeb420ebdf blk-mq: Make blk_mq_quiesce_tagset() hold the tag list mutex less long [1 file, +2/-1]
28d4191e19 HID: wacom: Interpret tilt data from Intuos Pro BT as signed values [1 file, +2/-2]
343e3e903c netdev-genl: Hold rcu_read_lock in napi_get [1 file, +2/-0]
df225df839 ALSA: rawmidi: Fix kvfree() call in spinlock [1 file, +3/-1]
0c4c9bf5ea ALSA: pcm: Add sanity NULL check for the default mmap fault handler [1 file, +4/-2]
068aab9564 usb: dwc3: ep0: Don't clear ep0 DWC3_EP_TRANSFER_STARTED [1 file, +1/-1]
2f6c3acece usb: dwc3: gadget: Fix checking for number of TRBs left [1 file, +6/-3]
70777a23a5 usb: dwc3: gadget: Fix looping of queued SG entries [1 file, +3/-3]
31e45c09a8 ublk: fix error code for unsupported command [1 file, +1/-1]
9517bc76ff lib: string_helpers: silence snprintf() output truncation warning [1 file, +1/-1]
0a5c8b3fbf f2fs: fix to do sanity check on node blkaddr in truncate_node() [1 file, +10/-0]
e77bce0a8c rtc: check if __rtc_read_time was successful in rtc_timer_do_work() [1 file, +6/-1]
4eaa19c620 nvme/multipath: Fix RCU list traversal to use SRCU primitive [1 file, +14/-7]
9c3d53f113 blk-mq: add non_owner variant of start_freeze/unfreeze queue APIs [2 files, +22/-0]
a6fc2ba1c7 block: model freeze & enter queue as lock for supporting lockdep [5 files, +81/-13]
61092568f2 block: fix uaf for flush rq while iterating tags [2 files, +5/-10]
5e15cc7a1d block: return unsigned int from bdev_io_min [1 file, +1/-1]
5416b76a81 nvme-fabrics: fix kernel crash while shutting down controller [1 file, +5/-0]
d5457349e5 block: Don't allow an atomic write be truncated in blkdev_write_iter() [1 file, +4/-1]
e70c21daad modpost: remove incorrect code in do_eisa_entry() [1 file, +1/-4]
01a853faae block, bfq: fix bfqq uaf in bfq_limit_depth() [1 file, +24/-13]
fbc342372a brd: decrease the number of allocated pages which discarded [1 file, +3/-1]
b12cfcae8a block: always verify unfreeze lock on the owner task [4 files, +61/-10]
6cea47849d block: don't verify IO lock for freeze/unfreeze in elevator_init_mq() [1 file, +8/-2]
Changes in 6.12.2
MAINTAINERS: appoint myself the XFS maintainer for 6.12 LTS
drm/amd/display: Skip Invalid Streams from DSC Policy
drm/amd/display: Fix incorrect DSC recompute trigger
s390/facilities: Fix warning about shadow of global variable
s390/virtio_ccw: Fix dma_parm pointer not set up
efs: fix the efs new mount api implementation
arm64: probes: Disable kprobes/uprobes on MOPS instructions
kselftest/arm64: hwcap: fix f8dp2 cpuinfo name
kselftest/arm64: mte: fix printf type warnings about __u64
kselftest/arm64: mte: fix printf type warnings about longs
block/fs: Pass an iocb to generic_atomic_write_valid()
fs/block: Check for IOCB_DIRECT in generic_atomic_write_valid()
s390/cio: Do not unregister the subchannel based on DNV
s390/pageattr: Implement missing kernel_page_present()
x86/pvh: Call C code via the kernel virtual mapping
brd: defer automatic disk creation until module initialization succeeds
ext4: avoid remount errors with 'abort' mount option
mips: asm: fix warning when disabling MIPS_FP_SUPPORT
s390/cpum_sf: Fix and protect memory allocation of SDBs with mutex
initramfs: avoid filename buffer overrun
arm64: Expose ID_AA64ISAR1_EL1.XS to sanitised feature consumers
kselftest/arm64: Fix encoding for SVE B16B16 test
nvme-pci: fix freeing of the HMB descriptor table
m68k: mvme147: Fix SCSI controller IRQ numbers
m68k: mvme147: Reinstate early console
arm64: fix .data.rel.ro size assertion when CONFIG_LTO_CLANG
acpi/arm64: Adjust error handling procedure in gtdt_parse_timer_block()
loop: fix type of block size
cachefiles: Fix incorrect length return value in cachefiles_ondemand_fd_write_iter()
cachefiles: Fix missing pos updates in cachefiles_ondemand_fd_write_iter()
cachefiles: Fix NULL pointer dereference in object->file
netfs/fscache: Add a memory barrier for FSCACHE_VOLUME_CREATING
block: take chunk_sectors into account in bio_split_write_zeroes
block: fix bio_split_rw_at to take zone_write_granularity into account
s390/syscalls: Avoid creation of arch/arch/ directory
hfsplus: don't query the device logical block size multiple times
ext4: fix race in buffer_head read fault injection
nvme-pci: reverse request order in nvme_queue_rqs
virtio_blk: reverse request order in virtio_queue_rqs
crypto: mxs-dcp - Fix AES-CBC with hardware-bound keys
crypto: caam - Fix the pointer passed to caam_qi_shutdown()
crypto: qat - remove check after debugfs_create_dir()
crypto: qat/qat_420xx - fix off by one in uof_get_name()
crypto: qat/qat_4xxx - fix off by one in uof_get_name()
firmware: google: Unregister driver_info on failure
EDAC/bluefield: Fix potential integer overflow
crypto: qat - remove faulty arbiter config reset
thermal: core: Initialize thermal zones before registering them
thermal: core: Rearrange PM notification code
thermal: core: Represent suspend-related thermal zone flags as bits
thermal: core: Mark thermal zones as initializing to start with
thermal: core: Fix race between zone registration and system suspend
EDAC/fsl_ddr: Fix bad bit shift operations
EDAC/skx_common: Differentiate memory error sources
EDAC/{skx_common,i10nm}: Fix incorrect far-memory error source indicator
crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY
crypto: cavium - Fix the if condition to exit loop after timeout
cpufreq/amd-pstate: Don't update CPPC request in amd_pstate_cpu_boost_update()
amd-pstate: Set min_perf to nominal_perf for active mode performance gov
crypto: hisilicon/qm - disable same error report before resetting
EDAC/igen6: Avoid segmentation fault on module unload
crypto: qat - Fix missing destroy_workqueue in adf_init_aer()
crypto: inside-secure - Fix the return value of safexcel_xcbcmac_cra_init()
sched/cpufreq: Ensure sd is rebuilt for EAS check
doc: rcu: update printed dynticks counter bits
rcu/srcutiny: don't return before reenabling preemption
rcu/kvfree: Fix data-race in __mod_timer / kvfree_call_rcu
rcu/nocb: Fix missed RCU barrier on deoffloading
hwmon: (pmbus/core) clear faults after setting smbalert mask
hwmon: (nct6775-core) Fix overflows seen when writing limit attributes
ACPI: CPPC: Fix _CPC register setting issue
thermal: testing: Use DEFINE_FREE() and __free() to simplify code
thermal: testing: Initialize some variables annoteded with _free()
crypto: caam - add error check to caam_rsa_set_priv_key_form
crypto: bcm - add error check in the ahash_hmac_init function
crypto: cavium - Fix an error handling path in cpt_ucode_load_fw()
rcuscale: Do a proper cleanup if kfree_scale_init() fails
tools/lib/thermal: Make more generic the command encoding function
thermal/lib: Fix memory leak on error in thermal_genl_auto()
x86/unwind/orc: Fix unwind for newly forked tasks
Revert "scripts/faddr2line: Check only two symbols when calculating symbol size"
cleanup: Remove address space of returned pointer
time: Partially revert cleanup on msecs_to_jiffies() documentation
time: Fix references to _msecs_to_jiffies() handling of values
timers: Add missing READ_ONCE() in __run_timer_base()
locking/atomic/x86: Use ALT_OUTPUT_SP() for __alternative_atomic64()
locking/atomic/x86: Use ALT_OUTPUT_SP() for __arch_{,try_}cmpxchg64_emu()
kcsan, seqlock: Support seqcount_latch_t
kcsan, seqlock: Fix incorrect assumption in read_seqbegin()
sched/ext: Remove sched_fork() hack
locking/rt: Add sparse annotation PREEMPT_RT's sleeping locks.
rust: helpers: Avoid raw_spin_lock initialization for PREEMPT_RT
clocksource/drivers:sp804: Make user selectable
clocksource/drivers/timer-ti-dm: Fix child node refcount handling
irqchip/riscv-aplic: Prevent crash when MSI domain is missing
regulator: qcom-smd: make smd_vreg_rpm static
spi: spi-fsl-lpspi: Use IRQF_NO_AUTOEN flag in request_irq()
arm64: dts: qcom: qcs6390-rb3gen2: use modem.mbn for modem DSP
ARM: dts: renesas: genmai: Fix partition size for QSPI NOR Flash
drivers: soc: xilinx: add the missing kfree in xlnx_add_cb_for_suspend()
microblaze: Export xmb_manager functions
arm64: dts: mediatek: mt8188: Fix wrong clock provider in MFG1 power domain
arm64: dts: mediatek: mt8395-genio-1200-evk: Fix dtbs_check error for phy
arm64: dts: mt8195: Fix dtbs_check error for mutex node
arm64: dts: mt8195: Fix dtbs_check error for infracfg_ao node
arm64: dts: mediatek: mt8183-kukui: Disable DPI display interface
arm64: dts: mt8183: Add port node to dpi node
soc: ti: smartreflex: Use IRQF_NO_AUTOEN flag in request_irq()
soc: qcom: geni-se: fix array underflow in geni_se_clk_tbl_get()
arm64: dts: qcom: sm6350: Fix GPU frequencies missing on some speedbins
arm64: dts: qcom: sda660-ifc6560: fix l10a voltage ranges
ARM: dts: microchip: sam9x60: Add missing property atmel,usart-mode
mmc: mmc_spi: drop buggy snprintf()
scripts/kernel-doc: Do not track section counter across processed files
arm64: dts: qcom: x1e80100-slim7x: Drop orientation-switch from USB SS[0-1] QMP PHYs
arm64: dts: qcom: x1e80100-vivobook-s15: Drop orientation-switch from USB SS[0-1] QMP PHYs
openrisc: Implement fixmap to fix earlycon
efi/libstub: fix efi_parse_options() ignoring the default command line
tpm: fix signed/unsigned bug when checking event logs
media: i2c: max96717: clean up on error in max96717_subdev_init()
media: i2c: vgxy61: Fix an error handling path in vgxy61_detect()
media: i2c: ds90ub960: Fix missing return check on ub960_rxport_read call
arm64: dts: mt8183: krane: Fix the address of eeprom at i2c4
arm64: dts: mt8183: kukui: Fix the address of eeprom at i2c4
arm64: dts: qcom: x1e80100: Resize GIC Redistributor register region
kernel-doc: allow object-like macros in ReST output
arm64: dts: ti: k3-am62x-phyboard-lyra: Drop unnecessary McASP AFIFOs
gpio: sloppy-logic-analyzer remove reference to rcu_momentary_dyntick_idle()
arm64: dts: mediatek: mt8173-elm-hana: Add vdd-supply to second source trackpad
arm64: dts: mediatek: mt8188: Fix USB3 PHY port default status
arm64: dts: mediatek: mt8195-cherry: Use correct audio codec DAI
Revert "cgroup: Fix memory leak caused by missing cgroup_bpf_offline"
cgroup/bpf: only cgroup v2 can be attached by bpf programs
regulator: rk808: Restrict DVS GPIOs to the RK808 variant only
power: sequencing: make the QCom PMU pwrseq driver depend on CONFIG_OF
arm64: tegra: p2180: Add mandatory compatible for WiFi node
arm64: dts: rockchip: Remove 'enable-active-low' from two boards
arm64: dts: mt8183: fennel: add i2c2's i2c-scl-internal-delay-ns
arm64: dts: mt8183: burnet: add i2c2's i2c-scl-internal-delay-ns
arm64: dts: mt8183: cozmo: add i2c2's i2c-scl-internal-delay-ns
arm64: dts: mt8183: Damu: add i2c2's i2c-scl-internal-delay-ns
pwm: imx27: Workaround of the pwm output bug when decrease the duty cycle
ARM: dts: cubieboard4: Fix DCDC5 regulator constraints
arm64: dts: ti: k3-j7200: Fix register map for main domain pmx
arm64: dts: ti: k3-j7200: Fix clock ids for MCSPI instances
arm64: dts: ti: k3-j721e: Fix clock IDs for MCSPI instances
arm64: dts: ti: k3-j721s2: Fix clock IDs for MCSPI instances
watchdog: Add HAS_IOPORT dependency for SBC8360 and SBC7240
arm64: dts: qcom: x1e80100: Update C4/C5 residency/exit numbers
dt-bindings: cache: qcom,llcc: Fix X1E80100 reg entries
of/fdt: add dt_phys arg to early_init_dt_scan and early_init_dt_verify
pmdomain: ti-sci: Add missing of_node_put() for args.np
spi: tegra210-quad: Avoid shift-out-of-bounds
spi: zynqmp-gqspi: Undo runtime PM changes at driver exit time
regmap: irq: Set lockdep class for hierarchical IRQ domains
arm64: dts: renesas: hihope: Drop #sound-dai-cells
arm64: dts: imx8mn-tqma8mqnl-mba8mx-usbot: fix coexistence of output-low and output-high in GPIO
arm64: dts: mediatek: mt6358: fix dtbs_check error
arm64: dts: mediatek: mt8183-kukui-jacuzzi: Fix DP bridge supply names
arm64: dts: mediatek: mt8183-kukui-jacuzzi: Add supplies for fixed regulators
selftests/resctrl: Print accurate buffer size as part of MBM results
selftests/resctrl: Fix memory overflow due to unhandled wraparound
selftests/resctrl: Protect against array overrun during iMC config parsing
firmware: arm_scpi: Check the DVFS OPP count returned by the firmware
media: ipu6: Fix DMA and physical address debugging messages for 32-bit
media: ipu6: not override the dma_ops of device in driver
media: ipu6: remove architecture DMA ops dependency in Kconfig
pwm: Assume a disabled PWM to emit a constant inactive output
media: atomisp: Add check for rgby_data memory allocation failure
arm64: dts: rockchip: correct analog audio name on Indiedroid Nova
sched_ext: scx_bpf_dispatch_from_dsq_set_*() are allowed from unlocked context
HID: hyperv: streamline driver probe to avoid devres issues
platform/x86: asus-wmi: Fix inconsistent use of thermal policies
platform/x86/intel/pmt: allow user offset for PMT callbacks
platform/x86: panasonic-laptop: Return errno correctly in show callback
drm/imagination: Convert to use time_before macro
drm/imagination: Use pvr_vm_context_get()
drm/mm: Mark drm_mm_interval_tree*() functions with __maybe_unused
drm/vc4: hvs: Don't write gamma luts on 2711
drm/vc4: hdmi: Avoid hang with debug registers when suspended
drm/vc4: hvs: Fix dlist debug not resetting the next entry pointer
drm/vc4: hvs: Remove incorrect limit from hvs_dlist debugfs function
drm/vc4: hvs: Correct logic on stopping an HVS channel
wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service()
drm/omap: Fix possible NULL dereference
drm/omap: Fix locking in omap_gem_new_dmabuf()
drm/v3d: Appease lockdep while updating GPU stats
wifi: p54: Use IRQF_NO_AUTOEN flag in request_irq()
wifi: mwifiex: Use IRQF_NO_AUTOEN flag in request_irq()
udmabuf: change folios array from kmalloc to kvmalloc
udmabuf: fix vmap_udmabuf error page set
drm/imx/dcss: Use IRQF_NO_AUTOEN flag in request_irq()
drm/imx/ipuv3: Use IRQF_NO_AUTOEN flag in request_irq()
drm/panel: nt35510: Make new commands optional
drm/v3d: Address race-condition in MMU flush
drm/v3d: Flush the MMU before we supply more memory to the binner
drm/amdgpu: Fix JPEG v4.0.3 register write
wifi: ath10k: fix invalid VHT parameters in supported_vht_mcs_rate_nss1
wifi: ath10k: fix invalid VHT parameters in supported_vht_mcs_rate_nss2
wifi: ath12k: Skip Rx TID cleanup for self peer
dt-bindings: vendor-prefixes: Add NeoFidelity, Inc
ASoC: fsl_micfil: fix regmap_write_bits usage
ASoC: dt-bindings: mt6359: Update generic node name and dmic-mode
drm/amdgpu/gfx9: Add Cleaner Shader Deinitialization in gfx_v9_0 Module
ASoC: fsl-asoc-card: Add missing handling of {hp,mic}-dt-gpios
drm/bridge: anx7625: Drop EDID cache on bridge power off
drm/bridge: it6505: Drop EDID cache on bridge power off
libbpf: Fix expected_attach_type set handling in program load callback
libbpf: Fix output .symtab byte-order during linking
selftests/bpf: Fix uprobe_multi compilation error
dlm: fix swapped args sb_flags vs sb_status
wifi: rtl8xxxu: Perform update_beacon_work when beaconing is enabled
ASoC: amd: acp: fix for inconsistent indenting
ASoC: amd: acp: fix for cpu dai index logic
drm/amd/display: fix a memleak issue when driver is removed
wifi: ath12k: fix use-after-free in ath12k_dp_cc_cleanup()
wifi: ath12k: fix one more memcpy size error
libbpf: Add missing per-arch include path
selftests: bpf: Add missing per-arch include path
bpf: Fix the xdp_adjust_tail sample prog issue
selftests/bpf: Fix backtrace printing for selftests crashes
wifi: ath11k: Fix CE offset address calculation for WCN6750 in SSR
selftests/bpf: add missing header include for htons
wifi: cfg80211: check radio iface combination for multi radio per wiphy
ice: consistently use q_idx in ice_vc_cfg_qs_msg()
drm/vc4: hdmi: Increase audio MAI fifo dreq threshold
drm/vc4: Introduce generation number enum
drm/vc4: Match drm_dev_enter and exit calls in vc4_hvs_lut_load
drm/vc4: Match drm_dev_enter and exit calls in vc4_hvs_atomic_flush
drm/vc4: Correct generation check in vc4_hvs_lut_load
libbpf: fix sym_is_subprog() logic for weak global subprogs
accel/ivpu: Prevent recovery invocation during probe and resume
ASoC: rt722-sdca: Remove logically deadcode in rt722-sdca.c
libbpf: never interpret subprogs in .text as entry programs
netdevsim: copy addresses for both in and out paths
drm/bridge: tc358767: Fix link properties discovery
drm/panic: Select ZLIB_DEFLATE for DRM_PANIC_SCREEN_QR_CODE
selftests/bpf: Fix msg_verify_data in test_sockmap
selftests/bpf: Fix txmsg_redir of test_txmsg_pull in test_sockmap
wifi: mwifiex: add missing locking for cfg80211 calls
wifi: wilc1000: Set MAC after operation mode
wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_config_scan()
drm: fsl-dcu: enable PIXCLK on LS1021A
drm: panel: nv3052c: correct spi_device_id for RG35XX panel
drm/msm/dpu: on SDM845 move DSPP_3 to LM_5 block
drm/msm/dpu: drop LM_3 / LM_4 on SDM845
drm/msm/dpu: drop LM_3 / LM_4 on MSM8998
octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_common.c
octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_ethtool.c
octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_flows.c
octeontx2-pf: handle otx2_mbox_get_rsp errors in cn10k.c
octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_dmac_flt.c
octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_dcbnl.c
selftests/bpf: fix test_spin_lock_fail.c's global vars usage
libbpf: move global data mmap()'ing into bpf_object__load()
wifi: rtw89: rename rtw89_vif to rtw89_vif_link ahead for MLO
wifi: rtw89: rename rtw89_sta to rtw89_sta_link ahead for MLO
wifi: rtw89: read bss_conf corresponding to the link
wifi: rtw89: read link_sta corresponding to the link
wifi: rtw89: refactor VIF related func ahead for MLO
wifi: rtw89: refactor STA related func ahead for MLO
wifi: rtw89: tweak driver architecture for impending MLO support
wifi: rtw89: Fix TX fail with A2DP after scanning
wifi: rtw89: unlock on error path in rtw89_ops_unassign_vif_chanctx()
drm/panfrost: Remove unused id_mask from struct panfrost_model
bpf, arm64: Remove garbage frame for struct_ops trampoline
drm/msm/adreno: Use IRQF_NO_AUTOEN flag in request_irq()
drm/msm/gpu: Check the status of registration to PM QoS
drm/xe/hdcp: Fix gsc structure check in fw check status
drm/etnaviv: Request pages from DMA32 zone on addressing_limited
drm/etnaviv: hold GPU lock across perfmon sampling
drm/amd/display: Increase idle worker HPD detection time
drm/amd/display: Reduce HPD Detection Interval for IPS
drm/nouveau/gr/gf100: Fix missing unlock in gf100_gr_chan_new()
drm: zynqmp_kms: Unplug DRM device before removal
drm: xlnx: zynqmp_disp: layer may be null while releasing
wifi: wfx: Fix error handling in wfx_core_init()
wifi: cw1200: Fix potential NULL dereference
drm/msm/dpu: cast crtc_clk calculation to u64 in _dpu_core_perf_calc_clk()
bpf, bpftool: Fix incorrect disasm pc
bpf: Tighten tail call checks for lingering locks, RCU, preempt_disable
drm/vkms: Drop unnecessary call to drm_crtc_cleanup()
drm/amdgpu: Fix the memory allocation issue in amdgpu_discovery_get_nps_info()
drm/amdkfd: Use dynamic allocation for CU occupancy array in 'kfd_get_cu_occupancy()'
bpf: Mark raw_tp arguments with PTR_MAYBE_NULL
drm: use ATOMIC64_INIT() for atomic64_t
netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion
netfilter: nf_tables: must hold rcu read lock while iterating expression type list
netfilter: nf_tables: must hold rcu read lock while iterating object type list
netlink: typographical error in nlmsg_type constants definition
wifi: rtw89: coex: check NULL return of kmalloc in btc_fw_set_monreg()
drm/panfrost: Add missing OPP table refcnt decremental
drm/panthor: introduce job cycle and timestamp accounting
drm/panthor: record current and maximum device clock frequencies
drm/panthor: Fix OPP refcnt leaks in devfreq initialisation
isofs: avoid memory leak in iocharset
selftests/bpf: Add txmsg_pass to pull/push/pop in test_sockmap
selftests/bpf: Fix SENDPAGE data logic in test_sockmap
selftests/bpf: Fix total_bytes in msg_loop_rx in test_sockmap
selftests/bpf: Add push/pop checking for msg_verify_data in test_sockmap
bpf, sockmap: Several fixes to bpf_msg_push_data
bpf, sockmap: Several fixes to bpf_msg_pop_data
bpf, sockmap: Fix sk_msg_reset_curr
ipv6: release nexthop on device removal
selftests: net: really check for bg process completion
wifi: cfg80211: Remove the Medium Synchronization Delay validity check
wifi: iwlwifi: allow fast resume on ax200
wifi: iwlwifi: mvm: tell iwlmei when we finished suspending
drm/amdgpu: fix ACA bank count boundary check error
drm/amdgpu: Fix map/unmap queue logic
drm/amdkfd: Fix wrong usage of INIT_WORK()
bpf: Allow return values 0 and 1 for kprobe session
bpf: Force uprobe bpf program to always return 0
selftests/bpf: skip the timer_lockup test for single-CPU nodes
ipv6: Fix soft lockups in fib6_select_path under high next hop churn
net: rfkill: gpio: Add check for clk_enable()
Revert "wifi: iwlegacy: do not skip frames with bad FCS"
bpf: Use function pointers count as struct_ops links count
bpf: Add kernel symbol for struct_ops trampoline
ALSA: usx2y: Use snd_card_free_when_closed() at disconnection
ALSA: us122l: Use snd_card_free_when_closed() at disconnection
ALSA: caiaq: Use snd_card_free_when_closed() at disconnection
ALSA: 6fire: Release resources at card release
i2c: dev: Fix memory leak when underlying adapter does not support I2C
selftests: netfilter: Fix missing return values in conntrack_dump_flush
Bluetooth: btintel_pcie: Add handshake between driver and firmware
Bluetooth: btintel: Do no pass vendor events to stack
Bluetooth: btmtk: adjust the position to init iso data anchor
Bluetooth: btbcm: fix missing of_node_put() in btbcm_get_board_name()
Bluetooth: ISO: Use kref to track lifetime of iso_conn
Bluetooth: ISO: Do not emit LE PA Create Sync if previous is pending
Bluetooth: ISO: Do not emit LE BIG Create Sync if previous is pending
Bluetooth: ISO: Send BIG Create Sync via hci_sync
Bluetooth: fix use-after-free in device_for_each_child()
xsk: Free skb when TX metadata options are invalid
erofs: fix file-backed mounts over FUSE
erofs: fix blksize < PAGE_SIZE for file-backed mounts
erofs: handle NONHEAD !delta[1] lclusters gracefully
dlm: fix dlm_recover_members refcount on error
eth: fbnic: don't disable the PCI device twice
net: txgbe: remove GPIO interrupt controller
net: txgbe: fix null pointer to pcs
netpoll: Use rcu_access_pointer() in netpoll_poll_lock
wireguard: selftests: load nf_conntrack if not present
bpf: fix recursive lock when verdict program return SK_PASS
unicode: Fix utf8_load() error path
cppc_cpufreq: Use desired perf if feedback ctrs are 0 or unchanged
RDMA/core: Provide rdma_user_mmap_disassociate() to disassociate mmap pages
RDMA/hns: Disassociate mmap pages for all uctx when HW is being reset
pinctrl: renesas: rzg2l: Fix missing return in rzg2l_pinctrl_register()
clk: mediatek: drop two dead config options
trace/trace_event_perf: remove duplicate samples on the first tracepoint event
pinctrl: zynqmp: drop excess struct member description
pinctrl: renesas: Select PINCTRL_RZG2L for RZ/V2H(P) SoC
clk: qcom: videocc-sm8550: depend on either gcc-sm8550 or gcc-sm8650
iommu/s390: Implement blocking domain
scsi: hisi_sas: Enable all PHYs that are not disabled by user during controller reset
powerpc/vdso: Flag VDSO64 entry points as functions
mfd: tps65010: Use IRQF_NO_AUTOEN flag in request_irq() to fix race
mfd: da9052-spi: Change read-mask to write-mask
mfd: intel_soc_pmic_bxtwc: Use IRQ domain for USB Type-C device
mfd: intel_soc_pmic_bxtwc: Use IRQ domain for TMU device
mfd: intel_soc_pmic_bxtwc: Use IRQ domain for PMIC devices
mfd: intel_soc_pmic_bxtwc: Fix IRQ domain names duplication
cpufreq: loongson2: Unregister platform_driver on failure
powerpc/fadump: Refactor and prepare fadump_cma_init for late init
powerpc/fadump: Move fadump_cma_init to setup_arch() after initmem_init()
mtd: hyperbus: rpc-if: Add missing MODULE_DEVICE_TABLE
mtd: rawnand: atmel: Fix possible memory leak
clk: Allow kunit tests to run without OF_OVERLAY enabled
powerpc/mm/fault: Fix kfence page fault reporting
iommu/tegra241-cmdqv: Staticize cmdqv_debugfs_dir
clk: sophgo: avoid integer overflow in sg2042_pll_recalc_rate()
mtd: spi-nor: spansion: Use nor->addr_nbytes in octal DTR mode in RD_ANY_REG_OP
powerpc/pseries: Fix dtl_access_lock to be a rw_semaphore
cpufreq: CPPC: Fix possible null-ptr-deref for cpufreq_cpu_get_raw()
cpufreq: CPPC: Fix possible null-ptr-deref for cppc_get_cpu_cost()
iommu/amd/pgtbl_v2: Take protection domain lock before invalidating TLB
RDMA/hns: Fix an AEQE overflow error caused by untimely update of eq_db_ci
RDMA/hns: Fix flush cqe error when racing with destroy qp
RDMA/hns: Modify debugfs name
RDMA/hns: Use dev_* printings in hem code instead of ibdev_*
RDMA/hns: Fix cpu stuck caused by printings during reset
RDMA/rxe: Fix the qp flush warnings in req
RDMA/bnxt_re: Check cqe flags to know imm_data vs inv_irkey
clk: sunxi-ng: d1: Fix PLL_AUDIO0 preset
clk: renesas: rzg2l: Fix FOUTPOSTDIV clk
RDMA/rxe: Set queue pair cur_qp_state when being queried
RDMA/mlx5: Call dev_put() after the blocking notifier
RDMA/core: Implement RoCE GID port rescan and export delete function
RDMA/mlx5: Ensure active slave attachment to the bond IB device
RISC-V: KVM: Fix APLIC in_clrip and clripnum write emulation
riscv: kvm: Fix out-of-bounds array access
clk: imx: lpcg-scu: SW workaround for errata (e10858)
clk: imx: fracn-gppll: correct PLL initialization flow
clk: imx: fracn-gppll: fix pll power up
clk: imx: clk-scu: fix clk enable state save and restore
clk: imx: imx8-acm: Fix return value check in clk_imx_acm_attach_pm_domains()
iommu/vt-d: Fix checks and print in dmar_fault_dump_ptes()
iommu/vt-d: Fix checks and print in pgtable_walk()
checkpatch: always parse orig_commit in fixes tag
mfd: rt5033: Fix missing regmap_del_irq_chip()
leds: max5970: Fix unreleased fwnode_handle in probe function
leds: ktd2692: Set missing timing properties
fs/proc/kcore.c: fix coccinelle reported ERROR instances
scsi: target: Fix incorrect function name in pscsi_create_type_disk()
scsi: bfa: Fix use-after-free in bfad_im_module_exit()
scsi: fusion: Remove unused variable 'rc'
scsi: qedf: Fix a possible memory leak in qedf_alloc_and_init_sb()
scsi: qedi: Fix a possible memory leak in qedi_alloc_and_init_sb()
scsi: sg: Enable runtime power management
x86/tdx: Introduce wrappers to read and write TD metadata
x86/tdx: Rename tdx_parse_tdinfo() to tdx_setup()
x86/tdx: Dynamically disable SEPT violations from causing #VEs
powerpc/fadump: allocate memory for additional parameters early
fadump: reserve param area if below boot_mem_top
RDMA/hns: Fix out-of-order issue of requester when setting FENCE
RDMA/hns: Fix NULL pointer derefernce in hns_roce_map_mr_sg()
cpufreq: loongson3: Check for error code from devm_mutex_init() call
cpufreq: CPPC: Fix wrong return value in cppc_get_cpu_cost()
cpufreq: CPPC: Fix wrong return value in cppc_get_cpu_power()
kasan: move checks to do_strncpy_from_user
kunit: skb: use "gfp" variable instead of hardcoding GFP_KERNEL
ocfs2: fix uninitialized value in ocfs2_file_read_iter()
zram: ZRAM_DEF_COMP should depend on ZRAM
iommu/tegra241-cmdqv: Fix alignment failure at max_n_shift
dax: delete a stale directory pmem
KVM: PPC: Book3S HV: Stop using vc->dpdes for nested KVM guests
KVM: PPC: Book3S HV: Avoid returning to nested hypervisor on pending doorbells
powerpc/sstep: make emulate_vsx_load and emulate_vsx_store static
RDMA/hns: Fix different dgids mapping to the same dip_idx
KVM: PPC: Book3S HV: Fix kmv -> kvm typo
powerpc/kexec: Fix return of uninitialized variable
fbdev: sh7760fb: Fix a possible memory leak in sh7760fb_alloc_mem()
RDMA/mlx5: Move events notifier registration to be after device registration
clk: clk-apple-nco: Add NULL check in applnco_probe
clk: ralink: mtmips: fix clock plan for Ralink SoC RT3883
clk: ralink: mtmips: fix clocks probe order in oldest ralink SoCs
clk: en7523: remove REG_PCIE*_{MEM,MEM_MASK} configuration
clk: en7523: move clock_register in hw_init callback
clk: en7523: introduce chip_scu regmap
clk: en7523: fix estimation of fixed rate for EN7581
dt-bindings: clock: axi-clkgen: include AXI clk
clk: clk-axi-clkgen: make sure to enable the AXI bus clock
zram: permit only one post-processing operation at a time
zram: fix NULL pointer in comp_algorithm_show()
RDMA/bnxt_re: Correct the sequence of device suspend
arm64: dts: qcom: sc8180x: Add a SoC-specific compatible to cpufreq-hw
pinctrl: k210: Undef K210_PC_DEFAULT
rtla/timerlat: Do not set params->user_workload with -U
smb: cached directories can be more than root file handle
mailbox: mtk-cmdq: fix wrong use of sizeof in cmdq_get_clocks()
mailbox: arm_mhuv2: clean up loop in get_irq_chan_comb()
x86: fix off-by-one in access_ok()
perf cs-etm: Don't flush when packet_queue fills up
gfs2: Rename GLF_VERIFY_EVICT to GLF_VERIFY_DELETE
gfs2: Allow immediate GLF_VERIFY_DELETE work
gfs2: Fix unlinked inode cleanup
perf mem: Fix printing PERF_MEM_LVLNUM_{L2_MHB|MSC}
dt-bindings: PCI: mediatek-gen3: Allow exact number of clocks only
PCI: Fix reset_method_store() memory leak
perf jevents: Don't stop at the first matched pmu when searching a events table
perf stat: Close cork_fd when create_perf_stat_counter() failed
perf stat: Fix affinity memory leaks on error path
perf trace: Keep exited threads for summary
perf test attr: Add back missing topdown events
rust: rbtree: fix `SAFETY` comments that should be `# Safety` sections
f2fs: compress: fix inconsistent update of i_blocks in release_compress_blocks and reserve_compress_blocks
f2fs: fix null-ptr-deref in f2fs_submit_page_bio()
mailbox, remoteproc: k3-m4+: fix compile testing
f2fs: fix to account dirty data in __get_secs_required()
perf dso: Fix symtab_type for kmod compression
perf disasm: Fix capstone memory leak
perf probe: Fix libdw memory leak
perf probe: Correct demangled symbols in C++ program
rust: kernel: fix THIS_MODULE header path in ThisModule doc comment
rust: macros: fix documentation of the paste! macro
PCI: cpqphp: Fix PCIBIOS_* return value confusion
rust: block: fix formatting of `kernel::block::mq::request` module
perf disasm: Use disasm_line__free() to properly free disasm_line
perf disasm: Fix not cleaning up disasm_line in symbol__disassemble_raw()
virtiofs: use pages instead of pointer for kernel direct IO
perf ftrace latency: Fix unit on histogram first entry when using --use-nsec
i3c: master: Remove i3c_dev_disable_ibi_locked(olddev) on device hotjoin
f2fs: fix the wrong f2fs_bug_on condition in f2fs_do_replace_block
f2fs: check curseg->inited before write_sum_page in change_curseg
f2fs: Fix not used variable 'index'
f2fs: fix to avoid potential deadlock in f2fs_record_stop_reason()
f2fs: fix to avoid use GC_AT when setting gc_mode as GC_URGENT_LOW or GC_URGENT_MID
PCI: qcom: Enable MSI interrupts together with Link up if 'Global IRQ' is supported
PCI: qcom-ep: Move controller cleanups to qcom_pcie_perst_deassert()
PCI: tegra194: Move controller cleanups to pex_ep_event_pex_rst_deassert()
PCI: j721e: Deassert PERST# after a delay of PCIE_T_PVPERL_MS milliseconds
perf build: Add missing cflags when building with custom libtraceevent
f2fs: fix race in concurrent f2fs_stop_gc_thread
f2fs: fix to map blocks correctly for direct write
f2fs: fix to avoid forcing direct write to use buffered IO on inline_data inode
perf trace: avoid garbage when not printing a trace event's arguments
m68k: mcfgpio: Fix incorrect register offset for CONFIG_M5441x
m68k: coldfire/device.c: only build FEC when HW macros are defined
svcrdma: Address an integer overflow
nfsd: drop inode parameter from nfsd4_change_attribute()
perf list: Fix topic and pmu_name argument order
perf trace: Fix tracing itself, creating feedback loops
perf trace: Do not lose last events in a race
perf trace: Avoid garbage when not printing a syscall's arguments
remoteproc: qcom: pas: Remove subdevs on the error path of adsp_probe()
remoteproc: qcom: adsp: Remove subdevs on the error path of adsp_probe()
remoteproc: qcom: pas: add minidump_id to SM8350 resources
rpmsg: glink: use only lower 16-bits of param2 for CMD_OPEN name length
remoteproc: qcom_q6v5_mss: Re-order writes to the IMEM region
PCI: endpoint: epf-mhi: Avoid NULL dereference if DT lacks 'mmio'
NFSD: Prevent NULL dereference in nfsd4_process_cb_update()
NFSD: Cap the number of bytes copied by nfs4_reset_recoverydir()
nfsd: release svc_expkey/svc_export with rcu_work
svcrdma: fix miss destroy percpu_counter in svc_rdma_proc_init()
NFSD: Fix nfsd4_shutdown_copy()
nfs_common: must not hold RCU while calling nfsd_file_put_local
f2fs: fix to do cast in F2FS_{BLK_TO_BYTES, BTYES_TO_BLK} to avoid overflow
perf bpf-filter: Return -ENOMEM directly when pfi allocation fails
hwmon: (tps23861) Fix reporting of negative temperatures
hwmon: (aquacomputer_d5next) Fix length of speed_input array
phy: airoha: Fix REG_CSR_2L_PLL_CMN_RESERVE0 config in airoha_pcie_phy_init_clk_out()
phy: airoha: Fix REG_PCIE_PMA_TX_RESET config in airoha_pcie_phy_init_csr_2l()
phy: airoha: Fix REG_CSR_2L_JCPLL_SDM_HREN config in airoha_pcie_phy_init_ssc_jcpll()
phy: airoha: Fix REG_CSR_2L_RX{0,1}_REV0 definitions
vdpa/mlx5: Fix suboptimal range on iotlb iteration
vfio/mlx5: Fix an unwind issue in mlx5vf_add_migration_pages()
vfio/mlx5: Fix unwind flows in mlx5vf_pci_save/resume_device_data()
selftests/mount_setattr: Fix failures on 64K PAGE_SIZE kernels
gpio: zevio: Add missed label initialisation
vfio/pci: Properly hide first-in-list PCIe extended capability
fs_parser: update mount_api doc to match function signature
LoongArch: Fix build failure with GCC 15 (-std=gnu23)
LoongArch: BPF: Sign-extend return values
power: supply: core: Remove might_sleep() from power_supply_put()
power: supply: bq27xxx: Fix registers of bq27426
power: supply: rt9471: Fix wrong WDT function regfield declaration
power: supply: rt9471: Use IC status regfield to report real charger status
fs/ntfs3: Equivalent transition from page to folio
power: reset: ep93xx: add AUXILIARY_BUS dependency
net: usb: lan78xx: Fix double free issue with interrupt buffer allocation
net: usb: lan78xx: Fix memory leak on device unplug by freeing PHY device
tg3: Set coherent DMA mask bits to 31 for BCM57766 chipsets
net: usb: lan78xx: Fix refcounting and autosuspend on invalid WoL configuration
net: microchip: vcap: Add typegroup table terminators in kunit tests
netlink: fix false positive warning in extack during dumps
exfat: fix file being changed by unaligned direct write
net/l2tp: fix warning in l2tp_exit_net found by syzbot
s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct()
rtase: Refactor the rtase_check_mac_version_valid() function
rtase: Correct the speed for RTL907XD-V1
rtase: Corrects error handling of the rtase_check_mac_version_valid()
net/ipv6: delete temporary address if mngtmpaddr is removed or unmanaged
net: mdio-ipq4019: add missing error check
marvell: pxa168_eth: fix call balance of pep->clk handling routines
net: stmmac: dwmac-socfpga: Set RX watchdog interrupt as broken
octeontx2-af: RPM: Fix mismatch in lmac type
octeontx2-af: RPM: Fix low network performance
octeontx2-af: RPM: fix stale RSFEC counters
octeontx2-af: RPM: fix stale FCFEC counters
octeontx2-af: Quiesce traffic before NIX block reset
spi: atmel-quadspi: Fix register name in verbose logging function
net: hsr: fix hsr_init_sk() vs network/transport headers.
bnxt_en: Reserve rings after PCIe AER recovery if NIC interface is down
bnxt_en: Set backplane link modes correctly for ethtool
bnxt_en: Fix queue start to update vnic RSS table
bnxt_en: Fix receive ring space parameters when XDP is active
bnxt_en: Refactor bnxt_ptp_init()
bnxt_en: Unregister PTP during PCI shutdown and suspend
Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync
Bluetooth: MGMT: Fix possible deadlocks
llc: Improve setsockopt() handling of malformed user input
rxrpc: Improve setsockopt() handling of malformed user input
tcp: Fix use-after-free of nreq in reqsk_timer_handler().
ip6mr: fix tables suspicious RCU usage
ipmr: fix tables suspicious RCU usage
iio: light: al3010: Fix an error handling path in al3010_probe()
usb: using mutex lock and supporting O_NONBLOCK flag in iowarrior_read()
usb: yurex: make waiting on yurex_write interruptible
USB: chaoskey: fail open after removal
USB: chaoskey: Fix possible deadlock chaoskey_list_lock
misc: apds990x: Fix missing pm_runtime_disable()
devres: Fix page faults when tracing devres from unloaded modules
usb: gadget: uvc: wake pump everytime we update the free list
interconnect: qcom: icc-rpmh: probe defer incase of missing QoS clock dependency
iio: backend: fix wrong pointer passed to IS_ERR()
iio: adc: ad4000: fix reading unsigned data
iio: adc: ad4000: Check for error code from devm_mutex_init() call
iio: adc: pac1921: Check for error code from devm_mutex_init() call
iio: accel: adxl380: fix raw sample read
phy: realtek: usb: fix NULL deref in rtk_usb2phy_probe
phy: realtek: usb: fix NULL deref in rtk_usb3phy_probe
counter: stm32-timer-cnt: Add check for clk_enable()
counter: ti-ecap-capture: Add check for clk_enable()
bus: mhi: host: Switch trace_mhi_gen_tre fields to native endian
usb: typec: fix potential array underflow in ucsi_ccg_sync_control()
firmware_loader: Fix possible resource leak in fw_log_firmware_info()
ALSA: hda/realtek: Update ALC256 depop procedure
drm/radeon: Fix spurious unplug event on radeon HDMI
drm/amd/display: Fix null check for pipe_ctx->plane_state in dcn20_program_pipe
drm/amd/display: Fix null check for pipe_ctx->plane_state in hwss_setup_dpp
ASoC: imx-audmix: Add NULL check in imx_audmix_probe
drm/xe/ufence: Wake up waiters after setting ufence->signalled
apparmor: fix 'Do simple duplicate message elimination'
ALSA: core: Fix possible NULL dereference caused by kunit_kzalloc()
ASoC: amd: yc: Fix for enabling DMIC on acp6x via _DSD entry
ASoC: mediatek: Check num_codecs is not zero to avoid panic during probe
s390/pci: Fix potential double remove of hotplug slot
f2fs: fix fiemap failure issue when page size is 16KB
net_sched: sch_fq: don't follow the fast path if Tx is behind now
xen: Fix the issue of resource not being properly released in xenbus_dev_probe()
ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices
ALSA: usb-audio: Fix out of bounds reads when finding clock sources
usb: ehci-spear: fix call balance of sehci clk handling routines
usb: typec: ucsi: glink: fix off-by-one in connector_status
xfs: fix simplify extent lookup in xfs_can_free_eofblocks
ext4: supress data-race warnings in ext4_free_inodes_{count,set}()
ext4: fix FS_IOC_GETFSMAP handling
MAINTAINERS: update location of media main tree
docs: media: update location of the media patches
jfs: xattr: check invalid xattr size more strictly
ASoC: amd: yc: Add a quirk for microfone on Lenovo ThinkPad P14s Gen 5 21MES00B00
ASoC: codecs: Fix atomicity violation in snd_soc_component_get_drvdata()
ASoC: da7213: Populate max_register to regmap_config
perf/x86/intel/pt: Fix buffer full but size is 0 case
crypto: x86/aegis128 - access 32-bit arguments as 32-bit
KVM: x86: switch hugepage recovery thread to vhost_task
KVM: x86/mmu: Skip the "try unsync" path iff the old SPTE was a leaf SPTE
KVM: x86: add back X86_LOCAL_APIC dependency
KVM: x86: Break CONFIG_KVM_X86's direct dependency on KVM_INTEL || KVM_AMD
powerpc/pseries: Fix KVM guest detection for disabling hardlockup detector
KVM: arm64: vgic-v3: Sanitise guest writes to GICR_INVLPIR
KVM: arm64: Ignore PMCNTENSET_EL0 while checking for overflow status
Revert "KVM: VMX: Move LOAD_IA32_PERF_GLOBAL_CTRL errata handling out of setup_vmcs_config()"
KVM: arm64: Don't retire aborted MMIO instruction
KVM: arm64: vgic-its: Clear ITE when DISCARD frees an ITE
KVM: arm64: Get rid of userspace_irqchip_in_use
KVM: arm64: vgic-its: Add a data length check in vgic_its_save_*
KVM: arm64: vgic-its: Clear DTE when MAPD unmaps a device
Compiler Attributes: disable __counted_by for clang < 19.1.3
PCI: Fix use-after-free of slot->bus on hot remove
LoongArch: Explicitly specify code model in Makefile
clk: clk-loongson2: Fix memory corruption bug in struct loongson2_clk_provider
clk: clk-loongson2: Fix potential buffer overflow in flexible-array member access
fsnotify: fix sending inotify event with unexpected filename
fsnotify: Fix ordering of iput() and watched_objects decrement
comedi: Flush partial mappings in error case
apparmor: test: Fix memory leak for aa_unpack_strdup()
iio: dac: adi-axi-dac: fix wrong register bitfield
tty: ldsic: fix tty_ldisc_autoload sysctl's proc_handler
locking/lockdep: Avoid creating new name string literals in lockdep_set_subclass()
tools/nolibc: s390: include std.h
fcntl: make F_DUPFD_QUERY associative
pinctrl: qcom: spmi: fix debugfs drive strength
dt-bindings: pinctrl: samsung: Fix interrupt constraint for variants with fallbacks
dt-bindings: iio: dac: ad3552r: fix maximum spi speed
exfat: fix uninit-value in __exfat_get_dentry_set
exfat: fix out-of-bounds access of directory entries
xhci: Fix control transfer error on Etron xHCI host
xhci: Combine two if statements for Etron xHCI host
xhci: Don't perform Soft Retry for Etron xHCI host
xhci: Don't issue Reset Device command to Etron xHCI host
Bluetooth: Fix type of len in rfcomm_sock_getsockopt{,_old}()
usb: xhci: Limit Stop Endpoint retries
usb: xhci: Fix TD invalidation under pending Set TR Dequeue
usb: xhci: Avoid queuing redundant Stop Endpoint commands
ARM: dts: omap36xx: declare 1GHz OPP as turbo again
wifi: ath12k: fix warning when unbinding
wifi: rtlwifi: Drastically reduce the attempts to read efuse in case of failures
wifi: nl80211: fix bounds checker error in nl80211_parse_sched_scan
wifi: ath12k: fix crash when unbinding
wifi: brcmfmac: release 'root' node in all execution paths
Revert "fs: don't block i_writecount during exec"
Revert "f2fs: remove unreachable lazytime mount option parsing"
Revert "usb: gadget: composite: fix OS descriptors w_value logic"
serial: sh-sci: Clean sci_ports[0] after at earlycon exit
Revert "serial: sh-sci: Clean sci_ports[0] after at earlycon exit"
io_uring: fix corner case forgetting to vunmap
io_uring: check for overflows in io_pin_pages
blk-settings: round down io_opt to physical_block_size
gpio: exar: set value when external pull-up or pull-down is present
netfilter: ipset: add missing range check in bitmap_ip_uadt
spi: Fix acpi deferred irq probe
mtd: spi-nor: core: replace dummy buswidth from addr to data
cpufreq: mediatek-hw: Fix wrong return value in mtk_cpufreq_get_cpu_power()
cifs: support mounting with alternate password to allow password rotation
parisc/ftrace: Fix function graph tracing disablement
RISC-V: Scalar unaligned access emulated on hotplug CPUs
RISC-V: Check scalar unaligned access on all CPUs
ksmbd: fix use-after-free in SMB request handling
smb: client: fix NULL ptr deref in crypto_aead_setkey()
platform/chrome: cros_ec_typec: fix missing fwnode reference decrement
irqchip/irq-mvebu-sei: Move misplaced select() callback to SEI CP domain
x86/CPU/AMD: Terminate the erratum_1386_microcode array
ubi: wl: Put source PEB into correct list if trying locking LEB failed
um: ubd: Do not use drvdata in release
um: net: Do not use drvdata in release
dt-bindings: serial: rs485: Fix rs485-rts-delay property
serial: 8250_fintek: Add support for F81216E
serial: 8250: omap: Move pm_runtime_get_sync
serial: amba-pl011: Fix RX stall when DMA is used
serial: amba-pl011: fix build regression
Revert "block, bfq: merge bfq_release_process_ref() into bfq_put_cooperator()"
mtd: ubi: fix unreleased fwnode_handle in find_volume_fwnode()
block: Prevent potential deadlock in blk_revalidate_disk_zones()
um: vector: Do not use drvdata in release
sh: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK
iio: gts: Fix uninitialized symbol 'ret'
ublk: fix ublk_ch_mmap() for 64K page size
arm64: tls: Fix context-switching of tpidrro_el0 when kpti is enabled
block: fix missing dispatching request when queue is started or unquiesced
block: fix ordering between checking QUEUE_FLAG_QUIESCED request adding
block: fix ordering between checking BLK_MQ_S_STOPPED request adding
blk-mq: Make blk_mq_quiesce_tagset() hold the tag list mutex less long
gve: Flow steering trigger reset only for timeout error
HID: wacom: Interpret tilt data from Intuos Pro BT as signed values
i40e: Fix handling changed priv flags
media: wl128x: Fix atomicity violation in fmc_send_cmd()
media: intel/ipu6: do not handle interrupts when device is disabled
arm64: dts: mediatek: mt8186-corsola-voltorb: Merge speaker codec nodes
netdev-genl: Hold rcu_read_lock in napi_get
soc: fsl: cpm1: qmc: Set the ret error code on platform_get_irq() failure
soc: fsl: rcpm: fix missing of_node_put() in copy_ippdexpcr1_setting()
media: v4l2-core: v4l2-dv-timings: check cvt/gtf result
x86/mm: Carve out INVLPG inline asm for use by others
x86/microcode/AMD: Flush patch buffer mapping after application
ALSA: rawmidi: Fix kvfree() call in spinlock
ALSA: ump: Fix evaluation of MIDI 1.0 FB info
ALSA: pcm: Add sanity NULL check for the default mmap fault handler
ALSA: hda/realtek: Update ALC225 depop procedure
ALSA: hda/realtek: Enable speaker pins for Medion E15443 platform
ALSA: hda/realtek: Set PCBeep to default value for ALC274
ALSA: hda/realtek: Fix Internal Speaker and Mic boost of Infinix Y4 Max
ALSA: hda/realtek: fix mute/micmute LEDs don't work for EliteBook X G1i
ALSA: hda/realtek: Apply quirk for Medion E15433
fs/smb/client: implement chmod() for SMB3 POSIX Extensions
smb: client: fix use-after-free of signing key
smb3: request handle caching when caching directories
smb: client: handle max length for SMB symlinks
smb: Don't leak cfid when reconnect races with open_cached_dir
smb: prevent use-after-free due to open_cached_dir error paths
smb: During unmount, ensure all cached dir instances drop their dentry
usb: misc: ljca: set small runtime autosuspend delay
usb: misc: ljca: move usb_autopm_put_interface() after wait for response
usb: dwc3: ep0: Don't clear ep0 DWC3_EP_TRANSFER_STARTED
usb: musb: Fix hardware lockup on first Rx endpoint request
usb: dwc3: gadget: Add missing check for single port RAM in TxFIFO resizing logic
usb: dwc3: gadget: Fix checking for number of TRBs left
usb: dwc3: gadget: Fix looping of queued SG entries
staging: vchiq_arm: Fix missing refcount decrement in error path for fw_node
counter: stm32-timer-cnt: fix device_node handling in probe_encoder()
ublk: fix error code for unsupported command
lib: string_helpers: silence snprintf() output truncation warning
f2fs: fix to do sanity check on node blkaddr in truncate_node()
ipc: fix memleak if msg_init_ns failed in create_ipc_ns
Input: cs40l50 - fix wrong usage of INIT_WORK()
NFSD: Prevent a potential integer overflow
SUNRPC: make sure cache entry active before cache_show
um: Fix potential integer overflow during physmem setup
um: Fix the return value of elf_core_copy_task_fpregs
kfifo: don't include dma-mapping.h in kfifo.h
um: ubd: Initialize ubd's disk pointer in ubd_add
um: Always dump trace for specified task in show_stack
NFSv4.0: Fix a use-after-free problem in the asynchronous open()
nfs/localio: must clear res.replen in nfs_local_read_done
rtc: st-lpc: Use IRQF_NO_AUTOEN flag in request_irq()
rtc: abx80x: Fix WDT bit position of the status register
rtc: check if __rtc_read_time was successful in rtc_timer_do_work()
ubi: fastmap: wl: Schedule fm_work if wear-leveling pool is empty
ubifs: Correct the total block count by deducting journal reservation
ubi: fastmap: Fix duplicate slab cache names while attaching
ubifs: authentication: Fix use-after-free in ubifs_tnc_end_commit
jffs2: fix use of uninitialized variable
hostfs: Fix the NULL vs IS_ERR() bug for __filemap_get_folio()
net/9p/usbg: fix handling of the failed kzalloc() memory allocation
rtc: rzn1: fix BCD to rtc_time conversion errors
Revert "nfs: don't reuse partially completed requests in nfs_lock_and_join_requests"
nvme/multipath: Fix RCU list traversal to use SRCU primitive
blk-mq: add non_owner variant of start_freeze/unfreeze queue APIs
block: model freeze & enter queue as lock for supporting lockdep
block: fix uaf for flush rq while iterating tags
block: return unsigned int from bdev_io_min
nvme-fabrics: fix kernel crash while shutting down controller
9p/xen: fix init sequence
9p/xen: fix release of IRQ
perf/arm-smmuv3: Fix lockdep assert in ->event_init()
perf/arm-cmn: Ensure port and device id bits are set properly
smb: client: disable directory caching when dir_cache_timeout is zero
x86/Documentation: Update algo in init_size description of boot protocol
cifs: Fix parsing native symlinks relative to the export
cifs: Fix parsing reparse point with native symlink in SMB1 non-UNICODE session
rtc: ab-eoz9: don't fail temperature reads on undervoltage notification
Rename .data.unlikely to .data..unlikely
Rename .data.once to .data..once to fix resetting WARN*_ONCE
kbuild: deb-pkg: Don't fail if modules.order is missing
smb: Initialize cfid->tcon before performing network ops
block: Don't allow an atomic write be truncated in blkdev_write_iter()
modpost: remove incorrect code in do_eisa_entry()
cifs: during remount, make sure passwords are in sync
cifs: unlock on error in smb3_reconfigure()
nfs: ignore SB_RDONLY when mounting nfs
sunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport
SUNRPC: timeout and cancel TLS handshake with -ETIMEDOUT
sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket
nfs/blocklayout: Don't attempt unregister for invalid block device
nfs/blocklayout: Limit repeat device registration on failure
block, bfq: fix bfqq uaf in bfq_limit_depth()
brd: decrease the number of allocated pages which discarded
sh: intc: Fix use-after-free bug in register_intc_controller()
tools/power turbostat: Fix trailing '\n' parsing
tools/power turbostat: Fix child's argument forwarding
block: always verify unfreeze lock on the owner task
block: don't verify IO lock for freeze/unfreeze in elevator_init_mq()
Linux 6.12.2
Change-Id: Ifebddb35b5a6a6ff2a65eb795a912633639aca9a
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
commit 21d1b618b6b9da46c5116c640ac4b1cc8d40d63a upstream.
Ensure the superblock is kept alive until we're done with iput().
Holding a reference to an inode is not allowed unless we ensure the
superblock stays alive, which fsnotify does by keeping the
watched_objects count elevated, so iput() must happen before the
watched_objects decrement.
This can lead to a UAF of something like sb->s_fs_info in tmpfs, but the
UAF is hard to hit because race orderings that oops are more likely, thanks
to the CHECK_DATA_CORRUPTION() block in generic_shutdown_super().
Also, ensure that fsnotify_put_sb_watched_objects() doesn't call
fsnotify_sb_watched_objects() on a superblock that may have already been
freed, which would cause a UAF read of sb->s_fsnotify_info.
Cc: stable@kernel.org
Fixes: d2f277e26f ("fsnotify: rename fsnotify_{get,put}_sb_connectors()")
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit aa52c54da40d9eee3ba87c05cdcb0cd07c04fa13 upstream.
We got a report that adding a fanotify filsystem watch prevents tail -f
from receiving events.
Reproducer:
1. Create 3 windows / login sessions. Become root in each session.
2. Choose a mounted filesystem that is pretty quiet; I picked /boot.
3. In the first window, run: fsnotifywait -S -m /boot
4. In the second window, run: echo data >> /boot/foo
5. In the third window, run: tail -f /boot/foo
6. Go back to the second window and run: echo more data >> /boot/foo
7. Observe that the tail command doesn't show the new data.
8. In the first window, hit control-C to interrupt fsnotifywait.
9. In the second window, run: echo still more data >> /boot/foo
10. Observe that the tail command in the third window has now printed
the missing data.
When stracing tail, we observed that when fanotify filesystem mark is
set, tail does get the inotify event, but the event is receieved with
the filename:
read(4, "\1\0\0\0\2\0\0\0\0\0\0\0\20\0\0\0foo\0\0\0\0\0\0\0\0\0\0\0\0\0",
50) = 32
This is unexpected, because tail is watching the file itself and not its
parent and is inconsistent with the inotify event received by tail when
fanotify filesystem mark is not set:
read(4, "\1\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0", 50) = 16
The inteference between different fsnotify groups was caused by the fact
that the mark on the sb requires the filename, so the filename is passed
to fsnotify(). Later on, fsnotify_handle_event() tries to take care of
not passing the filename to groups (such as inotify) that are interested
in the filename only when the parent is watching.
But the logic was incorrect for the case that no group is watching the
parent, some groups are watching the sb and some watching the inode.
Reported-by: Miklos Szeredi <miklos@szeredi.hu>
Fixes: 7372e79c9e ("fanotify: fix logic of reporting name info with watched parent")
Cc: stable@vger.kernel.org # 5.10+
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Previously errors from the daemon in FUSE_CANONICAL_PATH were simply
ignored. In order to block inotifys, it is useful to be able to return
errors from this opcode.
[drosen: I've combined this patch with a few others that fix dealing
with error codes (mostly ENOSYS) to make it harder to lose these again
in the future:
ANDROID: fsnotify: Do not notify lower fs of open when ENOSYS
ANDROID: fuse: Skip canonical path logic if ENOSYS
ANDROID: fuse: Fix the issue of fuse_dentry_canonical_path ]
Bug: 238619640
Test: inotify no longer works on /storage/emulated/0/Android/media but
does on child folders
Bug: 326995824
Test: cts-tradefed run commandAndExit cts -m CtsOsTestCases -t android.os.cts.FileObserverTest
Bug: 330136711
Test: ./cts-tradefed run commandAndExit cts -m CtsIncidentHostTestCases -t com.android.server.cts.ErrorsTest#testTombstone
Signed-off-by: Paul Lawrence <paullawrence@google.com>
Change-Id: Icb15c090c6286c174338471a787712f8388de316
[Syzbot reported]
WARNING: possible circular locking dependency detected
6.11.0-rc4-syzkaller-00019-gb311c1b497e5 #0 Not tainted
------------------------------------------------------
kswapd0/78 is trying to acquire lock:
ffff88801b8d8930 (&group->mark_mutex){+.+.}-{3:3}, at: fsnotify_group_lock include/linux/fsnotify_backend.h:270 [inline]
ffff88801b8d8930 (&group->mark_mutex){+.+.}-{3:3}, at: fsnotify_destroy_mark+0x38/0x3c0 fs/notify/mark.c:578
but task is already holding lock:
ffffffff8ea2fd60 (fs_reclaim){+.+.}-{0:0}, at: balance_pgdat mm/vmscan.c:6841 [inline]
ffffffff8ea2fd60 (fs_reclaim){+.+.}-{0:0}, at: kswapd+0xbb4/0x35a0 mm/vmscan.c:7223
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #1 (fs_reclaim){+.+.}-{0:0}:
...
kmem_cache_alloc_noprof+0x3d/0x2a0 mm/slub.c:4044
inotify_new_watch fs/notify/inotify/inotify_user.c:599 [inline]
inotify_update_watch fs/notify/inotify/inotify_user.c:647 [inline]
__do_sys_inotify_add_watch fs/notify/inotify/inotify_user.c:786 [inline]
__se_sys_inotify_add_watch+0x72e/0x1070 fs/notify/inotify/inotify_user.c:729
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #0 (&group->mark_mutex){+.+.}-{3:3}:
...
__mutex_lock+0x136/0xd70 kernel/locking/mutex.c:752
fsnotify_group_lock include/linux/fsnotify_backend.h:270 [inline]
fsnotify_destroy_mark+0x38/0x3c0 fs/notify/mark.c:578
fsnotify_destroy_marks+0x14a/0x660 fs/notify/mark.c:934
fsnotify_inoderemove include/linux/fsnotify.h:264 [inline]
dentry_unlink_inode+0x2e0/0x430 fs/dcache.c:403
__dentry_kill+0x20d/0x630 fs/dcache.c:610
shrink_kill+0xa9/0x2c0 fs/dcache.c:1055
shrink_dentry_list+0x2c0/0x5b0 fs/dcache.c:1082
prune_dcache_sb+0x10f/0x180 fs/dcache.c:1163
super_cache_scan+0x34f/0x4b0 fs/super.c:221
do_shrink_slab+0x701/0x1160 mm/shrinker.c:435
shrink_slab+0x1093/0x14d0 mm/shrinker.c:662
shrink_one+0x43b/0x850 mm/vmscan.c:4815
shrink_many mm/vmscan.c:4876 [inline]
lru_gen_shrink_node mm/vmscan.c:4954 [inline]
shrink_node+0x3799/0x3de0 mm/vmscan.c:5934
kswapd_shrink_node mm/vmscan.c:6762 [inline]
balance_pgdat mm/vmscan.c:6954 [inline]
kswapd+0x1bcd/0x35a0 mm/vmscan.c:7223
[Analysis]
The problem is that inotify_new_watch() is using GFP_KERNEL to allocate
new watches under group->mark_mutex, however if dentry reclaim races
with unlinking of an inode, it can end up dropping the last dentry reference
for an unlinked inode resulting in removal of fsnotify mark from reclaim
context which wants to acquire group->mark_mutex as well.
This scenario shows that all notification groups are in principle prone
to this kind of a deadlock (previously, we considered only fanotify and
dnotify to be problematic for other reasons) so make sure all
allocations under group->mark_mutex happen with GFP_NOFS.
Reported-and-tested-by: syzbot+c679f13773f295d2da53@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=c679f13773f295d2da53
Signed-off-by: Lizhi Xu <lizhi.xu@windriver.com>
Reviewed-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Link: https://patch.msgid.link/20240927143642.2369508-1-lizhi.xu@windriver.com
Steps on the way to 6.12-rc1
Bug: 367265496
Change-Id: Ia35c8df80c389ca4f4f32c649da7d33a25e2fe23
Signed-off-by: Matthias Maennich <maennich@google.com>
Steps on the way to 6.12-rc1
Bug: 367265496
Change-Id: I37a904f83857c7847142c7273b3c2771b5125cfc
Signed-off-by: Matthias Maennich <maennich@google.com>
Pull 'struct fd' updates from Al Viro:
"Just the 'struct fd' layout change, with conversion to accessor
helpers"
* tag 'pull-stable-struct_fd' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
add struct fd constructors, get rid of __to_fd()
struct fd: representation change
introduce fd_file(), convert all accessors to it.
We do embedd struct fown_struct into struct file letting it take up 32
bytes in total. We could tweak struct fown_struct to be more compact but
really it shouldn't even be embedded in struct file in the first place.
Instead, actual users of struct fown_struct should allocate the struct
on demand. This frees up 24 bytes in struct file.
That will have some potentially user-visible changes for the ownership
fcntl()s. Some of them can now fail due to allocation failures.
Practically, that probably will almost never happen as the allocations
are small and they only happen once per file.
The fown_struct is used during kill_fasync() which is used by e.g.,
pipes to generate a SIGIO signal. Sending of such signals is conditional
on userspace having set an owner for the file using one of the F_OWNER
fcntl()s. Such users will be unaffected if struct fown_struct is
allocated during the fcntl() call.
There are a few subsystems that call __f_setown() expecting
file->f_owner to be allocated:
(1) tun devices
file->f_op->fasync::tun_chr_fasync()
-> __f_setown()
There are no callers of tun_chr_fasync().
(2) tty devices
file->f_op->fasync::tty_fasync()
-> __tty_fasync()
-> __f_setown()
tty_fasync() has no additional callers but __tty_fasync() has. Note
that __tty_fasync() only calls __f_setown() if the @on argument is
true. It's called from:
file->f_op->release::tty_release()
-> tty_release()
-> __tty_fasync()
-> __f_setown()
tty_release() calls __tty_fasync() with @on false
=> __f_setown() is never called from tty_release().
=> All callers of tty_release() are safe as well.
file->f_op->release::tty_open()
-> tty_release()
-> __tty_fasync()
-> __f_setown()
__tty_hangup() calls __tty_fasync() with @on false
=> __f_setown() is never called from tty_release().
=> All callers of __tty_hangup() are safe as well.
From the callchains it's obvious that (1) and (2) end up getting called
via file->f_op->fasync(). That can happen either through the F_SETFL
fcntl() with the FASYNC flag raised or via the FIOASYNC ioctl(). If
FASYNC is requested and the file isn't already FASYNC then
file->f_op->fasync() is called with @on true which ends up causing both
(1) and (2) to call __f_setown().
(1) and (2) are the only subsystems that call __f_setown() from the
file->f_op->fasync() handler. So both (1) and (2) have been updated to
allocate a struct fown_struct prior to calling fasync_helper() to
register with the fasync infrastructure. That's safe as they both call
fasync_helper() which also does allocations if @on is true.
The other interesting case are file leases:
(3) file leases
lease_manager_ops->lm_setup::lease_setup()
-> __f_setown()
Which in turn is called from:
generic_add_lease()
-> lease_manager_ops->lm_setup::lease_setup()
-> __f_setown()
So here again we can simply make generic_add_lease() allocate struct
fown_struct prior to the lease_manager_ops->lm_setup::lease_setup()
which happens under a spinlock.
With that the two remaining subsystems that call __f_setown() are:
(4) dnotify
(5) sockets
Both have their own custom ioctls to set struct fown_struct and both
have been converted to allocate a struct fown_struct on demand from
their respective ioctls.
Interactions with O_PATH are fine as well e.g., when opening a /dev/tty
as O_PATH then no file->f_op->open() happens thus no file->f_owner is
allocated. That's fine as no file operation will be set for those and
the device has never been opened. fcntl()s called on such things will
just allocate a ->f_owner on demand. Although I have zero idea why'd you
care about f_owner on an O_PATH fd.
Link: https://lore.kernel.org/r/20240813-work-f_owner-v2-1-4e9343a79f9f@kernel.org
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Christian Brauner <brauner@kernel.org>
For any changes of struct fd representation we need to
turn existing accesses to fields into calls of wrappers.
Accesses to struct fd::flags are very few (3 in linux/file.h,
1 in net/socket.c, 3 in fs/overlayfs/file.c and 3 more in
explicit initializers).
Those can be dealt with in the commit converting to
new layout; accesses to struct fd::file are too many for that.
This commit converts (almost) all of f.file to
fd_file(f). It's not entirely mechanical ('file' is used as
a member name more than just in struct fd) and it does not
even attempt to distinguish the uses in pointer context from
those in boolean context; the latter will be eventually turned
into a separate helper (fd_empty()).
NOTE: mass conversion to fd_empty(), tempting as it
might be, is a bad idea; better do that piecewise in commit
that convert from fdget...() to CLASS(...).
[conflicts in fs/fhandle.c, kernel/bpf/syscall.c, mm/memcontrol.c
caught by git; fs/stat.c one got caught by git grep]
[fs/xattr.c conflict]
Reviewed-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
In some setups directories can have many (usually negative) dentries.
Hence __fsnotify_update_child_dentry_flags() function can take a
significant amount of time. Since the bulk of this function happens
under inode->i_lock this causes a significant contention on the lock
when we remove the watch from the directory as the
__fsnotify_update_child_dentry_flags() call from fsnotify_recalc_mask()
races with __fsnotify_update_child_dentry_flags() calls from
__fsnotify_parent() happening on children. This can lead upto softlockup
reports reported by users.
Fix the problem by calling fsnotify_update_children_dentry_flags() to
set PARENT_WATCHED flags only when parent starts watching children.
When parent stops watching children, clear false positive PARENT_WATCHED
flags lazily in __fsnotify_parent() for each accessed child.
Suggested-by: Jan Kara <jack@suse.cz>
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Stephen Brennan <stephen.s.brennan@oracle.com>
Signed-off-by: Jan Kara <jack@suse.cz>
This reverts commit e659522446.
These kinds of patches are only making the code worse.
Compilers don't care about the unnecessary check, but removing it makes
the code less obvious to a human. The declaration of 'len' is more than
80 lines earlier, so a human won't easily see that 'len' is of an
unsigned type, so to a human the range check that checks against zero is
much more explicit and obvious.
Any tool that complains about a range check like this just because the
variable is unsigned is actively detrimental, and should be ignored.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Commit e43de7f086 ("fsnotify: optimize the case of no marks of any type")
optimized the case where there are no fsnotify watchers on any of the
filesystem's objects.
It is quite common for a system to have a single local filesystem and
it is quite common for the system to have some inotify watches on some
config files or directories, so the optimization of no marks at all is
often not in effect.
Permission event watchers, which require high priority group are more
rare, so optimizing the case of no marks og high priority groups can
improve performance for more systems, especially for performance
sensitive io workloads.
Count per-sb watched objects by high priority groups and use that the
optimize out the call to __fsnotify_parent() and fsnotify() in fsnotify
permission hooks.
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Message-Id: <20240317184154.1200192-11-amir73il@gmail.com>
Define a container struct fsnotify_sb_info to hold per-sb state,
including the reference to sb marks connector.
Allocate the fsnotify_sb_info state before attaching connector to any
object on the sb and free it only when killing sb.
This state is going to be used for storing per priority watched objects
counters.
Suggested-by: Jan Kara <jack@suse.cz>
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Message-Id: <20240317184154.1200192-8-amir73il@gmail.com>
We would like to count watched objects by priority group, so we will need
to update the watched object counter after adding/removing marks.
Create a helper fsnotify_update_sb_watchers() and call it after
attaching/detaching a mark, instead of fsnotify_{get,put}_sb_watchers()
only after attaching/detaching a connector.
Soon, we will use this helper to count watched objects by the highest
watching priority group.
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Message-Id: <20240317184154.1200192-7-amir73il@gmail.com>
Instead of passing fsnotify_connp_t, pass the pointer to the marked
object.
Store the object pointer in the connector and move the definition of
fsnotify_connp_t to internal fsnotify subsystem API, so it is no longer
used by fsnotify backends.
Suggested-by: Jan Kara <jack@suse.cz>
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Message-Id: <20240317184154.1200192-6-amir73il@gmail.com>
There are two similar checks for adding an ignore mark without
FAN_MARK_IGNORED_SURV_MODIFY, one for the old FAN_MARK_IGNORED flag
and one for the new FAN_MARK_IGNORE flag.
Merge the two checks into a single location.
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Message-Id: <20240317184154.1200192-5-amir73il@gmail.com>
Instead of counting the number of connectors in an sb, we would like
to count the number of watched objects per priority group.
As a start, create an accessor fsnotify_sb_watched_objects() to
s_fsnotify_connectors and rename the fsnotify_{get,put}_sb_connectors()
helpers to fsnotify_{get,put}_sb_watchers() to better describes the
counter.
Increment the counter at the end of fsnotify_attach_connector_to_object()
if connector was attached instead of decrementing it on race to connect.
This is fine, because fsnotify_delete_sb() cannot be running in parallel
to fsnotify_attach_connector_to_object() which requires a reference to
a filesystem object.
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Message-Id: <20240317184154.1200192-2-amir73il@gmail.com>
Use the `DEFINE_FLEX()` helper for an on-stack definition of a
flexible structure where the size of the flexible-array member
is known at compile-time, and refactor the rest of the code,
accordingly.
So, with these changes, fix the following warning:
fs/notify/fdinfo.c:45:36: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end]
Link: https://github.com/KSPP/linux/issues/202
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Signed-off-by: Jan Kara <jack@suse.cz>
Message-Id: <ZgImguNzJBiis9Mj@neat>
Unsigned size_t len in copy_fid_info_to_user is checked
for negative value. This check is redundant as it is
always false.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 5e469c830f ("fanotify: copy event fid info to user")
Signed-off-by: Nikita Kiryushin <kiryushin@ancud.ru>
Signed-off-by: Jan Kara <jack@suse.cz>
Message-Id: <d296ff1c-dcf7-4813-994b-3c4369debb7d@ancud.ru>
If parent inode is not watching, check for the event in masks of
sb/mount/inode masks early to optimize out most of the code in
__fsnotify_parent() and avoid calling fsnotify().
Jens has reported that this optimization improves BW and IOPS in an
io_uring benchmark by more than 10% and reduces perf reported CPU usage.
before:
+ 4.51% io_uring [kernel.vmlinux] [k] fsnotify
+ 3.67% io_uring [kernel.vmlinux] [k] __fsnotify_parent
after:
+ 2.37% io_uring [kernel.vmlinux] [k] __fsnotify_parent
Reported-and-tested-by: Jens Axboe <axboe@kernel.dk>
Link: https://lore.kernel.org/linux-fsdevel/b45bd8ff-5654-4e67-90a6-aad5e6759e0b@kernel.dk/
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Message-Id: <20240116113247.758848-1-amir73il@gmail.com>
Pull dcache updates from Al Viro:
"Change of locking rules for __dentry_kill(), regularized refcounting
rules in that area, assorted cleanups and removal of weird corner
cases (e.g. now ->d_iput() on child is always called before the parent
might hit __dentry_kill(), etc)"
* tag 'pull-dcache' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (40 commits)
dcache: remove unnecessary NULL check in dget_dlock()
kill DCACHE_MAY_FREE
__d_unalias() doesn't use inode argument
d_alloc_parallel(): in-lookup hash insertion doesn't need an RCU variant
get rid of DCACHE_GENOCIDE
d_genocide(): move the extern into fs/internal.h
simple_fill_super(): don't bother with d_genocide() on failure
nsfs: use d_make_root()
d_alloc_pseudo(): move setting ->d_op there from the (sole) caller
kill d_instantate_anon(), fold __d_instantiate_anon() into remaining caller
retain_dentry(): introduce a trimmed-down lockless variant
__dentry_kill(): new locking scheme
d_prune_aliases(): use a shrink list
switch select_collect{,2}() to use of to_shrink_list()
to_shrink_list(): call only if refcount is 0
fold dentry_kill() into dput()
don't try to cut corners in shrink_lock_dentry()
fold the call of retain_dentry() into fast_dput()
Call retain_dentry() with refcount 0
dentry_kill(): don't bother with retain_dentry() on slow path
...
Pull sysctl updates from Luis Chamberlain:
"To help make the move of sysctls out of kernel/sysctl.c not incur a
size penalty sysctl has been changed to allow us to not require the
sentinel, the final empty element on the sysctl array. Joel Granados
has been doing all this work.
In the v6.6 kernel we got the major infrastructure changes required to
support this. For v6.7 we had all arch/ and drivers/ modified to
remove the sentinel. For v6.8-rc1 we get a few more updates for fs/
directory only.
The kernel/ directory is left but we'll save that for v6.9-rc1 as
those patches are still being reviewed. After that we then can expect
also the removal of the no longer needed check for procname == NULL.
Let us recap the purpose of this work:
- this helps reduce the overall build time size of the kernel and run
time memory consumed by the kernel by about ~64 bytes per array
- the extra 64-byte penalty is no longer inncurred now when we move
sysctls out from kernel/sysctl.c to their own files
Thomas Weißschuh also sent a few cleanups, for v6.9-rc1 we expect to
see further work by Thomas Weißschuh with the constificatin of the
struct ctl_table.
Due to Joel Granados's work, and to help bring in new blood, I have
suggested for him to become a maintainer and he's accepted. So for
v6.9-rc1 I look forward to seeing him sent you a pull request for
further sysctl changes. This also removes Iurii Zaikin as a maintainer
as he has moved on to other projects and has had no time to help at
all"
* tag 'sysctl-6.8-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mcgrof/linux:
sysctl: remove struct ctl_path
sysctl: delete unused define SYSCTL_PERM_EMPTY_DIR
coda: Remove the now superfluous sentinel elements from ctl_table array
sysctl: Remove the now superfluous sentinel elements from ctl_table array
fs: Remove the now superfluous sentinel elements from ctl_table array
cachefiles: Remove the now superfluous sentinel element from ctl_table array
sysclt: Clarify the results of selftest run
sysctl: Add a selftest for handling empty dirs
sysctl: Fix out of bounds access for empty sysctl registers
MAINTAINERS: Add Joel Granados as co-maintainer for proc sysctl
MAINTAINERS: remove Iurii Zaikin from proc sysctl
This commit comes at the tail end of a greater effort to remove the
empty elements at the end of the ctl_table arrays (sentinels) which
will reduce the overall build time size of the kernel and run time
memory bloat by ~64 bytes per sentinel (further information Link :
https://lore.kernel.org/all/ZO5Yx5JFogGi%2FcBo@bombadil.infradead.org/)
Remove sentinel elements ctl_table struct. Special attention was placed in
making sure that an empty directory for fs/verity was created when
CONFIG_FS_VERITY_BUILTIN_SIGNATURES is not defined. In this case we use the
register sysctl call that expects a size.
Signed-off-by: Joel Granados <j.granados@samsung.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Reviewed-by: "Darrick J. Wong" <djwong@kernel.org>
Acked-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Luis Chamberlain <mcgrof@kernel.org>
So far, fanotify returns -ENODEV or -EXDEV when trying to set a mark
on a filesystem with a "weak" fsid, namely, zero fsid (e.g. fuse), or
non-uniform fsid (e.g. btrfs non-root subvol).
When group is watching inodes all from the same filesystem (or subvol),
allow adding inode marks with "weak" fsid, because there is no ambiguity
regarding which filesystem reports the event.
The first mark added to a group determines if this group is single or
multi filesystem, depending on the fsid at the path of the added mark.
If the first mark added has a "strong" fsid, marks with "weak" fsid
cannot be added and vice versa.
If the first mark added has a "weak" fsid, following marks must have
the same "weak" fsid and the same sb as the first mark.
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Message-Id: <20231130165619.3386452-3-amir73il@gmail.com>
Some filesystems like fuse and nfs have zero or non-unique fsid.
We would like to avoid reporting ambiguous fsid in events, so we need
to avoid marking objects with same fsid and different sb.
To make this easier to enforce, store the fsid in the marks of the group
instead of in the shared conenctor.
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Message-Id: <20231130165619.3386452-2-amir73il@gmail.com>
Saves a pointer per struct dentry and actually makes the things less
clumsy. Cleaned the d_walk() and dcache_readdir() a bit by use
of hlist_for_... iterators.
A couple of new helpers - d_first_child() and d_next_sibling(),
to make the expressions less awful.
Reviewed-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Pull vfs fanotify fsid updates from Christian Brauner:
"This work is part of the plan to enable fanotify to serve as a drop-in
replacement for inotify. While inotify is availabe on all filesystems,
fanotify currently isn't.
In order to support fanotify on all filesystems two things are needed:
(1) all filesystems need to support AT_HANDLE_FID
(2) all filesystems need to report a non-zero f_fsid
This contains (1) and allows filesystems to encode non-decodable file
handlers for fanotify without implementing any exportfs operations by
encoding a file id of type FILEID_INO64_GEN from i_ino and
i_generation.
Filesystems that want to opt out of encoding non-decodable file ids
for fanotify that don't support NFS export can do so by providing an
empty export_operations struct.
This also partially addresses (2) by generating f_fsid for simple
filesystems as well as freevxfs. Remaining filesystems will be dealt
with by separate patches.
Finally, this contains the patch from the current exportfs maintainers
which moves exportfs under vfs with Chuck, Jeff, and Amir as
maintainers and vfs.git as tree"
* tag 'vfs-6.7.fsid' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
MAINTAINERS: create an entry for exportfs
fs: fix build error with CONFIG_EXPORTFS=m or not defined
freevxfs: derive f_fsid from bdev->bd_dev
fs: report f_fsid from s_dev for "simple" filesystems
exportfs: support encoding non-decodeable file handles by default
exportfs: define FILEID_INO64_GEN* file handle types
exportfs: make ->encode_fh() a mandatory method for NFS export
exportfs: add helpers to check if filesystem can encode/decode file handles
Pull non-MM updates from Andrew Morton:
"As usual, lots of singleton and doubleton patches all over the tree
and there's little I can say which isn't in the individual changelogs.
The lengthier patch series are
- 'kdump: use generic functions to simplify crashkernel reservation
in arch', from Baoquan He. This is mainly cleanups and
consolidation of the 'crashkernel=' kernel parameter handling
- After much discussion, David Laight's 'minmax: Relax type checks in
min() and max()' is here. Hopefully reduces some typecasting and
the use of min_t() and max_t()
- A group of patches from Oleg Nesterov which clean up and slightly
fix our handling of reads from /proc/PID/task/... and which remove
task_struct.thread_group"
* tag 'mm-nonmm-stable-2023-11-02-14-08' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (64 commits)
scripts/gdb/vmalloc: disable on no-MMU
scripts/gdb: fix usage of MOD_TEXT not defined when CONFIG_MODULES=n
.mailmap: add address mapping for Tomeu Vizoso
mailmap: update email address for Claudiu Beznea
tools/testing/selftests/mm/run_vmtests.sh: lower the ptrace permissions
.mailmap: map Benjamin Poirier's address
scripts/gdb: add lx_current support for riscv
ocfs2: fix a spelling typo in comment
proc: test ProtectionKey in proc-empty-vm test
proc: fix proc-empty-vm test with vsyscall
fs/proc/base.c: remove unneeded semicolon
do_io_accounting: use sig->stats_lock
do_io_accounting: use __for_each_thread()
ocfs2: replace BUG_ON() at ocfs2_num_free_extents() with ocfs2_error()
ocfs2: fix a typo in a comment
scripts/show_delta: add __main__ judgement before main code
treewide: mark stuff as __ro_after_init
fs: ocfs2: check status values
proc: test /proc/${pid}/statm
compiler.h: move __is_constexpr() to compiler.h
...
Pull fsnotify update from Jan Kara:
"This time just one tiny cleanup for fsnotify"
* tag 'fsnotify_for_v6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs:
fanotify: delete useless parenthesis in FANOTIFY_INLINE_FH macro
Greg Kroah-Hartman
Amir Goldstein
Jann Horn
Paul Lawrence
Matthias Maennich
Lizhi Xu
Jan Kara
Linus Torvalds
Christian Brauner
Lee Jones
Al Viro
Will McVicker
Gustavo A. R. Silva
Nikita Kiryushin
Winston Wen
Joel Granados