This reverts commit ce23b73f0f which is
commit 1d6123102e9fbedc8d25bf4731da6d513173e49e upstream.
It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.
Bug: 161946584
Change-Id: Id61431c9decd8e97b69d0a3871b2658242c092ee
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
GKI (arm64) relevant 43 out of 213 changes, affecting 47 files +324/-116
8a997e1ab5 mailbox: Not protect module_put with spin_lock_irqsave [1 file, +1/-1]
dcd5b32139 leds: multicolor: Fix intensity setting while SW blinking [1 file, +2/-1]
3a0f33c420 fuse: fix race between concurrent setattrs from multiple nodes [1 file, +11/-0]
9f0fa01811 PCI: dwc: Make link training more robust by setting PORT_LOGIC_LINK_WIDTH to one lane [1 file, +1/-4]
53809d38ec usb: Add checks for snprintf() calls in usb_alloc_dev() [1 file, +10/-4]
cf69fedbb1 usb: gadget: f_hid: wake up readers on disable/unbind [1 file, +17/-2]
10cc2cfd3e usb: typec: displayport: Receive DP Status Update NAK request exit dp altmode [1 file, +4/-0]
1ef2737432 usb: typec: mux: do not return on EOPNOTSUPP in {mux, switch}_set [1 file, +2/-2]
1818fc3602 ALSA: usb-audio: Add a quirk for Lenovo Thinkpad Thunderbolt 3 dock [1 file, +2/-0]
ae2353d862 scsi: ufs: core: Don't perform UFS clkscaling during host async scan [1 file, +3/-0]
0437390086 ovl: Check for NULL d_inode() in ovl_dentry_upper() [1 file, +3/-1]
4149f0ee5e f2fs: don't over-report free space or inodes in statvfs [1 file, +18/-12]
61a9ad7b69 af_unix: Don't leave consecutive consumed OOB skbs. [1 file, +11/-2]
93abf5e0d5 fs/proc/task_mmu: fix PAGE_IS_PFNZERO detection for the huge zero folio [1 file, +1/-1]
29d39e0d5f lib/group_cpus: fix NULL pointer dereference from group_cpus_evenly() [1 file, +8/-1]
a4f182ffa3 HID: wacom: fix crash in wacom_aes_battery_handler() [1 file, +1/-0]
ce23b73f0f Bluetooth: hci_core: Fix use-after-free in vhci_flush() [2 files, +32/-4]
0ee87c2814 ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() [1 file, +2/-0]
b10a795364 attach_recursive_mnt(): do not lock the covering tree when sliding something under it [1 file, +4/-4]
949060a623 af_unix: Don't set -ECONNRESET for consumed OOB skb. [1 file, +12/-6]
dbcd546400 vsock/uapi: fix linux/vm_sockets.h userspace compilation errors [1 file, +4/-0]
104048a4a4 net: selftests: fix TCP packet checksum [1 file, +3/-2]
2b8788496f serial: core: restore of_node information in sysfs [1 file, +1/-0]
5a8400ebc2 Bluetooth: L2CAP: Fix L2CAP MTU negotiation [1 file, +8/-1]
cf95f8426f maple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate() [1 file, +3/-1]
7b4ac8433c mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked" [1 file, +10/-4]
c465f52333 f2fs: fix to zero post-eof page [1 file, +38/-0]
a85999b987 HID: wacom: fix memory leak on kobject creation failure [1 file, +3/-1]
2746d02066 HID: wacom: fix memory leak on sysfs attribute creation failure [1 file, +1/-0]
70017f56b1 HID: wacom: fix kobject reference count leak [1 file, +1/-0]
6a87e79404 scsi: ufs: core: Fix clk scaling to be conditional in reset and restore [1 file, +2/-1]
0519b61075 media: uvcvideo: Rollback non processed entities on error [1 file, +23/-11]
8b8a366e8c io_uring: fix potential page leak in io_sqe_buffer_register() [1 file, +5/-4]
53fd75f25b io_uring/rsrc: fix folio unpinning [1 file, +9/-4]
50998b0ae7 io_uring/rsrc: don't rely on user vaddr alignment [2 files, +5/-1]
399214d703 io_uring/net: improve recv bundles [1 file, +18/-0]
0c07f2bf49 io_uring/net: only retry recv bundle for a full transfer [1 file, +10/-4]
725fcba8bd io_uring/net: only consider msg_inq if larger than 1 [1 file, +2/-2]
b8be3ae062 io_uring/net: always use current transfer count for buffer put [1 file, +1/-1]
c8d152b8c1 io_uring/net: mark iov as dynamically allocated even for single segments [1 file, +6/-5]
560c3b51c7 io_uring/kbuf: flag partial buffer mappings [3 files, +17/-8]
1f4b030e08 mm/vma: reset VMA iterator on commit_merge() OOM failure [1 file, +8/-19]
287b9cec2e usb: typec: tcpm: PSSourceOffTimer timeout in PR_Swap enters ERROR_RECOVERY [1 file, +1/-2]
Changes in 6.12.36
cifs: Correctly set SMB1 SessionKey field in Session Setup Request
cifs: Fix cifs_query_path_info() for Windows NT servers
cifs: Fix encoding of SMB1 Session Setup NTLMSSP Request in non-UNICODE mode
NFSv4: Always set NLINK even if the server doesn't support it
NFSv4.2: fix listxattr to return selinux security label
NFSv4.2: fix setattr caching of TIME_[MODIFY|ACCESS]_SET when timestamps are delegated
mailbox: Not protect module_put with spin_lock_irqsave
mfd: max14577: Fix wakeup source leaks on device unbind
sunrpc: don't immediately retransmit on seqno miss
dm vdo indexer: don't read request structure after enqueuing
leds: multicolor: Fix intensity setting while SW blinking
fuse: fix race between concurrent setattrs from multiple nodes
cxl/region: Add a dev_err() on missing target list entries
NFSv4: xattr handlers should check for absent nfs filehandles
hwmon: (pmbus/max34440) Fix support for max34451
ksmbd: allow a filename to contain special characters on SMB3.1.1 posix extension
ksmbd: provide zero as a unique ID to the Mac client
rust: module: place cleanup_module() in .exit.text section
rust: arm: fix unknown (to Clang) argument '-mno-fdpic'
dmaengine: idxd: Check availability of workqueue allocated by idxd wq driver before using
dmaengine: xilinx_dma: Set dma_device directions
PCI: dwc: Make link training more robust by setting PORT_LOGIC_LINK_WIDTH to one lane
PCI: apple: Fix missing OF node reference in apple_pcie_setup_port
PCI: imx6: Add workaround for errata ERR051624
nvme-tcp: fix I/O stalls on congested sockets
nvme-tcp: sanitize request list handling
md/md-bitmap: fix dm-raid max_write_behind setting
amd/amdkfd: fix a kfd_process ref leak
bcache: fix NULL pointer in cache_set_flush()
drm/amdgpu: seq64 memory unmap uses uninterruptible lock
drm/scheduler: signal scheduled fence when kill job
iio: pressure: zpa2326: Use aligned_s64 for the timestamp
um: Add cmpxchg8b_emu and checksum functions to asm-prototypes.h
um: use proper care when taking mmap lock during segfault
8250: microchip: pci1xxxx: Add PCIe Hot reset disable support for Rev C0 and later devices
coresight: Only check bottom two claim bits
usb: dwc2: also exit clock_gating when stopping udc while suspended
iio: adc: ad_sigma_delta: Fix use of uninitialized status_pos
misc: tps6594-pfsm: Add NULL pointer check in tps6594_pfsm_probe()
usb: potential integer overflow in usbg_make_tpg()
tty: serial: uartlite: register uart driver in init
usb: common: usb-conn-gpio: use a unique name for usb connector device
usb: Add checks for snprintf() calls in usb_alloc_dev()
usb: cdc-wdm: avoid setting WDM_READ for ZLP-s
usb: gadget: f_hid: wake up readers on disable/unbind
usb: typec: displayport: Receive DP Status Update NAK request exit dp altmode
usb: typec: mux: do not return on EOPNOTSUPP in {mux, switch}_set
riscv: add a data fence for CMODX in the kernel mode
ALSA: hda: Ignore unsol events for cards being shut down
ALSA: hda: Add new pci id for AMD GPU display HD audio controller
ALSA: usb-audio: Add a quirk for Lenovo Thinkpad Thunderbolt 3 dock
ASoC: rt1320: fix speaker noise when volume bar is 100%
ceph: fix possible integer overflow in ceph_zero_objects()
scsi: ufs: core: Don't perform UFS clkscaling during host async scan
ovl: Check for NULL d_inode() in ovl_dentry_upper()
btrfs: handle csum tree error with rescue=ibadroots correctly
drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1
Revert "drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1"
btrfs: factor out nocow ordered extent and extent map generation into a helper
btrfs: use unsigned types for constants defined as bit shifts
btrfs: fix qgroup reservation leak on failure to allocate ordered extent
fs/jfs: consolidate sanity checking in dbMount
jfs: validate AG parameters in dbMount() to prevent crashes
ASoC: codec: wcd9335: Convert to GPIO descriptors
ASoC: codecs: wcd9335: Fix missing free of regulator supplies
f2fs: don't over-report free space or inodes in statvfs
PCI: apple: Use helper function for_each_child_of_node_scoped()
PCI: apple: Set only available ports up
accel/ivpu: Do not fail on cmdq if failed to allocate preemption buffers
accel/ivpu: Remove copy engine support
accel/ivpu: Make command queue ID allocated on XArray
accel/ivpu: Separate DB ID and CMDQ ID allocations from CMDQ allocation
accel/ivpu: Add debugfs interface for setting HWS priority bands
accel/ivpu: Trigger device recovery on engine reset/resume failure
af_unix: Don't leave consecutive consumed OOB skbs.
i2c: tiny-usb: disable zero-length read messages
i2c: robotfuzz-osif: disable zero-length read messages
ata: ahci: Use correct DMI identifier for ASUSPRO-D840SA LPM quirk
smb: client: remove \t from TP_printk statements
mm/damon/sysfs-schemes: free old damon_sysfs_scheme_filter->memcg_path on write
ASoC: amd: yc: Add DMI quirk for Lenovo IdeaPad Slim 5 15
s390/pkey: Prevent overflow in size calculation for memdup_user()
fs/proc/task_mmu: fix PAGE_IS_PFNZERO detection for the huge zero folio
lib/group_cpus: fix NULL pointer dereference from group_cpus_evenly()
Revert "riscv: Define TASK_SIZE_MAX for __access_ok()"
Revert "riscv: misaligned: fix sleeping function called during misaligned access handling"
drm/xe/display: Add check for alloc_ordered_workqueue()
HID: wacom: fix crash in wacom_aes_battery_handler()
atm: clip: prevent NULL deref in clip_push()
Bluetooth: hci_core: Fix use-after-free in vhci_flush()
ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3()
attach_recursive_mnt(): do not lock the covering tree when sliding something under it
libbpf: Fix null pointer dereference in btf_dump__free on allocation failure
ethernet: ionic: Fix DMA mapping tests
wifi: mac80211: fix beacon interval calculation overflow
af_unix: Don't set -ECONNRESET for consumed OOB skb.
wifi: mac80211: Add link iteration macro for link data
wifi: mac80211: Create separate links for VLAN interfaces
wifi: mac80211: finish link init before RCU publish
vsock/uapi: fix linux/vm_sockets.h userspace compilation errors
bnxt: properly flush XDP redirect lists
um: ubd: Add missing error check in start_io_thread()
libbpf: Fix possible use-after-free for externs
net: enetc: Correct endianness handling in _enetc_rd_reg64
netlink: specs: tc: replace underscores with dashes in names
atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister().
ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X507UAR
net: selftests: fix TCP packet checksum
drm/amdgpu/discovery: optionally use fw based ip discovery
drm/amd: Adjust output for discovery error handling
drm/i915: fix build error some more
drm/bridge: ti-sn65dsi86: make use of debugfs_init callback
drm/bridge: ti-sn65dsi86: Add HPD for DisplayPort connector type
drm/xe: Process deferred GGTT node removals on device unwind
smb: client: fix potential deadlock when reconnecting channels
smb: smbdirect: add smbdirect_pdu.h with protocol definitions
smb: client: make use of common smbdirect_pdu.h
smb: smbdirect: add smbdirect.h with public structures
smb: smbdirect: add smbdirect_socket.h
smb: client: make use of common smbdirect_socket
smb: smbdirect: introduce smbdirect_socket_parameters
smb: client: make use of common smbdirect_socket_parameters
cifs: Fix the smbd_response slab to allow usercopy
cifs: Fix reading into an ITER_FOLIOQ from the smbdirect code
EDAC/amd64: Fix size calculation for Non-Power-of-Two DIMMs
x86/traps: Initialize DR6 by writing its architectural reset value
staging: rtl8723bs: Avoid memset() in aes_cipher() and aes_decipher()
dt-bindings: serial: 8250: Make clocks and clock-frequency exclusive
serial: core: restore of_node information in sysfs
serial: imx: Restore original RXTL for console to fix data loss
Bluetooth: L2CAP: Fix L2CAP MTU negotiation
dm-raid: fix variable in journal device check
btrfs: fix a race between renames and directory logging
btrfs: update superblock's device bytes_used when dropping chunk
spi: spi-cadence-quadspi: Fix pm runtime unbalance
net: libwx: fix the creation of page_pool
maple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate()
mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked"
f2fs: fix to zero post-eof page
HID: lenovo: Restrict F7/9/11 mode to compact keyboards only
HID: wacom: fix memory leak on kobject creation failure
HID: wacom: fix memory leak on sysfs attribute creation failure
HID: wacom: fix kobject reference count leak
scsi: megaraid_sas: Fix invalid node index
scsi: ufs: core: Fix clk scaling to be conditional in reset and restore
drm/ast: Fix comment on modeset lock
drm/cirrus-qemu: Fix pitch programming
drm/etnaviv: Protect the scheduler's pending list with its lock
drm/tegra: Assign plane type before registration
drm/tegra: Fix a possible null pointer dereference
drm/udl: Unregister device before cleaning up on disconnect
drm/msm/gpu: Fix crash when throttling GPU immediately during boot
drm/amdkfd: Fix race in GWS queue scheduling
drm/bridge: cdns-dsi: Fix the clock variable for mode_valid()
drm/bridge: cdns-dsi: Fix phy de-init and flag it so
drm/bridge: cdns-dsi: Fix connecting to next bridge
drm/bridge: cdns-dsi: Check return value when getting default PHY config
drm/bridge: cdns-dsi: Wait for Clk and Data Lanes to be ready
drm/amd/display: Add null pointer check for get_first_active_display()
drm/amdgpu: amdgpu_vram_mgr_new(): Clamp lpfn to total vram
drm/amd/display: Correct non-OLED pre_T11_delay.
drm/xe/vm: move rebind_work init earlier
drm/xe/sched: stop re-submitting signalled jobs
drm/xe/guc_submit: add back fix
drm/amd/display: Fix RMCM programming seq errors
drm/amdgpu: Add kicker device detection
drm/amd/display: Check dce_hwseq before dereferencing it
drm/xe: Fix memset on iomem
drm/xe: Fix taking invalid lock on wedge
drm/xe: Fix early wedge on GuC load failure
drm/i915/dsi: Fix off by one in BXT_MIPI_TRANS_VTOTAL
drm/amdgpu: Fix SDMA UTC_L1 handling during start/stop sequences
drm/amdgpu: switch job hw_fence to amdgpu_fence
drm/amd/display: Fix mpv playback corruption on weston
media: uvcvideo: Rollback non processed entities on error
x86/fpu: Refactor xfeature bitmask update code for sigframe XSAVE
x86/pkeys: Simplify PKRU update in signal frame
net: libwx: fix Tx L4 checksum
io_uring: fix potential page leak in io_sqe_buffer_register()
io_uring/rsrc: fix folio unpinning
io_uring/rsrc: don't rely on user vaddr alignment
io_uring/net: improve recv bundles
io_uring/net: only retry recv bundle for a full transfer
io_uring/net: only consider msg_inq if larger than 1
io_uring/net: always use current transfer count for buffer put
io_uring/net: mark iov as dynamically allocated even for single segments
io_uring/kbuf: flag partial buffer mappings
mm/vma: reset VMA iterator on commit_merge() OOM failure
r8169: add support for RTL8125D
net: phy: realtek: merge the drivers for internal NBase-T PHY's
net: phy: realtek: add RTL8125D-internal PHY
btrfs: do proper folio cleanup when cow_file_range() failed
iio: dac: ad3552r: changes to use FIELD_PREP
iio: dac: ad3552r: extract common code (no changes in behavior intended)
iio: dac: ad3552r-common: fix ad3541/2r ranges
drm/xe: Carve out wopcm portion from the stolen memory
usb: typec: tcpm: PSSourceOffTimer timeout in PR_Swap enters ERROR_RECOVERY
drm/msm/dp: account for widebus and yuv420 during mode validation
drm/fbdev-dma: Add shadow buffering for deferred I/O
btrfs: skip inodes without loaded extent maps when shrinking extent maps
btrfs: make the extent map shrinker run asynchronously as a work queue job
btrfs: do regular iput instead of delayed iput during extent map shrinking
riscv/atomic: Do proper sign extension also for unsigned in arch_cmpxchg
arm64: dts: rockchip: Add avdd HDMI supplies to RockPro64 board dtsi
ALSA: hda/realtek: Bass speaker fixup for ASUS UM5606KA
drm/amdkfd: remove gfx 12 trap handler page size cap
drm/amdkfd: Fix instruction hazard in gfx12 trap handler
net: stmmac: Fix accessing freed irq affinity_hint
spi: fsl-qspi: use devm function instead of driver remove
btrfs: zoned: fix extent range end unlock in cow_file_range()
btrfs: fix use-after-free on inode when scanning root during em shrinking
spi: fsl-qspi: Fix double cleanup in probe error path
Linux 6.12.36
Change-Id: Ie7748fa6d766a9cf7800e67297e404cb90bd359c
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
GKI (arm64) relevant 87 out of 414 changes, affecting 112 files +738/-352
bdb71ee651 configfs: Do not override creating attribute file failure in populate_attrs() [1 file, +1/-1]
ba789be63d io_uring: account drain memory to cgroup [1 file, +1/-1]
c58b577cf7 io_uring/kbuf: account ring io_buffer_list memory [1 file, +1/-1]
f78b38af35 jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() [1 file, +3/-2]
2429bb9fad media: v4l2-dev: fix error handling in __video_register_device() [1 file, +7/-7]
5d8b057ed7 media: videobuf2: use sgtable-based scatterlist wrappers [1 file, +2/-2]
b52dc88361 media: uvcvideo: Return the number of processed controls [1 file, +10/-1]
6d2b12e7c5 media: uvcvideo: Send control events for partial succeeds [1 file, +9/-3]
aac91ae06c media: uvcvideo: Fix deferred probing error [1 file, +19/-8]
86d9837e46 arm64/mm: Close theoretical race where stale TLB entry remains valid [1 file, +5/-4]
5538af3843 block: use plug request list tail for one-shot backmerge attempt [1 file, +13/-13]
943801c380 block: Clear BIO_EMULATES_ZONE_APPEND flag on BIO completion [1 file, +1/-0]
1c71f3cf5f cgroup,freezer: fix incomplete freezing when attaching tasks [1 file, +1/-2]
a0890b7805 bus: firewall: Fix missing static inline annotations for stubs [1 file, +9/-6]
5766da2237 ext4: inline: fix len overflow in ext4_prepare_inline_data [1 file, +1/-1]
796632e6f8 ext4: fix calculation of credits for extent tree modification [1 file, +6/-5]
4b36399711 ext4: ensure i_size is smaller than maxbytes [1 file, +2/-1]
be5f3061a6 ext4: only dirty folios when data journaling regular files [1 file, +6/-1]
a0b1c91ada Input: gpio-keys - fix possible concurrent access in gpio_keys_irq_timer() [1 file, +2/-0]
fed611bd8c f2fs: fix to do sanity check on ino and xnid [1 file, +6/-0]
aaa644e7ff f2fs: prevent kernel warning due to negative i_nlink from corrupted image [1 file, +9/-0]
ee1b421c46 f2fs: fix to do sanity check on sit_bitmap_size [1 file, +8/-0]
f16a797dce watchdog: fix watchdog may detect false positive of softlockup [1 file, +27/-14]
02137179ff mm: fix ratelimit_pages update error in dirty_ratio_handler() [1 file, +1/-1]
462eee6d42 firmware: arm_scmi: Ensure that the message-id supports fastchannel [2 files, +45/-33]
e3cf1ef571 dm-verity: fix a memory leak if some arguments are specified multiple times [3 files, +24/-5]
f2986bccf2 dm: lock limits when reading them [1 file, +7/-1]
ec5f0b4412 ovl: Fix nested backing file paths [1 file, +2/-2]
92776ca0cc remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach() [1 file, +2/-3]
f4ef928ca5 remoteproc: core: Release rproc->clean_table after rproc_attach() fails [1 file, +1/-0]
68e58f5791 PCI: dwc: ep: Correct PBA offset in .set_msix() callback [1 file, +3/-2]
b20701d594 PCI: Add ACS quirk for Loongson PCIe [1 file, +23/-0]
be0cf75cbd PCI: Fix lock symmetry in pci_slot_unlock() [1 file, +2/-1]
7b45d2401d clocksource: Fix the CPUs' choice in the watchdog per CPU verification [1 file, +1/-1]
c05aba32a9 ACPICA: Avoid sequence overread in call to strncmp() [1 file, +1/-1]
66613b13cd ACPI: Add missing prototype for non CONFIG_SUSPEND/CONFIG_X86 case [1 file, +8/-1]
33cd650d38 pmdomain: core: Reset genpd->states to avoid freeing invalid data [1 file, +3/-1]
f34e0c1556 platform-msi: Add msi_remove_device_irq_domain() in platform_device_msi_free_irqs_all() [1 file, +1/-0]
c519f81e9c gpiolib: of: Add polarity quirk for s5m8767 [1 file, +9/-0]
1f152ae557 PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn() [1 file, +1/-1]
6c1151d53c tipc: use kfree_sensitive() for aead cleanup [1 file, +1/-1]
b0e647442c f2fs: use vmalloc instead of kvmalloc in .init_{,de}compress_ctx [2 files, +15/-13]
2d834477bb bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem() [1 file, +2/-1]
77ff6aec7c cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs [1 file, +35/-1]
0a8446058c tcp: always seek for minimal rtt in tcp_rcv_rtt_update() [1 file, +8/-14]
f97085d365 tcp: remove zero TCP TS samples for autotuning [1 file, +5/-5]
89b20c406e tcp: fix initial tp->rcvq_space.space value for passive TS enabled flows [1 file, +3/-3]
84c156a351 tcp: add receive queue awareness in tcp_rcv_space_adjust() [2 files, +5/-3]
3a9e74d158 ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT [1 file, +4/-0]
5eb9c50e0c net: page_pool: Don't recycle into cache on PREEMPT_RT [1 file, +4/-0]
8b0741b167 xfrm: validate assignment of maximal possible SEQ number [1 file, +42/-10]
8fdf2f79eb bpf: Pass the same orig_call value to trampoline functions [1 file, +1/-1]
f0023d7a2a f2fs: fix to bail out in get_new_segment() [2 files, +6/-1]
448dc45eea bpf: Use proper type to calculate bpf_raw_tp_null_args.mask index [1 file, +2/-2]
78f768e36c net: bridge: mcast: re-implement br_multicast_{enable, disable}_port functions [1 file, +69/-8]
4b3383110b software node: Correct a OOB check in software_node_get_reference_args() [1 file, +1/-1]
b7129ef57d sock: Correct error checking condition for (assign|release)_proto_idx() [1 file, +2/-2]
a58f0a0e99 f2fs: fix to set atomic write status more clear [3 files, +12/-2]
b8b4b8bb34 bpf, sockmap: Fix data lost during EAGAIN retries [1 file, +2/-1]
7c41f73b64 fs/xattr.c: fix simple_xattr_list() [1 file, +1/-0]
2e10dc9c2a io_uring/kbuf: don't truncate end buffer for multiple buffer peeks [1 file, +4/-1]
1a4254ab06 io_uring: fix task leak issue in io_wq_create() [1 file, +3/-1]
4220cc0b98 nvme: always punt polled uring_cmd end_io work to task_work [1 file, +7/-14]
f9b97d466e net_sched: sch_sfq: reject invalid perturb period [1 file, +8/-2]
2a3ad42a57 net: clear the dst when changing skb protocol [1 file, +13/-6]
510a29d776 mm: close theoretical race where stale TLB entries could linger [1 file, +2/-0]
57ec081869 sched_ext, sched/core: Don't call scx_group_set_weight() prematurely from sched_create_group() [3 files, +9/-2]
3d828519bd atm: Revert atm_account_tx() if copy_from_iter_full() fails. [3 files, +8/-1]
47f34289d1 arm64: Restrict pagetable teardown to avoid false warning [1 file, +2/-1]
9cf5b2a3b7 mm/hugetlb: unshare page tables during VMA split, not before [5 files, +57/-16]
dc5f0aef9e net: Fix checksum update for ILA adj-transport [4 files, +7/-7]
2516299184 bpf: Fix L4 csum update on IPv6 in CHECKSUM_COMPLETE [3 files, +7/-2]
50189d9c5e erofs: remove unused trace event erofs_destroy_inode [1 file, +0/-18]
348e541fef ipv6: remove leftover ip6 cookie initializer [1 file, +0/-2]
3c44ebad5a ipv6: replace ipcm6_init calls with ipcm6_init_sk [4 files, +3/-29]
6b358b3adf io_uring/sqpoll: don't put task_struct on tctx setup failure [1 file, +1/-4]
8873080b88 workqueue: Initialize wq_isolated_cpumask in workqueue_init_early() [1 file, +2/-1]
ac462a75fd net: netmem: fix skb_ensure_writable with unreadable skbs [1 file, +0/-3]
61b39e189d ptp: allow reading of currently dialed frequency to succeed on free-running clocks [1 file, +2/-1]
397c1faf8f tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen() behavior [1 file, +25/-12]
0d3d91c350 tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer [1 file, +2/-2]
31d50dfe9c tcp: fix passive TFO socket having invalid NAPI ID [1 file, +3/-0]
0f8df5d6f2 ublk: santizize the arguments from userspace when adding a device [1 file, +3/-0]
456019adaa perf: Fix sample vs do_exit() [2 files, +16/-8]
7335c33d62 perf: Fix cgroup state vs ERROR [1 file, +30/-21]
fd199366bf perf/core: Fix WARN in perf_cgroup_switch() [1 file, +20/-2]
22f935bc86 arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() [1 file, +1/-1]
Changes in 6.12.35
configfs: Do not override creating attribute file failure in populate_attrs()
crypto: marvell/cesa - Do not chain submitted requests
gfs2: move msleep to sleepable context
crypto: qat - add shutdown handler to qat_c3xxx
crypto: qat - add shutdown handler to qat_420xx
crypto: qat - add shutdown handler to qat_4xxx
crypto: qat - add shutdown handler to qat_c62x
crypto: qat - add shutdown handler to qat_dh895xcc
ASoC: qcom: sdm845: Add error handling in sdm845_slim_snd_hw_params()
ASoC: meson: meson-card-utils: use of_property_present() for DT parsing
ASoC: amd: sof_amd_sdw: Fix unlikely uninitialized variable use in create_sdw_dailinks()
io_uring: account drain memory to cgroup
io_uring/kbuf: account ring io_buffer_list memory
powerpc/pseries/msi: Avoid reading PCI device registers in reduced power states
s390/pci: Remove redundant bus removal and disable from zpci_release_device()
s390/pci: Prevent self deletion in disable_slot()
s390/pci: Allow re-add of a reserved but not yet removed device
s390/pci: Serialize device addition and removal
regulator: max20086: Fix MAX200086 chip id
regulator: max20086: Change enable gpio to optional
net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr()
net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid()
wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback()
wifi: mt76: mt7925: fix host interrupt register initialization
wifi: ath11k: fix rx completion meta data corruption
wifi: rtw88: usb: Upload the firmware in bigger chunks
wifi: ath11k: fix ring-buffer corruption
NFSD: unregister filesystem in case genl_register_family() fails
NFSD: fix race between nfsd registration and exports_proc
NFSD: Implement FATTR4_CLONE_BLKSIZE attribute
nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request
nfsd: Initialize ssc before laundromat_work to prevent NULL dereference
SUNRPC: Prevent hang on NFS mount with xprtsec=[m]tls
NFSv4: Don't check for OPEN feature support in v4.1
fs/nfs/read: fix double-unlock bug in nfs_return_empty_folio()
wifi: ath12k: fix ring-buffer corruption
jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata()
svcrdma: Unregister the device if svc_rdma_accept() fails
wifi: rtw88: usb: Reduce control message timeout to 500 ms
wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID 11ad:1723
media: ov8856: suppress probe deferral errors
media: ov5675: suppress probe deferral errors
media: imx335: Use correct register width for HNUM
media: nxp: imx8-isi: better handle the m2m usage_count
media: i2c: ds90ub913: Fix returned fmt from .set_fmt()
media: ccs-pll: Start VT pre-PLL multiplier search from correct value
media: ov2740: Move pm-runtime cleanup on probe-errors to proper place
media: ccs-pll: Start OP pre-PLL multiplier search from correct value
media: ccs-pll: Correct the upper limit of maximum op_pre_pll_clk_div
media: ccs-pll: Check for too high VT PLL multiplier in dual PLL case
media: cxusb: no longer judge rbuf when the write fails
media: davinci: vpif: Fix memory leak in probe error path
media: gspca: Add error handling for stv06xx_read_sensor()
media: i2c: imx335: Fix frame size enumeration
media: imagination: fix a potential memory leak in e5010_probe()
media: intel/ipu6: Fix dma mask for non-secure mode
media: ipu6: Remove workaround for Meteor Lake ES2
media: mediatek: vcodec: Correct vsi_core framebuffer size
media: omap3isp: use sgtable-based scatterlist wrappers
media: v4l2-dev: fix error handling in __video_register_device()
media: venus: Fix probe error handling
media: videobuf2: use sgtable-based scatterlist wrappers
media: vidtv: Terminating the subsequent process of initialization failure
media: vivid: Change the siize of the composing
media: imx-jpeg: Drop the first error frames
media: imx-jpeg: Move mxc_jpeg_free_slot_data() ahead
media: imx-jpeg: Reset slot data pointers when freed
media: imx-jpeg: Cleanup after an allocation error
media: uvcvideo: Return the number of processed controls
media: uvcvideo: Send control events for partial succeeds
media: uvcvideo: Fix deferred probing error
arm64/mm: Close theoretical race where stale TLB entry remains valid
ARM: 9447/1: arm/memremap: fix arch_memremap_can_ram_remap()
ARM: omap: pmic-cpcap: do not mess around without CPCAP or OMAP4
ASoC: codecs: wcd9375: Fix double free of regulator supplies
ASoC: codecs: wcd937x: Drop unused buck_supply
block: use plug request list tail for one-shot backmerge attempt
block: Clear BIO_EMULATES_ZONE_APPEND flag on BIO completion
bus: mhi: ep: Update read pointer only after buffer is written
bus: mhi: host: Fix conflict between power_up and SYSERR
can: kvaser_pciefd: refine error prone echo_skb_max handling logic
can: tcan4x5x: fix power regulator retrieval during probe
ceph: avoid kernel BUG for encrypted inode with unaligned file size
ceph: set superblock s_magic for IMA fsmagic matching
cgroup,freezer: fix incomplete freezing when attaching tasks
bus: firewall: Fix missing static inline annotations for stubs
ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330
ata: ahci: Disallow LPM for ASUSPRO-D840SA motherboard
ata: ahci: Disallow LPM for Asus B550-F motherboard
bus: fsl-mc: do not add a device-link for the UAPI used DPMCP device
bus: fsl-mc: fix GET/SET_TAILDROP command ids
ext4: inline: fix len overflow in ext4_prepare_inline_data
ext4: fix calculation of credits for extent tree modification
ext4: factor out ext4_get_maxbytes()
ext4: ensure i_size is smaller than maxbytes
ext4: only dirty folios when data journaling regular files
Input: ims-pcu - check record size in ims_pcu_flash_firmware()
Input: gpio-keys - fix possible concurrent access in gpio_keys_irq_timer()
f2fs: fix to do sanity check on ino and xnid
f2fs: prevent kernel warning due to negative i_nlink from corrupted image
f2fs: fix to do sanity check on sit_bitmap_size
hwmon: (ftsteutates) Fix TOCTOU race in fts_read()
NFC: nci: uart: Set tty->disc_data only in success path
net/sched: fix use-after-free in taprio_dev_notifier
net: ftgmac100: select FIXED_PHY
iommu/vt-d: Restore context entry setup order for aliased devices
fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var
EDAC/altera: Use correct write width with the INTTEST register
fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var
parisc/unaligned: Fix hex output to show 8 hex chars
vgacon: Add check for vc_origin address range in vgacon_scroll()
parisc: fix building with gcc-15
clk: meson-g12a: add missing fclk_div2 to spicc
ipc: fix to protect IPCS lookups using RCU
watchdog: fix watchdog may detect false positive of softlockup
RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction
mm: fix ratelimit_pages update error in dirty_ratio_handler()
soc: qcom: pmic_glink_altmode: fix spurious DP hotplug events
configfs-tsm-report: Fix NULL dereference of tsm_ops
firmware: arm_scmi: Ensure that the message-id supports fastchannel
mtd: rawnand: sunxi: Add randomizer configuration in sunxi_nfc_hw_ecc_write_chunk
mtd: nand: sunxi: Add randomizer configuration before randomizer enable
KVM: SVM: Clear current_vmcb during vCPU free for all *possible* CPUs
KVM: VMX: Flush shadow VMCS on emergency reboot
dm-mirror: fix a tiny race condition
dm-verity: fix a memory leak if some arguments are specified multiple times
mtd: rawnand: qcom: Fix read len for onfi param page
ftrace: Fix UAF when lookup kallsym after ftrace disabled
dm: lock limits when reading them
phy: fsl-imx8mq-usb: fix phy_tx_vboost_level_from_property()
net: ch9200: fix uninitialised access during mii_nway_restart
KVM: s390: rename PROT_NONE to PROT_TYPE_DUMMY
sysfb: Fix screen_info type check for VGA
video: screen_info: Relocate framebuffers behind PCI bridges
pwm: axi-pwmgen: fix missing separate external clock
staging: iio: ad5933: Correct settling cycles encoding per datasheet
mips: Add -std= flag specified in KBUILD_CFLAGS to vdso CFLAGS
ovl: Fix nested backing file paths
regulator: max14577: Add error check for max14577_read_reg()
remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach()
remoteproc: core: Release rproc->clean_table after rproc_attach() fails
remoteproc: k3-m4: Don't assert reset in detach routine
cifs: reset connections for all channels when reconnect requested
cifs: update dstaddr whenever channel iface is updated
cifs: dns resolution is needed only for primary channel
smb: client: add NULL check in automount_fullpath
Drivers: hv: Allocate interrupt and monitor pages aligned to system page boundary
uio_hv_generic: Use correct size for interrupt and monitor pages
uio_hv_generic: Align ring size to system page
PCI: cadence-ep: Correct PBA offset in .set_msix() callback
PCI: dwc: ep: Correct PBA offset in .set_msix() callback
PCI: Add ACS quirk for Loongson PCIe
PCI: Fix lock symmetry in pci_slot_unlock()
PCI: dw-rockchip: Remove PCIE_L0S_ENTRY check from rockchip_pcie_link_up()
PCI: dw-rockchip: Fix PHY function call sequence in rockchip_pcie_phy_deinit()
iio: accel: fxls8962af: Fix temperature scan element sign
accel/ivpu: Improve buffer object logging
accel/ivpu: Use firmware names from upstream repo
accel/ivpu: Use dma_resv_lock() instead of a custom mutex
accel/ivpu: Fix warning in ivpu_gem_bo_free()
dummycon: Trigger redraw when switching consoles with deferred takeover
mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race
iio: imu: inv_icm42600: Fix temperature calculation
iio: adc: ad7944: mask high bits on direct read
iio: adc: ti-ads1298: Kconfig: add kfifo dependency to fix module build
iio: adc: ad7606_spi: fix reg write value mask
ACPICA: fix acpi operand cache leak in dswstate.c
ASoC: amd: yc: Add quirk for Lenovo Yoga Pro 7 14ASP9
clocksource: Fix the CPUs' choice in the watchdog per CPU verification
power: supply: collie: Fix wakeup source leaks on device unbind
mmc: Add quirk to disable DDR50 tuning
ACPICA: Avoid sequence overread in call to strncmp()
ASoC: tas2770: Power cycle amp on ISENSE/VSENSE change
ASoC: intel/sdw_utils: Assign initial value in asoc_sdw_rt_amp_spk_rtd_init()
ACPI: bus: Bail out if acpi_kobj registration fails
ACPI: Add missing prototype for non CONFIG_SUSPEND/CONFIG_X86 case
ACPICA: fix acpi parse and parseext cache leaks
ACPICA: Apply pack(1) to union aml_resource
ALSA: hda: cs35l41: Fix swapped l/r audio channels for Acer Helios laptops
power: supply: bq27xxx: Retrieve again when busy
pmdomain: core: Reset genpd->states to avoid freeing invalid data
ACPICA: utilities: Fix overflow check in vsnprintf()
platform-msi: Add msi_remove_device_irq_domain() in platform_device_msi_free_irqs_all()
ASoC: tegra210_ahub: Add check to of_device_get_match_data()
Make 'cc-option' work correctly for the -Wno-xyzzy pattern
gpiolib: of: Add polarity quirk for s5m8767
PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn()
power: supply: max17040: adjust thermal channel scaling
ACPI: battery: negate current when discharging
net: macb: Check return value of dma_set_mask_and_coherent()
net: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices
tipc: use kfree_sensitive() for aead cleanup
f2fs: use vmalloc instead of kvmalloc in .init_{,de}compress_ctx
bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem()
Bluetooth: btusb: Add new VID/PID 13d3/3584 for MT7922
i2c: designware: Invoke runtime suspend on quick slave re-registration
wifi: mt76: mt7996: drop fragments with multicast or broadcast RA
emulex/benet: correct command version selection in be_cmd_get_stats()
Bluetooth: btusb: Add new VID/PID 13d3/3630 for MT7925
wifi: mt76: mt76x2: Add support for LiteOn WN4516R,WN4519R
wifi: mt76: mt7921: add 160 MHz AP for mt7922 device
wifi: mt76: mt7925: introduce thermal protection
wifi: mac80211: validate SCAN_FLAG_AP in scan request during MLO
sctp: Do not wake readers in __sctp_write_space()
libbpf/btf: Fix string handling to support multi-split BTF
cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs
i2c: tegra: check msg length in SMBUS block read
i2c: npcm: Add clock toggle recovery
clk: qcom: gcc-x1e80100: Set FORCE MEM CORE for UFS clocks
net: dlink: add synchronization for stats update
wifi: ath12k: fix macro definition HAL_RX_MSDU_PKT_LENGTH_GET
wifi: ath12k: fix a possible dead lock caused by ab->base_lock
wifi: ath11k: Fix QMI memory reuse logic
iommu/amd: Allow matching ACPI HID devices without matching UIDs
wifi: rtw89: leave idle mode when setting WEP encryption for AP mode
tcp: always seek for minimal rtt in tcp_rcv_rtt_update()
tcp: remove zero TCP TS samples for autotuning
tcp: fix initial tp->rcvq_space.space value for passive TS enabled flows
tcp: add receive queue awareness in tcp_rcv_space_adjust()
x86/sgx: Prevent attempts to reclaim poisoned pages
ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT
net: page_pool: Don't recycle into cache on PREEMPT_RT
xfrm: validate assignment of maximal possible SEQ number
net: atlantic: generate software timestamp just before the doorbell
pinctrl: armada-37xx: propagate error from armada_37xx_pmx_set_by_name()
pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get_direction()
bpf: Pass the same orig_call value to trampoline functions
net: stmmac: generate software timestamp just before the doorbell
pinctrl: armada-37xx: propagate error from armada_37xx_pmx_gpio_set_direction()
libbpf: Check bpf_map_skeleton link for NULL
pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get()
net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info
net: vertexcom: mse102x: Return code for mse102x_rx_pkt_spi
wireless: purelifi: plfxlc: fix memory leak in plfxlc_usb_wreq_asyn()
wifi: mac80211: do not offer a mesh path if forwarding is disabled
clk: rockchip: rk3036: mark ddrphy as critical
hid-asus: check ROG Ally MCU version and warn
wifi: iwlwifi: mvm: fix beacon CCK flag
f2fs: fix to bail out in get_new_segment()
netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX
libbpf: Add identical pointer detection to btf_dedup_is_equiv()
scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64 commands
scsi: smartpqi: Add new PCI IDs
iommu/amd: Ensure GA log notifier callbacks finish running before module unload
wifi: iwlwifi: pcie: make sure to lock rxq->read
wifi: rtw89: 8922a: fix TX fail with wrong VCO setting
wifi: mac80211_hwsim: Prevent tsf from setting if beacon is disabled
netdevsim: Mark NAPI ID on skb in nsim_rcv
net/mlx5: HWS, Fix IP version decision
bpf: Use proper type to calculate bpf_raw_tp_null_args.mask index
wifi: mac80211: VLAN traffic in multicast path
Revert "mac80211: Dynamically set CoDel parameters per station"
wifi: iwlwifi: Add missing MODULE_FIRMWARE for Qu-c0-jf-b0
net: bridge: mcast: update multicast contex when vlan state is changed
net: bridge: mcast: re-implement br_multicast_{enable, disable}_port functions
vxlan: Do not treat dst cache initialization errors as fatal
bnxt_en: Remove unused field "ref_count" in struct bnxt_ulp
wifi: ath12k: using msdu end descriptor to check for rx multicast packets
net: ethernet: ti: am65-cpsw: handle -EPROBE_DEFER
software node: Correct a OOB check in software_node_get_reference_args()
isofs: fix Y2038 and Y2156 issues in Rock Ridge TF entry
pinctrl: mcp23s08: Reset all pins to input at probe
wifi: ath12k: fix failed to set mhi state error during reboot with hardware grouping
scsi: lpfc: Use memcpy() for BIOS version
sock: Correct error checking condition for (assign|release)_proto_idx()
i40e: fix MMIO write access to an invalid page in i40e_clear_hw
ixgbe: Fix unreachable retry logic in combined and byte I2C write functions
RDMA/hns: initialize db in update_srq_db()
ice: fix check for existing switch rule
usbnet: asix AX88772: leave the carrier control to phylink
f2fs: fix to set atomic write status more clear
bpf, sockmap: Fix data lost during EAGAIN retries
net: ethernet: cortina: Use TOE/TSO on all TCP
octeontx2-pf: Add error log forcn10k_map_unmap_rq_policer()
wifi: ath11k: determine PM policy based on machine model
wifi: ath12k: fix link valid field initialization in the monitor Rx
wifi: ath12k: fix incorrect CE addresses
wifi: ath12k: Pass correct values of center freq1 and center freq2 for 160 MHz
net/mlx5: HWS, Harden IP version definer checks
fbcon: Make sure modelist not set on unregistered console
watchdog: da9052_wdt: respect TWDMIN
bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value
ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY
tee: Prevent size calculation wraparound on 32-bit kernels
Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first"
fs/xattr.c: fix simple_xattr_list()
platform/x86/amd: pmc: Clear metrics table at start of cycle
platform/x86/amd: pmf: Prevent amd_pmf_tee_deinit() from running twice
platform/x86: dell_rbu: Fix list usage
platform/x86: dell_rbu: Stop overwriting data buffer
powerpc/vdso: Fix build of VDSO32 with pcrel
powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH recovery
io_uring/kbuf: don't truncate end buffer for multiple buffer peeks
io_uring: fix task leak issue in io_wq_create()
drivers/rapidio/rio_cm.c: prevent possible heap overwrite
platform/loongarch: laptop: Get brightness setting from EC on probe
platform/loongarch: laptop: Unregister generic_sub_drivers on exit
platform/loongarch: laptop: Add backlight power control support
LoongArch: vDSO: Correctly use asm parameters in syscall wrappers
LoongArch: Avoid using $r0/$r1 as "mask" for csrxchg
LoongArch: Fix panic caused by NULL-PMD in huge_pte_offset()
jffs2: check that raw node were preallocated before writing summary
jffs2: check jffs2_prealloc_raw_node_refs() result in few other places
cifs: deal with the channel loading lag while picking channels
cifs: serialize other channels when query server interfaces is pending
cifs: do not disable interface polling on failure
smb: improve directory cache reuse for readdir operations
scsi: storvsc: Increase the timeouts to storvsc_timeout
scsi: s390: zfcp: Ensure synchronous unit_add
nvme: always punt polled uring_cmd end_io work to task_work
net_sched: sch_sfq: reject invalid perturb period
net: clear the dst when changing skb protocol
mm: close theoretical race where stale TLB entries could linger
udmabuf: use sgtable-based scatterlist wrappers
x86/virt/tdx: Avoid indirect calls to TDX assembly functions
selftests/x86: Add a test to detect infinite SIGTRAP handler loop
ksmbd: fix null pointer dereference in destroy_previous_session
platform/x86: ideapad-laptop: use usleep_range() for EC polling
selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len
platform/x86/intel-uncore-freq: Fail module load when plat_info is NULL
sched_ext, sched/core: Don't call scx_group_set_weight() prematurely from sched_create_group()
atm: Revert atm_account_tx() if copy_from_iter_full() fails.
wifi: rtw89: phy: add dummy C2H event handler for report of TAS power
cpufreq/amd-pstate: Add missing NULL ptr check in amd_pstate_update
Input: sparcspkr - avoid unannotated fall-through
wifi: ath12k: Clear affinity hint before calling ath12k_pci_free_irq() in error path
wifi: cfg80211: init wiphy_work before allocating rfkill fails
arm64: Restrict pagetable teardown to avoid false warning
ALSA: usb-audio: Rename ALSA kcontrol PCM and PCM1 for the KTMicro sound card
ALSA: hda/intel: Add Thinkpad E15 to PM deny list
ALSA: hda/realtek - Add mute LED support for HP Victus 16-s1xxx and HP Victus 15-fa1xxx
ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged
ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X513EA
ALSA: hda/realtek: Add quirk for Asus GU605C
iio: accel: fxls8962af: Fix temperature calculation
mm/hugetlb: unshare page tables during VMA split, not before
drm/amdgpu: read back register after written for VCN v4.0.5
kbuild: rust: add rustc-min-version support function
rust: compile libcore with edition 2024 for 1.87+
net: Fix checksum update for ILA adj-transport
bpf: Fix L4 csum update on IPv6 in CHECKSUM_COMPLETE
erofs: remove unused trace event erofs_destroy_inode
nfsd: use threads array as-is in netlink interface
sunrpc: handle SVC_GARBAGE during svc auth processing as auth error
drm/v3d: Avoid NULL pointer dereference in `v3d_job_update_stats()`
Kunit to check the longest symbol length
x86/tools: Drop duplicate unlikely() definition in insn_decoder_test.c
ipv6: remove leftover ip6 cookie initializer
ipv6: replace ipcm6_init calls with ipcm6_init_sk
smb: fix secondary channel creation issue with kerberos by populating hostname when adding channels
drm/msm/disp: Correct porch timing for SDM845
drm/msm/dsi/dsi_phy_10nm: Fix missing initial VCO rate
drm/msm: Fix CP_RESET_CONTEXT_STATE bitfield names
drm/msm/a7xx: Call CP_RESET_CONTEXT_STATE
drm/ssd130x: fix ssd132x_clear_screen() columns
ionic: Prevent driver/fw getting out of sync on devcmd(s)
drm/nouveau/bl: increase buffer size to avoid truncate warning
drm/i915/pmu: Fix build error with GCOV and AutoFDO enabled
hwmon: (occ) Rework attribute registration for stack usage
hwmon: (occ) fix unaligned accesses
hwmon: (ltc4282) avoid repeated register write
pldmfw: Select CRC32 when PLDMFW is selected
aoe: clean device rq_list in aoedev_downdev()
io_uring/sqpoll: don't put task_struct on tctx setup failure
net: ice: Perform accurate aRFS flow match
ice: fix eswitch code memory leak in reset scenario
e1000e: set fixed clock frequency indication for Nahum 11 and Nahum 13
workqueue: Initialize wq_isolated_cpumask in workqueue_init_early()
ksmbd: add free_transport ops in ksmbd connection
net: netmem: fix skb_ensure_writable with unreadable skbs
bnxt_en: Fix double invocation of bnxt_ulp_stop()/bnxt_ulp_start()
eth: bnxt: fix out-of-range access of vnic_info array
bnxt_en: Add a helper function to configure MRU and RSS
bnxt_en: Update MRU and RSS table of RSS contexts on queue reset
ptp: fix breakage after ptp_vclock_in_use() rework
ptp: allow reading of currently dialed frequency to succeed on free-running clocks
wifi: carl9170: do not ping device which has failed to load firmware
mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu().
atm: atmtcp: Free invalid length skb in atmtcp_c_send().
tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen() behavior
tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer
tcp: fix passive TFO socket having invalid NAPI ID
eth: fbnic: avoid double free when failing to DMA-map FW msg
net: lan743x: fix potential out-of-bounds write in lan743x_ptp_io_event_clock_get()
ublk: santizize the arguments from userspace when adding a device
drm/xe: Wire up device shutdown handler
drm/xe/gt: Update handling of xe_force_wake_get return
drm/xe/bmg: Update Wa_16023588340
calipso: Fix null-ptr-deref in calipso_req_{set,del}attr().
mlxbf_gige: return EPROBE_DEFER if PHY IRQ is not available
net: atm: add lec_mutex
net: atm: fix /proc/net/atm/lec handling
EDAC/amd64: Correct number of UMCs for family 19h models 70h-7fh
dt-bindings: i2c: nvidia,tegra20-i2c: Specify the required properties
smb: Log an error when close_all_cached_dirs fails
serial: sh-sci: Clean sci_ports[0] after at earlycon exit
serial: sh-sci: Increment the runtime usage counter for the earlycon device
smb: client: fix first command failure during re-negotiation
smb: client: fix max_sge overflow in smb_extract_folioq_to_rdma()
s390/pci: Fix __pcilg_mio_inuser() inline assembly
perf: Fix sample vs do_exit()
perf: Fix cgroup state vs ERROR
perf/core: Fix WARN in perf_cgroup_switch()
arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth()
scsi: elx: efct: Fix memory leak in efct_hw_parse_filter()
RISC-V: KVM: Fix the size parameter check in SBI SFENCE calls
RISC-V: KVM: Don't treat SBI HFENCE calls as NOPs
gpio: pca953x: fix wrong error probe return value
perf evsel: Missed close() when probing hybrid core PMUs
perf test: Directory file descriptor leak
gpio: mlxbf3: only get IRQ for device instance 0
cifs: Remove duplicate fattr->cf_dtype assignment from wsl_to_fattr() function
bpftool: Fix cgroup command to only show cgroup bpf programs
Linux 6.12.35
Change-Id: Ida57d269272a624bedb979bfad0b3c5e7df7e846
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
This reverts commit 4e83f2dbb2 which is
commit 6fe26f694c824b8a4dbf50c635bee1302e3f099c upstream.
It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.
Bug: 161946584
Change-Id: Ia71be8ae26f83011527d07fbbfdf9d6d282f23a4
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
GKI (arm64) relevant 105 out of 506 changes, affecting 145 files +1290/-523
623074162b sched: Fix trace_sched_switch(.prev_state) [1 file, +4/-2]
781bbc8252 perf/core: Fix broken throttling when max_samples_per_tick=1 [1 file, +8/-8]
451a18d71b sched/core: Tweak wait_task_inactive() to force dequeue sched_delayed tasks [1 file, +6/-0]
5b814cde62 brd: fix aligned_sector from brd_do_discard() [1 file, +1/-1]
48e11bcee9 brd: fix discard end sector [1 file, +6/-3]
9cfca45aec erofs: fix file handle encoding for 64-bit NIDs [1 file, +36/-8]
65115472f7 erofs: avoid using multiple devices with different type [1 file, +4/-1]
58beaa1aee rcu/cpu_stall_cputime: fix the hardirq count for x86 architecture [3 files, +10/-6]
5ed92ad1b7 crypto: xts - Only add ecb if it is not already there [1 file, +2/-2]
e9ecaeaf41 kunit: Fix wrong parameter to kunit_deactivate_static_stub() [1 file, +1/-1]
9c094deb6b crypto: api - Redo lookup on EEXIST [1 file, +11/-2]
81d72f9241 PM: EM: Fix potential division-by-zero error in em_compute_costs() [1 file, +4/-0]
0426e92970 PM: wakeup: Delete space in the end of string shown by pm_show_wakelocks() [1 file, +3/-0]
77d45ba1be PM: sleep: Print PM debug messages during hibernation [3 files, +11/-1]
45844a9403 ALSA: core: fix up bus match const issues. [4 files, +8/-8]
fa65c89f3f arm64/fpsimd: Avoid RES0 bits in the SME trap handler [2 files, +9/-7]
6103f9ba51 arm64/fpsimd: Discard stale CPU state when handling SME traps [1 file, +2/-0]
945d247d1c arm64/fpsimd: Don't corrupt FPMR when streaming mode changes [1 file, +3/-3]
55d52af498 arm64/fpsimd: Avoid clobbering kernel FPSIMD state with SMSTOP [1 file, +1/-1]
2756dac036 arm64/fpsimd: Reset FPMR upon exec() [1 file, +3/-0]
f5ffc750db arm64/fpsimd: Fix merging of FPSIMD state during signal return [1 file, +1/-1]
0860d48b70 firmware: psci: Fix refcount leak in psci_dt_init [1 file, +3/-1]
64a9ee6e11 arm64/fpsimd: Avoid warning when sve_to_fpsimd() is unused [1 file, +2/-2]
b3cfc1f9f5 arm64/fpsimd: Do not discard modified SVE state [3 files, +47/-17]
e55f46a11b overflow: Fix direct struct member initialization in _DEFINE_FLEX() [1 file, +3/-3]
671dd1fb87 bpf: Check link_create.flags parameter for multi_kprobe [1 file, +3/-0]
3a8e680f7d bpf, sockmap: fix duplicated data transmission [1 file, +9/-5]
3d25fa2d7f bpf, sockmap: Fix panic when calling skb_linearize [1 file, +16/-15]
44a51592ac f2fs: zone: fix to avoid inconsistence in between SIT and SSA [1 file, +3/-0]
4f51fb0d25 page_pool: Track DMA-mapped pages and unmap them when destroying the pool [5 files, +147/-18]
88f65bb66d iommu: Protect against overflow in iommu_pgsize() [1 file, +3/-1]
04daca6012 f2fs: clean up w/ fscrypt_is_bounce_page() [1 file, +1/-1]
4248ba53e4 f2fs: fix to detect gcing page in f2fs_is_cp_guaranteed() [1 file, +1/-1]
c1f418cc27 bpf: Allow XDP dev-bound programs to perform XDP_REDIRECT into maps [1 file, +16/-11]
e53a8dcd36 tracing: Move histogram trigger variables from stack to per CPU structure [1 file, +105/-15]
69a995644a efi/libstub: Describe missing 'out' parameter in efi_load_initrd [1 file, +1/-0]
709412b92a tracing: Fix error handling in event_trigger_parse() [1 file, +2/-2]
c98cdf6795 bpf: Fix WARN() in get_bpf_raw_tp_regs [1 file, +1/-1]
e0657136ae scsi: ufs: mcq: Delete ufshcd_release_scsi_cmd() in ufshcd_mcq_abort() [1 file, +0/-6]
6bfb154f95 kernfs: Relax constraint in draining guard [2 files, +5/-3]
df00f9147e Bluetooth: ISO: Fix not using SID from adv report [5 files, +75/-14]
1d249cc92d bpf: Revert "bpf: remove unnecessary rcu_read_{lock,unlock}() in multi-uprobe attach logic" [1 file, +2/-0]
1750c3f1d9 Bluetooth: MGMT: iterate over mesh commands in mgmt_mesh_foreach() [1 file, +1/-1]
15c0250dae bpf, sockmap: Avoid using sk_socket after free when sending [1 file, +8/-0]
30a9e834c7 net: usb: aqc111: fix error handling of usbnet read calls [1 file, +8/-2]
7893a41dea vsock/virtio: fix `rx_bytes` accounting for stream sockets [2 files, +17/-10]
2bc6dffb4b bpf: Avoid __bpf_prog_ret0_warn when jit fails [1 file, +1/-1]
ddc654e89a net: phy: clear phydev->devlink when the link is deleted [1 file, +3/-1]
f15ed37dd3 net: phy: fix up const issues in to_mdio_device() and to_phy_device() [2 files, +2/-8]
532601e783 f2fs: use d_inode(dentry) cleanup dentry->d_inode [2 files, +6/-6]
0befc3005d f2fs: fix to correct check conditions in f2fs_cross_rename [1 file, +1/-1]
2eeb181e76 dm: don't change md if dm_table_set_restrictions() fails [1 file, +12/-10]
48e0b54be4 dm: free table mempools if not used in __bind [1 file, +4/-4]
17e4b0fcd2 PCI: Print the actual delay time in pci_bridge_wait_for_secondary_bus() [1 file, +1/-1]
0a3e2ec508 PCI: endpoint: Retain fixed-size BAR size as well as aligned size [2 files, +18/-7]
9f40ae8310 USB: gadget: udc: fix const issue in gadget_match_driver() [1 file, +1/-1]
4bd30962f3 USB: typec: fix const issue in typec_match() [1 file, +1/-1]
3091d4c0d0 loop: add file_start_write() and file_end_write() [1 file, +6/-2]
90891eadb8 Fix sock_exceed_buf_limit not being triggered in __sk_mem_raise_allocated [1 file, +4/-4]
e869a85acc page_pool: Fix use-after-free in page_pool_recycle_in_ring [1 file, +14/-13]
c762fc79d7 net: tipc: fix refcount warning in tipc_aead_encrypt [1 file, +5/-1]
b788cebf72 Bluetooth: L2CAP: Fix not responding with L2CAP_CR_LE_ENCRYPTION [1 file, +2/-1]
4399f59a94 net: fix udp gso skb_segment after pull from frag_list [1 file, +5/-0]
0cffc6e40d PM: sleep: Fix power.is_suspended cleanup for direct-complete devices [1 file, +2/-1]
f34dc858e6 netfilter: nf_nat: also check reverse tuple to obtain clashing entry [1 file, +9/-3]
4f0fcdb835 wifi: cfg80211/mac80211: correctly parse S1G beacon optional elements [4 files, +83/-32]
933466fc50 wireguard: device: enable threaded NAPI [1 file, +1/-0]
1be1f3b848 iov_iter: use iov_offset for length calculation in iov_iter_aligned_bvec [1 file, +1/-1]
1d79230719 path_overmount(): avoid false negatives [1 file, +13/-6]
e1d02fe504 fix propagation graph breakage by MOVE_MOUNT_SET_GROUP move_mount(2) [1 file, +1/-1]
9c1ddfeb66 do_change_type(): refuse to operate on unmounted/not ours mounts [1 file, +4/-0]
80f7c5be4f pmdomain: core: Introduce dev_pm_genpd_rpm_always_on() [2 files, +42/-0]
3464a707d1 scsi: core: ufs: Fix a hang in the error handler [1 file, +6/-1]
99e3d69853 Bluetooth: hci_core: fix list_for_each_entry_rcu usage [1 file, +3/-8]
9df3e5e7f7 Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete [3 files, +12/-30]
84ab1283eb Bluetooth: MGMT: Remove unused mgmt_pending_find_data [2 files, +0/-21]
4e83f2dbb2 Bluetooth: MGMT: Protect mgmt_pending list with its own lock [5 files, +80/-59]
d1bc80da75 net_sched: sch_sfq: fix a potential crash on gso_skb handling [1 file, +4/-1]
1e0de7582c net: Fix TOCTOU issue in sk_is_readable() [1 file, +5/-2]
78fa7b723e macsec: MACsec SCI assignment for ES = 0 [1 file, +34/-6]
b02d9d2732 net/mdiobus: Fix potential out-of-bounds read/write access [1 file, +6/-0]
31bf7b2b92 net/mdiobus: Fix potential out-of-bounds clause 45 read/write access [1 file, +6/-0]
842f7c3154 Bluetooth: Fix NULL pointer deference on eir_get_service_data [1 file, +6/-4]
907ef6e12f Bluetooth: hci_sync: Fix broadcast/PA when using an existing instance [1 file, +15/-5]
2af40d795d Bluetooth: eir: Fix possible crashes on eir_create_adv_data [3 files, +8/-6]
7a41744e38 Bluetooth: MGMT: Fix sparse errors [1 file, +2/-2]
e3f6745006 net_sched: prio: fix a race in prio_tune() [1 file, +1/-1]
180b12eafa net_sched: tbf: fix a race in tbf_change() [1 file, +1/-1]
0a2500782f fs/filesystems: Fix potential unsigned integer underflow in fs_name() [1 file, +9/-5]
f351bb3085 perf: Ensure bpf_perf_link path is properly serialized [1 file, +30/-4]
a5c7b61eed block: use q->elevator with ->elevator_lock held in elv_iosched_show() [1 file, +1/-2]
af8c13f9ee io_uring: fix use-after-free of sq->thread in __io_uring_show_fdinfo() [2 files, +14/-7]
0fccb6773b block: don't use submit_bio_noacct_nocheck in blk_zone_wplug_bio_work [1 file, +5/-2]
48f33ec141 io_uring: consistently use rcu semantics with sqpoll thread [4 files, +38/-15]
a9022c8631 bio: Fix bio_first_folio() for SPARSEMEM without VMEMMAP [1 file, +1/-1]
4b1ef15ffd block: Fix bvec_set_folio() for very large folios [1 file, +5/-2]
84e9f0a2c2 ALSA: usb-audio: Add implicit feedback quirk for RODE AI-1 [1 file, +1/-0]
c29d531870 posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() [1 file, +9/-0]
657003ced7 usb: Flush altsetting 0 endpoints before reinitializating them after reset. [1 file, +14/-2]
7bdd712abe usb: typec: tcpm: move tcpm_queue_vdm_unlocked to asynchronous work [1 file, +71/-20]
b8df8cb8f7 ring-buffer: Do not trigger WARN_ON() due to a commit_overrun [1 file, +18/-8]
e09c0600be ring-buffer: Fix buffer locking in ring_buffer_subbuf_order_set() [1 file, +1/-3]
2d6a6cfe96 ring-buffer: Move cpus_read_lock() outside of buffer->mutex [1 file, +6/-5]
5ed1d7a700 net: usb: aqc111: debug info before sanitation [1 file, +4/-4]
ab20b0bdb0 overflow: Introduce __DEFINE_FLEX for having no initializer [1 file, +19/-6]
Changes in 6.12.34
tools/x86/kcpuid: Fix error handling
x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt()
crypto: sun8i-ce-hash - fix error handling in sun8i_ce_hash_run()
sched: Fix trace_sched_switch(.prev_state)
perf/x86/amd/uncore: Remove unused 'struct amd_uncore_ctx::node' member
perf/x86/amd/uncore: Prevent UMC counters from saturating
gfs2: replace sd_aspace with sd_inode
gfs2: gfs2_create_inode error handling fix
perf/core: Fix broken throttling when max_samples_per_tick=1
crypto: sun8i-ce-cipher - fix error handling in sun8i_ce_cipher_prepare()
crypto: sun8i-ss - do not use sg_dma_len before calling DMA functions
powerpc: do not build ppc_save_regs.o always
powerpc/crash: Fix non-smp kexec preparation
sched/core: Tweak wait_task_inactive() to force dequeue sched_delayed tasks
x86/microcode/AMD: Do not return error when microcode update is not necessary
crypto: sun8i-ce - undo runtime PM changes during driver removal
x86/cpu: Sanitize CPUID(0x80000000) output
x86/insn: Fix opcode map (!REX2) superscript tags
brd: fix aligned_sector from brd_do_discard()
brd: fix discard end sector
kselftest: cpufreq: Get rid of double suspend in rtcwake case
crypto: marvell/cesa - Handle zero-length skcipher requests
crypto: marvell/cesa - Avoid empty transfer descriptor
erofs: fix file handle encoding for 64-bit NIDs
erofs: avoid using multiple devices with different type
powerpc/pseries/iommu: Fix kmemleak in TCE table userspace view
btrfs: scrub: update device stats when an error is detected
btrfs: scrub: fix a wrong error type when metadata bytenr mismatches
btrfs: fix invalid data space release when truncating block in NOCOW mode
rcu/cpu_stall_cputime: fix the hardirq count for x86 architecture
crypto: lrw - Only add ecb if it is not already there
crypto: xts - Only add ecb if it is not already there
crypto: sun8i-ce - move fallback ahash_request to the end of the struct
kunit: Fix wrong parameter to kunit_deactivate_static_stub()
crypto: api - Redo lookup on EEXIST
ACPICA: exserial: don't forget to handle FFixedHW opregions for reading
ASoC: tas2764: Enable main IRQs
ASoC: mediatek: mt8195: Set ETDM1/2 IN/OUT to COMP_DUMMY()
EDAC/skx_common: Fix general protection fault
EDAC/{skx_common,i10nm}: Fix the loss of saved RRL for HBM pseudo channel 0
spi: tegra210-quad: Fix X1_X2_X4 encoding and support x4 transfers
spi: tegra210-quad: remove redundant error handling code
spi: tegra210-quad: modify chip select (CS) deactivation
power: reset: at91-reset: Optimize at91_reset()
PM: EM: Fix potential division-by-zero error in em_compute_costs()
ASoC: SOF: ipc4-pcm: Adjust pipeline_list->pipelines allocation type
ASoC: SOF: amd: add missing acp descriptor field
PM: wakeup: Delete space in the end of string shown by pm_show_wakelocks()
ACPI: resource: fix a typo for MECHREVO in irq1_edge_low_force_override[]
x86/mtrr: Check if fixed-range MTRRs exist in mtrr_save_fixed_ranges()
PM: sleep: Print PM debug messages during hibernation
thermal/drivers/mediatek/lvts: Fix debugfs unregister on failure
ACPI: OSI: Stop advertising support for "3.0 _SCP Extensions"
spi: sh-msiof: Fix maximum DMA transfer size
ASoC: apple: mca: Constrain channels according to TDM mask
ALSA: core: fix up bus match const issues.
drm/vmwgfx: Add seqno waiter for sync_files
drm/vmwgfx: Add error path for xa_store in vmw_bo_add_detached_resource
drm/vmwgfx: Fix dumb buffer leak
drm/xe/d3cold: Set power state to D3Cold during s2idle/s3
drm/vc4: tests: Use return instead of assert
drm/amd/pp: Fix potential NULL pointer dereference in atomctrl_initialize_mc_reg_table
media: rkvdec: Fix frame size enumeration
arm64/fpsimd: Avoid RES0 bits in the SME trap handler
arm64/fpsimd: Discard stale CPU state when handling SME traps
arm64/fpsimd: Don't corrupt FPMR when streaming mode changes
arm64/fpsimd: Avoid clobbering kernel FPSIMD state with SMSTOP
arm64/fpsimd: Reset FPMR upon exec()
arm64/fpsimd: Fix merging of FPSIMD state during signal return
drm/panthor: Fix GPU_COHERENCY_ACE[_LITE] definitions
drm/panthor: Update panthor_mmu::irq::mask when needed
perf: arm-ni: Unregister PMUs on probe failure
perf: arm-ni: Fix missing platform_set_drvdata()
drm/panel: samsung-sofef00: Drop s6e3fc2x01 support
drm/bridge: lt9611uxc: Fix an error handling path in lt9611uxc_probe()
fs/ntfs3: handle hdr_first_de() return value
fs/ntfs3: Add missing direct_IO in ntfs_aops_cmpr
kunit/usercopy: Disable u64 test on 32-bit SPARC
watchdog: exar: Shorten identity name to fit correctly
m68k: mac: Fix macintosh_config for Mac II
firmware: psci: Fix refcount leak in psci_dt_init
arm64: Support ARM64_VA_BITS=52 when setting ARCH_MMAP_RND_BITS_MAX
arm64/fpsimd: Avoid warning when sve_to_fpsimd() is unused
selftests/seccomp: fix syscall_restart test for arm compat
drm/msm/dpu: enable SmartDMA on SM8150
drm/msm/dpu: enable SmartDMA on SC8180X
drm: rcar-du: Fix memory leak in rcar_du_vsps_init()
drm/vkms: Adjust vkms_state->active_planes allocation type
drm/tegra: rgb: Fix the unbound reference count
firmware: SDEI: Allow sdei initialization without ACPI_APEI_GHES
arm64/fpsimd: Do not discard modified SVE state
overflow: Fix direct struct member initialization in _DEFINE_FLEX()
scsi: qedf: Use designated initializer for struct qed_fcoe_cb_ops
perf/amlogic: Replace smp_processor_id() with raw_smp_processor_id() in meson_ddr_pmu_create()
selftests/seccomp: fix negative_ENOSYS tracer tests on arm32
drm/msm/a6xx: Disable rgb565_predicator on Adreno 7c3
drm/mediatek: mtk_drm_drv: Fix kobject put for mtk_mutex device ptr
drm/mediatek: Fix kobject put for component sub-drivers
drm/mediatek: mtk_drm_drv: Unbind secondary mmsys components on err
media: verisilicon: Free post processor buffers on error
svcrdma: Reduce the number of rdma_rw contexts per-QP
xen/x86: fix initial memory balloon target
wifi: ath11k: fix node corruption in ar->arvifs list
wifi: ath12k: Fix memory leak during vdev_id mismatch
wifi: ath12k: Fix invalid memory access while forming 802.11 header
IB/cm: use rwlock for MAD agent lock
bpf: Check link_create.flags parameter for multi_kprobe
selftests/bpf: Fix bpf_nf selftest failure
bpf: fix ktls panic with sockmap
bpf, sockmap: fix duplicated data transmission
bpf, sockmap: Fix panic when calling skb_linearize
f2fs: zone: fix to avoid inconsistence in between SIT and SSA
wifi: ath12k: fix cleanup path after mhi init
wifi: ath12k: Fix WMI tag for EHT rate in peer assoc
wifi: ath12k: Fix buffer overflow in debugfs
f2fs: clean up unnecessary indentation
f2fs: prevent the current section from being selected as a victim during GC
f2fs: fix to do sanity check on sbi->total_valid_block_count
page_pool: Move pp_magic check into helper functions
page_pool: Track DMA-mapped pages and unmap them when destroying the pool
net: ncsi: Fix GCPS 64-bit member variables
libbpf: Fix buffer overflow in bpf_object__init_prog
net/mlx5: Avoid using xso.real_dev unnecessarily
xfrm: Use xdo.dev instead of xdo.real_dev
wifi: rtw88: sdio: map mgmt frames to queue TX_DESC_QSEL_MGMT
wifi: rtw88: sdio: call rtw_sdio_indicate_tx_status unconditionally
wifi: rtw88: do not ignore hardware read error during DPK
wifi: ath12k: fix invalid access to memory
wifi: ath12k: Add MSDU length validation for TKIP MIC error
wifi: ath12k: Fix the QoS control field offset to build QoS header
wifi: ath12k: fix node corruption in ar->arvifs list
RDMA/hns: Include hnae3.h in hns_roce_hw_v2.h
scsi: hisi_sas: Call I_T_nexus after soft reset for SATA disk
libbpf: Fix event name too long error
libbpf: Remove sample_period init in perf_buffer
Use thread-safe function pointer in libbpf_print
iommu: Protect against overflow in iommu_pgsize()
bonding: assign random address if device address is same as bond
f2fs: clean up w/ fscrypt_is_bounce_page()
f2fs: fix to detect gcing page in f2fs_is_cp_guaranteed()
scsi: smartpqi: Fix smp_processor_id() call trace for preemptible kernels
libbpf: Use proper errno value in linker
bpf: Allow XDP dev-bound programs to perform XDP_REDIRECT into maps
netfilter: bridge: Move specific fragmented packet to slow_path instead of dropping it
netfilter: nft_quota: match correctly when the quota just depleted
netfilter: nft_set_pipapo: prevent overflow in lookup table allocation
RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction
bpf: Fix uninitialized values in BPF_{CORE,PROBE}_READ
tracing: Move histogram trigger variables from stack to per CPU structure
clk: qcom: camcc-sm6350: Add *_wait_val values for GDSCs
clk: qcom: dispcc-sm6350: Add *_wait_val values for GDSCs
clk: qcom: gcc-sm6350: Add *_wait_val values for GDSCs
clk: qcom: gpucc-sm6350: Add *_wait_val values for GDSCs
bpftool: Fix regression of "bpftool cgroup tree" EINVAL on older kernels
clk: bcm: rpi: Add NULL check in raspberrypi_clk_register()
wifi: iwlfiwi: mvm: Fix the rate reporting
efi/libstub: Describe missing 'out' parameter in efi_load_initrd
selftests/bpf: Fix caps for __xlated/jited_unpriv
tracing: Rename event_trigger_alloc() to trigger_data_alloc()
tracing: Fix error handling in event_trigger_parse()
of: unittest: Unlock on error in unittest_data_add()
ktls, sockmap: Fix missing uncharge operation
libbpf: Use proper errno value in nlattr
pinctrl: at91: Fix possible out-of-boundary access
bpf: Fix WARN() in get_bpf_raw_tp_regs
dt-bindings: soc: fsl,qman-fqd: Fix reserved-memory.yaml reference
clk: qcom: gcc-msm8939: Fix mclk0 & mclk1 for 24 MHz
s390/bpf: Store backchain even for leaf progs
wifi: rtw89: pci: enlarge retry times of RX tag to 1000
wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds
wifi: rtw89: fix firmware scan delay unit for WiFi 6 chips
iommu: remove duplicate selection of DMAR_TABLE
wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event
hisi_acc_vfio_pci: fix XQE dma address error
hisi_acc_vfio_pci: add eq and aeq interruption restore
hisi_acc_vfio_pci: bugfix live migration function without VF device driver
wifi: ath9k_htc: Abort software beacon handling if disabled
scsi: ufs: mcq: Delete ufshcd_release_scsi_cmd() in ufshcd_mcq_abort()
kernfs: Relax constraint in draining guard
Bluetooth: ISO: Fix not using SID from adv report
wifi: mt76: mt7996: Fix null-ptr-deref in mt7996_mmio_wed_init()
wifi: mt76: mt7915: Fix null-ptr-deref in mt7915_mmio_wed_init()
wifi: mt76: mt7925: prevent multiple scan commands
wifi: mt76: mt7925: refine the sniffer commnad
wifi: mt76: mt7925: ensure all MCU commands wait for response
wifi: mt76: mt7996: set EHT max ampdu length capability
wifi: mt76: mt7996: fix RX buffer size of MCU event
bpf: Revert "bpf: remove unnecessary rcu_read_{lock,unlock}() in multi-uprobe attach logic"
netfilter: xtables: support arpt_mark and ipv6 optstrip for iptables-nft only builds
netfilter: nf_tables: nft_fib_ipv6: fix VRF ipv4/ipv6 result discrepancy
vfio/type1: Fix error unwind in migration dirty bitmap allocation
Bluetooth: MGMT: iterate over mesh commands in mgmt_mesh_foreach()
Bluetooth: btintel: Check dsbr size from EFI variable
bpf, sockmap: Avoid using sk_socket after free when sending
netfilter: nf_tables: nft_fib: consistent l3mdev handling
netfilter: nft_tunnel: fix geneve_opt dump
RISC-V: KVM: lock the correct mp_state during reset
net: usb: aqc111: fix error handling of usbnet read calls
vsock/virtio: fix `rx_bytes` accounting for stream sockets
RDMA/cma: Fix hang when cma_netevent_callback fails to queue_work
net: lan966x: Fix 1-step timestamping over ipv4 or ipv6
net: xilinx: axienet: Fix Tx skb circular buffer occupancy check in dmaengine xmit
bpf: Avoid __bpf_prog_ret0_warn when jit fails
net: phy: clear phydev->devlink when the link is deleted
net: phy: fix up const issues in to_mdio_device() and to_phy_device()
net: lan743x: rename lan743x_reset_phy to lan743x_hw_reset_phy
net: lan743x: Fix PHY reset handling during initialization and WOL
net: phy: mscc: Fix memory leak when using one step timestamping
octeontx2-pf: QOS: Perform cache sync on send queue teardown
octeontx2-pf: QOS: Refactor TC_HTB_LEAF_DEL_LAST callback
calipso: Don't call calipso functions for AF_INET sk.
net: openvswitch: Fix the dead loop of MPLS parse
net: phy: mscc: Stop clearing the the UDPv4 checksum for L2 frames
f2fs: use d_inode(dentry) cleanup dentry->d_inode
f2fs: fix to correct check conditions in f2fs_cross_rename
arm64: dts: qcom: x1e80100: Mark usb_2 as dma-coherent
arm64: dts: qcom: sm8650: setup gpu thermal with higher temperatures
arm64: dts: qcom: sm8650: add missing cpu-cfg interconnect path in the mdss node
arm64: dts: qcom: x1e80100-romulus: Keep L12B and L15B always on
arm64: dts: qcom: sdm845-starqltechn: remove wifi
arm64: dts: qcom: sdm845-starqltechn: fix usb regulator mistake
arm64: dts: qcom: sdm845-starqltechn: refactor node order
arm64: dts: qcom: sdm845-starqltechn: remove excess reserved gpios
arm64: dts: qcom: sm8350: Reenable crypto & cryptobam
arm64: dts: qcom: sm8250: Fix CPU7 opp table
arm64: dts: qcom: sc8280xp-x13s: Drop duplicate DMIC supplies
arm64: dts: qcom: ipq9574: Fix USB vdd info
arm64: dts: rockchip: Move SHMEM memory to reserved memory on rk3588
ARM: dts: at91: usb_a9263: fix GPIO for Dataflash chip select
ARM: dts: at91: at91sam9263: fix NAND chip selects
arm64: dts: mediatek: mt8195: Reparent vdec1/2 and venc1 power domains
arm64: dts: qcom: sdm660-xiaomi-lavender: Add missing SD card detect GPIO
arm64: dts: mt8183: Add port node to mt8183.dtsi
arm64: dts: imx8mm-beacon: Fix RTC capacitive load
arm64: dts: imx8mn-beacon: Fix RTC capacitive load
arm64: dts: imx8mp-beacon: Fix RTC capacitive load
arm64: dts: imx8mm-beacon: Set SAI5 MCLK direction to output for HDMI audio
arm64: dts: imx8mn-beacon: Set SAI5 MCLK direction to output for HDMI audio
arm64: dts: mediatek: mt6357: Drop regulator-fixed compatibles
arm64: dts: mt6359: Add missing 'compatible' property to regulators node
arm64: dts: qcom: sdm660-lavender: Add missing USB phy supply
arm64: dts: qcom: sda660-ifc6560: Fix dt-validate warning
arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3566-rock3c
arm64: dts: rockchip: Update eMMC for NanoPi R5 series
arm64: tegra: Drop remaining serial clock-names and reset-names
arm64: tegra: Add uartd serial alias for Jetson TX1 module
arm64: dts: ti: k3-j721e-common-proc-board: Enable OSPI1 on J721E
soc: qcom: smp2p: Fix fallback to qcom,ipc parse
Squashfs: check return result of sb_min_blocksize
ocfs2: fix possible memory leak in ocfs2_finish_quota_recovery
nilfs2: add pointer check for nilfs_direct_propagate()
nilfs2: do not propagate ENOENT error from nilfs_btree_propagate()
bus: fsl-mc: fix double-free on mc_dev
dt-bindings: vendor-prefixes: Add Liontron name
ARM: dts: qcom: apq8064: add missing clocks to the timer node
ARM: dts: qcom: apq8064 merge hw splinlock into corresponding syscon device
ARM: dts: qcom: apq8064: move replicator out of soc node
arm64: defconfig: mediatek: enable PHY drivers
arm64: dts: rockchip: disable unrouted USB controllers and PHY on RK3399 Puma with Haikou
arm64: dts: qcom: qcm2290: fix (some) of QUP interconnects
arm64: dts: renesas: white-hawk-ard-audio: Fix TPU0 groups
arm64: dts: mt6359: Rename RTC node to match binding expectations
ARM: aspeed: Don't select SRAM
soc: aspeed: lpc: Fix impossible judgment condition
soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop()
fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod()
randstruct: gcc-plugin: Remove bogus void member
randstruct: gcc-plugin: Fix attribute addition
perf build: Warn when libdebuginfod devel files are not available
perf ui browser hists: Set actions->thread before calling do_zoom_thread()
dm: don't change md if dm_table_set_restrictions() fails
dm: free table mempools if not used in __bind
backlight: pm8941: Add NULL check in wled_configure()
x86/irq: Ensure initial PIR loads are performed exactly once
mtd: nand: ecc-mxic: Fix use of uninitialized variable ret
hwmon: (asus-ec-sensors) check sensor index in read_string()
perf symbol-minimal: Fix double free in filename__read_build_id
dm: fix dm_blk_report_zones
dm-flakey: error all IOs when num_features is absent
dm-flakey: make corrupting read bios work
perf trace: Fix leaks of 'struct thread' in set_filter_loop_pids()
perf tests: Fix 'perf report' tests installation
perf intel-pt: Fix PEBS-via-PT data_src
perf scripts python: exported-sql-viewer.py: Fix pattern matching with Python 3
remoteproc: qcom_wcnss_iris: Add missing put_device() on error in probe
remoteproc: k3-r5: Drop check performed in k3_r5_rproc_{mbox_callback/kick}
remoteproc: k3-dsp: Drop check performed in k3_dsp_rproc_{mbox_callback/kick}
rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send()
mfd: exynos-lpass: Fix an error handling path in exynos_lpass_probe()
mfd: exynos-lpass: Avoid calling exynos_lpass_disable() twice in exynos_lpass_remove()
mfd: stmpe-spi: Correct the name used in MODULE_DEVICE_TABLE
perf tests switch-tracking: Fix timestamp comparison
mailbox: imx: Fix TXDB_V2 sending
mailbox: mtk-cmdq: Refine GCE_GCTL_VALUE setting
perf symbol: Fix use-after-free in filename__read_build_id
perf record: Fix incorrect --user-regs comments
perf trace: Always print return value for syscalls returning a pid
nfs: clear SB_RDONLY before getting superblock
nfs: ignore SB_RDONLY when remounting nfs
perf trace: Set errpid to false for rseq and set_robust_list
perf callchain: Always populate the addr_location map when adding IP
cifs: Fix validation of SMB1 query reparse point response
rust: alloc: add missing invariant in Vec::set_len()
rtc: sh: assign correct interrupts with DT
phy: rockchip: samsung-hdptx: Fix clock ratio setup
phy: rockchip: samsung-hdptx: Do no set rk_hdptx_phy->rate in case of errors
PCI: Print the actual delay time in pci_bridge_wait_for_secondary_bus()
PCI: rcar-gen4: set ep BAR4 fixed size
PCI: cadence: Fix runtime atomic count underflow
PCI: apple: Use gpiod_set_value_cansleep in probe flow
phy: qcom-qmp-usb: Fix an NULL vs IS_ERR() bug
dmaengine: ti: Add NULL check in udma_probe()
PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root()
PCI/DPC: Initialize aer_err_info before using it
PCI/DPC: Log Error Source ID only when valid
rtc: loongson: Add missing alarm notifications for ACPI RTC events
PCI: endpoint: Retain fixed-size BAR size as well as aligned size
usb: renesas_usbhs: Reorder clock handling and power management in probe
serial: Fix potential null-ptr-deref in mlb_usio_probe()
thunderbolt: Fix a logic error in wake on connect
iio: filter: admv8818: fix band 4, state 15
iio: filter: admv8818: fix integer overflow
iio: filter: admv8818: fix range calculation
iio: filter: admv8818: Support frequencies >= 2^32
iio: adc: ad7124: Fix 3dB filter frequency reading
usb: acpi: Prevent null pointer dereference in usb_acpi_add_usb4_devlink()
MIPS: Loongson64: Add missing '#interrupt-cells' for loongson64c_ls7a
coresight: Fixes device's owner field for registered using coresight_init_driver()
coresight: catu: Introduce refcount and spinlock for enabling/disabling
counter: interrupt-cnt: Protect enable/disable OPs with mutex
fpga: fix potential null pointer deref in fpga_mgr_test_img_load_sgt()
coresight: prevent deactivate active config while enabling the config
vt: remove VT_RESIZE and VT_RESIZEX from vt_compat_ioctl()
mei: vsc: Cast tx_buf to (__be32 *) when passed to cpu_to_be32_array()
iio: adc: PAC1934: fix typo in documentation link
iio: adc: mcp3911: fix device dependent mappings for conversion result registers
USB: gadget: udc: fix const issue in gadget_match_driver()
USB: typec: fix const issue in typec_match()
loop: add file_start_write() and file_end_write()
drm/xe: Make xe_gt_freq part of the Documentation
Fix sock_exceed_buf_limit not being triggered in __sk_mem_raise_allocated
page_pool: Fix use-after-free in page_pool_recycle_in_ring
net: stmmac: platform: guarantee uniqueness of bus_id
gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt
net: tipc: fix refcount warning in tipc_aead_encrypt
driver: net: ethernet: mtk_star_emac: fix suspend/resume issue
net/mlx4_en: Prevent potential integer overflow calculating Hz
net: lan966x: Make sure to insert the vlan tags also in host mode
spi: bcm63xx-spi: fix shared reset
spi: bcm63xx-hsspi: fix shared reset
Bluetooth: L2CAP: Fix not responding with L2CAP_CR_LE_ENCRYPTION
ice: fix Tx scheduler error handling in XDP callback
ice: create new Tx scheduler nodes for new queues only
ice: fix rebuilding the Tx scheduler tree for large queue counts
idpf: fix a race in txq wakeup
idpf: avoid mailbox timeout delays during reset
net: dsa: tag_brcm: legacy: fix pskb_may_pull length
net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping
net: stmmac: make sure that ptp_rate is not 0 before configuring EST
drm/i915/guc: Check if expecting reply before decrementing outstanding_submission_g2h
drm/i915/psr: Fix using wrong mask in REG_FIELD_PREP
drm/i915/guc: Handle race condition where wakeref count drops below 0
net: fix udp gso skb_segment after pull from frag_list
net: wwan: t7xx: Fix napi rx poll issue
vmxnet3: correctly report gso type for UDP tunnels
selftests: net: build net/lib dependency in all target
PM: sleep: Fix power.is_suspended cleanup for direct-complete devices
nvme: fix command limits status code
gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO
drm/panel-simple: fix the warnings for the Evervision VGG644804
netfilter: nf_set_pipapo_avx2: fix initial map fill
netfilter: nf_nat: also check reverse tuple to obtain clashing entry
net: ti: icssg-prueth: Fix swapped TX stats for MII interfaces.
net: dsa: b53: do not enable RGMII delay on bcm63xx
net: dsa: b53: allow RGMII for bcm63xx RGMII ports
net: dsa: b53: do not touch DLL_IQQD on bcm53115
wifi: cfg80211/mac80211: correctly parse S1G beacon optional elements
net: wwan: mhi_wwan_mbim: use correct mux_id for multiplexing
wireguard: device: enable threaded NAPI
seg6: Fix validation of nexthop addresses
riscv: misaligned: fix sleeping function called during misaligned access handling
scsi: ufs: qcom: Prevent calling phy_exit() before phy_init()
ASoC: codecs: hda: Fix RPM usage count underflow
ASoC: Intel: avs: Fix deadlock when the failing IPC is SET_D0IX
ASoC: Intel: avs: Verify content returned by parse_int_array()
ASoC: ti: omap-hdmi: Re-add dai_link->platform to fix card init
iov_iter: use iov_offset for length calculation in iov_iter_aligned_bvec
path_overmount(): avoid false negatives
fix propagation graph breakage by MOVE_MOUNT_SET_GROUP move_mount(2)
do_change_type(): refuse to operate on unmounted/not ours mounts
tools/power turbostat: Fix AMD package-energy reporting
ALSA: hda/realtek: fix micmute LEDs on HP Laptops with ALC3315
ALSA: hda/realtek: fix micmute LEDs on HP Laptops with ALC3247
ALSA: hda/realtek: Add support for various HP Laptops using CS35L41 HDA
ALSA: hda/realtek - Support mute led function for HP platform
ALSA: hda/realtek - Add new HP ZBook laptop with micmute led fixup
ALSA: hda/realtek: Add support for HP Agusta using CS35L41 HDA
Input: synaptics-rmi - fix crash with unsupported versions of F34
pmdomain: core: Introduce dev_pm_genpd_rpm_always_on()
mmc: sdhci-of-dwcmshc: add PD workaround on RK3576
arm64: dts: qcom: x1e80100: Apply consistent critical thermal shutdown
arm64: dts: qcom: x1e80100: Add GPU cooling
pinctrl: samsung: refactor drvdata suspend & resume callbacks
pinctrl: samsung: add dedicated SoC eint suspend/resume callbacks
pinctrl: samsung: add gs101 specific eint suspend/resume callbacks
dt-bindings: pwm: adi,axi-pwmgen: Increase #pwm-cells to 3
dt-bindings: pwm: Correct indentation and style in DTS example
dt-bindings: pwm: adi,axi-pwmgen: Fix clocks
serial: sh-sci: Move runtime PM enable to sci_probe_single()
scsi: core: ufs: Fix a hang in the error handler
Bluetooth: hci_core: fix list_for_each_entry_rcu usage
Bluetooth: btintel_pcie: Fix driver not posting maximum rx buffers
Bluetooth: btintel_pcie: Increase the tx and rx descriptor count
Bluetooth: btintel_pcie: Reduce driver buffer posting to prevent race condition
Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete
Bluetooth: MGMT: Remove unused mgmt_pending_find_data
Bluetooth: MGMT: Protect mgmt_pending list with its own lock
net: dsa: b53: fix untagged traffic sent via cpu tagged with VID 0
ptp: remove ptp->n_vclocks check logic in ptp_vclock_in_use()
ath10k: snoc: fix unbalanced IRQ enable in crash recovery
wifi: ath11k: convert timeouts to secs_to_jiffies()
wifi: ath11k: avoid burning CPU in ath11k_debugfs_fw_stats_request()
wifi: ath11k: don't use static variables in ath11k_debugfs_fw_stats_process()
wifi: ath11k: don't wait when there is no vdev started
wifi: ath11k: move some firmware stats related functions outside of debugfs
wifi: ath11k: validate ath11k_crypto_mode on top of ath11k_core_qmi_firmware_ready
wifi: ath12k: refactor ath12k_hw_regs structure
wifi: ath12k: fix GCC_GCC_PCIE_HOT_RST definition for WCN7850
regulator: max20086: Fix refcount leak in max20086_parse_regulators_dt()
spi: omap2-mcspi: Disable multi mode when CS should be kept asserted after message
spi: omap2-mcspi: Disable multi-mode when the previous message kept CS asserted
pinctrl: qcom: pinctrl-qcm2290: Add missing pins
scsi: iscsi: Fix incorrect error path labels for flashnode operations
net_sched: sch_sfq: fix a potential crash on gso_skb handling
powerpc/powernv/memtrace: Fix out of bounds issue in memtrace mmap
powerpc/vas: Return -EINVAL if the offset is non-zero in mmap()
drm/meson: use unsigned long long / Hz for frequency types
drm/meson: fix debug log statement when setting the HDMI clocks
drm/meson: use vclk_freq instead of pixel_freq in debug print
drm/meson: fix more rounding issues with 59.94Hz modes
i40e: return false from i40e_reset_vf if reset is in progress
i40e: retry VFLR handling if there is ongoing VF reset
ACPI: CPPC: Fix NULL pointer dereference when nosmp is used
net: Fix TOCTOU issue in sk_is_readable()
macsec: MACsec SCI assignment for ES = 0
net/mdiobus: Fix potential out-of-bounds read/write access
net/mdiobus: Fix potential out-of-bounds clause 45 read/write access
Bluetooth: Fix NULL pointer deference on eir_get_service_data
Bluetooth: hci_sync: Fix broadcast/PA when using an existing instance
Bluetooth: eir: Fix possible crashes on eir_create_adv_data
Bluetooth: MGMT: Fix sparse errors
net/mlx5: Ensure fw pages are always allocated on same NUMA
net/mlx5: Fix ECVF vports unload on shutdown flow
net/mlx5: Fix return value when searching for existing flow group
net/mlx5: HWS, fix missing ip_version handling in definer
net/mlx5e: Fix leak of Geneve TLV option object
net_sched: prio: fix a race in prio_tune()
net_sched: red: fix a race in __red_change()
net_sched: tbf: fix a race in tbf_change()
net_sched: ets: fix a race in ets_qdisc_change()
net: drv: netdevsim: don't napi_complete() from netpoll
btrfs: exit after state insertion failure at btrfs_convert_extent_bit()
fs/filesystems: Fix potential unsigned integer underflow in fs_name()
gfs2: pass through holder from the VFS for freeze/thaw
btrfs: exit after state split error at set_extent_bit()
nvmet-fcloop: access fcpreq only when holding reqlock
perf: Ensure bpf_perf_link path is properly serialized
block: use q->elevator with ->elevator_lock held in elv_iosched_show()
io_uring: fix use-after-free of sq->thread in __io_uring_show_fdinfo()
block: don't use submit_bio_noacct_nocheck in blk_zone_wplug_bio_work
io_uring: consistently use rcu semantics with sqpoll thread
bio: Fix bio_first_folio() for SPARSEMEM without VMEMMAP
block: Fix bvec_set_folio() for very large folios
objtool/rust: relax slice condition to cover more `noreturn` Rust functions
tools/resolve_btfids: Fix build when cross compiling kernel with clang.
Revert "wifi: mwifiex: Fix HT40 bandwidth issue."
ALSA: usb-audio: Add implicit feedback quirk for RODE AI-1
HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse()
posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()
nvmem: zynqmp_nvmem: unbreak driver after cleanup
usb: usbtmc: Fix read_stb function and get_stb ioctl
VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify
tty: serial: 8250_omap: fix TX with DMA for am33xx
usb: misc: onboard_usb_dev: Fix usb5744 initialization sequence
usb: cdnsp: Fix issue with detecting command completion event
usb: cdnsp: Fix issue with detecting USB 3.2 speed
usb: Flush altsetting 0 endpoints before reinitializating them after reset.
usb: typec: tcpm/tcpci_maxim: Fix bounds check in process_rx()
usb: typec: tcpm: move tcpm_queue_vdm_unlocked to asynchronous work
9p: Add a migrate_folio method
ring-buffer: Do not trigger WARN_ON() due to a commit_overrun
ring-buffer: Fix buffer locking in ring_buffer_subbuf_order_set()
ring-buffer: Move cpus_read_lock() outside of buffer->mutex
xfs: don't assume perags are initialised when trimming AGs
xen/arm: call uaccess_ttbr0_enable for dm_op hypercall
x86/iopl: Cure TIF_IO_BITMAP inconsistencies
x86/fred/signal: Prevent immediate repeat of single step trap on return from SIGTRAP handler
calipso: unlock rcu before returning -EAFNOSUPPORT
regulator: dt-bindings: mt6357: Drop fixed compatible requirement
usb: misc: onboard_usb_dev: fix build warning for CONFIG_USB_ONBOARD_DEV_USB5744=n
net: usb: aqc111: debug info before sanitation
overflow: Introduce __DEFINE_FLEX for having no initializer
gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add
drm/meson: Use 1000ULL when operating with mode->clock
thermal/drivers/mediatek/lvts: Remove unused lvts_debugfs_exit
Linux 6.12.34
Change-Id: I679f0f1ddcf9bf8a0b86089ccb7b78536f5bc441
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
[ Upstream commit 1d6123102e9fbedc8d25bf4731da6d513173e49e ]
syzbot reported use-after-free in vhci_flush() without repro. [0]
From the splat, a thread close()d a vhci file descriptor while
its device was being used by iotcl() on another thread.
Once the last fd refcnt is released, vhci_release() calls
hci_unregister_dev(), hci_free_dev(), and kfree() for struct
vhci_data, which is set to hci_dev->dev->driver_data.
The problem is that there is no synchronisation after unlinking
hdev from hci_dev_list in hci_unregister_dev(). There might be
another thread still accessing the hdev which was fetched before
the unlink operation.
We can use SRCU for such synchronisation.
Let's run hci_dev_reset() under SRCU and wait for its completion
in hci_unregister_dev().
Another option would be to restore hci_dev->destruct(), which was
removed in commit 587ae086f6 ("Bluetooth: Remove unused
hci-destruct cb"). However, this would not be a good solution, as
we should not run hci_unregister_dev() while there are in-flight
ioctl() requests, which could lead to another data-race KCSAN splat.
Note that other drivers seem to have the same problem, for exmaple,
virtbt_remove().
[0]:
BUG: KASAN: slab-use-after-free in skb_queue_empty_lockless include/linux/skbuff.h:1891 [inline]
BUG: KASAN: slab-use-after-free in skb_queue_purge_reason+0x99/0x360 net/core/skbuff.c:3937
Read of size 8 at addr ffff88807cb8d858 by task syz.1.219/6718
CPU: 1 UID: 0 PID: 6718 Comm: syz.1.219 Not tainted 6.16.0-rc1-syzkaller-00196-g08207f42d3ff #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Call Trace:
<TASK>
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:408 [inline]
print_report+0xd2/0x2b0 mm/kasan/report.c:521
kasan_report+0x118/0x150 mm/kasan/report.c:634
skb_queue_empty_lockless include/linux/skbuff.h:1891 [inline]
skb_queue_purge_reason+0x99/0x360 net/core/skbuff.c:3937
skb_queue_purge include/linux/skbuff.h:3368 [inline]
vhci_flush+0x44/0x50 drivers/bluetooth/hci_vhci.c:69
hci_dev_do_reset net/bluetooth/hci_core.c:552 [inline]
hci_dev_reset+0x420/0x5c0 net/bluetooth/hci_core.c:592
sock_do_ioctl+0xd9/0x300 net/socket.c:1190
sock_ioctl+0x576/0x790 net/socket.c:1311
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fcf5b98e929
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fcf5c7b9038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fcf5bbb6160 RCX: 00007fcf5b98e929
RDX: 0000000000000000 RSI: 00000000400448cb RDI: 0000000000000009
RBP: 00007fcf5ba10b39 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fcf5bbb6160 R15: 00007ffd6353d528
</TASK>
Allocated by task 6535:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
__kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:394
kasan_kmalloc include/linux/kasan.h:260 [inline]
__kmalloc_cache_noprof+0x230/0x3d0 mm/slub.c:4359
kmalloc_noprof include/linux/slab.h:905 [inline]
kzalloc_noprof include/linux/slab.h:1039 [inline]
vhci_open+0x57/0x360 drivers/bluetooth/hci_vhci.c:635
misc_open+0x2bc/0x330 drivers/char/misc.c:161
chrdev_open+0x4c9/0x5e0 fs/char_dev.c:414
do_dentry_open+0xdf0/0x1970 fs/open.c:964
vfs_open+0x3b/0x340 fs/open.c:1094
do_open fs/namei.c:3887 [inline]
path_openat+0x2ee5/0x3830 fs/namei.c:4046
do_filp_open+0x1fa/0x410 fs/namei.c:4073
do_sys_openat2+0x121/0x1c0 fs/open.c:1437
do_sys_open fs/open.c:1452 [inline]
__do_sys_openat fs/open.c:1468 [inline]
__se_sys_openat fs/open.c:1463 [inline]
__x64_sys_openat+0x138/0x170 fs/open.c:1463
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 6535:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:68
kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:576
poison_slab_object mm/kasan/common.c:247 [inline]
__kasan_slab_free+0x62/0x70 mm/kasan/common.c:264
kasan_slab_free include/linux/kasan.h:233 [inline]
slab_free_hook mm/slub.c:2381 [inline]
slab_free mm/slub.c:4643 [inline]
kfree+0x18e/0x440 mm/slub.c:4842
vhci_release+0xbc/0xd0 drivers/bluetooth/hci_vhci.c:671
__fput+0x44c/0xa70 fs/file_table.c:465
task_work_run+0x1d1/0x260 kernel/task_work.c:227
exit_task_work include/linux/task_work.h:40 [inline]
do_exit+0x6ad/0x22e0 kernel/exit.c:955
do_group_exit+0x21c/0x2d0 kernel/exit.c:1104
__do_sys_exit_group kernel/exit.c:1115 [inline]
__se_sys_exit_group kernel/exit.c:1113 [inline]
__x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1113
x64_sys_call+0x21ba/0x21c0 arch/x86/include/generated/asm/syscalls_64.h:232
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
The buggy address belongs to the object at ffff88807cb8d800
which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 88 bytes inside of
freed 1024-byte region [ffff88807cb8d800, ffff88807cb8dc00)
Fixes: bf18c7118c ("Bluetooth: vhci: Free driver_data on file release")
Reported-by: syzbot+2faa4825e556199361f9@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=f62d64848fc4c7c30cd6
Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
Acked-by: Paul Menzel <pmenzel@molgen.mpg.de>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This reverts commit 4f51fb0d25 which is
commit ee62ce7a1d909ccba0399680a03c2dee83bcae95 upstream.
It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.
Bug: 161946584
Change-Id: I1778b757059df295816de520022729e7ab7348a1
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Steps on the way to 6.12.34
Resolves merge conflicts in:
kernel/sched/core.c
net/netfilter/xt_mark.c
Change-Id: I6df5e27c2a5bfa8b077b1f2814ad98b2a3dc0877
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
This reverts commit 9cbca30102 which is
commit 028363685bd0b7a19b4a820f82dd905b1dc83999 upstream.
It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.
Bug: 161946584
Change-Id: Ifec9e4a0d3e7404091dd8bcc60e2cf06815d9c3b
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
GKI (arm64) relevant 137 out of 624 changes, affecting 192 files +1647/-1035
a4f865ecdb nvmem: core: fix bit offsets of more than one byte [1 file, +17/-7]
4327479e55 nvmem: core: verify cell's raw_len [1 file, +12/-0]
410f8b72e0 nvmem: core: update raw_len if the bit reading is required [1 file, +3/-1]
7aea1517fb scsi: ufs: Introduce quirk to extend PA_HIBERN8TIME for UFS devices [2 files, +35/-0]
b730cb1096 virtio_ring: Fix data race by tagging event_triggered as racy for KCSAN [1 file, +1/-1]
2998813177 dma/mapping.c: dev_dbg support for dma_addressing_limited [1 file, +10/-1]
3eec42a17a dma-mapping: avoid potential unused data compilation warning [1 file, +8/-4]
97edaa0ec6 cgroup: Fix compilation issue due to cgroup_mutex not being exported [1 file, +1/-1]
f93675793b vhost_task: fix vhost_task_create() documentation [1 file, +1/-1]
e22034cbee dma-mapping: Fix warning reported for missing prototype [1 file, +8/-8]
4f5553a08f fs/buffer: split locking for pagecache lookups [1 file, +25/-16]
e138fc2316 fs/buffer: introduce sleeping flavors for pagecache lookups [2 files, +17/-0]
a49a4a87ce fs/buffer: use sleeping version of __find_get_block() [1 file, +9/-2]
f1c5aa614b fs/jbd2: use sleeping version of __find_get_block() [1 file, +9/-6]
9ece099e95 fs/ext4: use sleeping version of sb_find_get_block() [1 file, +2/-1]
64f505b08e block: fix race between set_blocksize and read paths [4 files, +43/-1]
218c838d03 io_uring: don't duplicate flushing in io_req_post_cqe [1 file, +8/-3]
8014d3e56e bpf: fix possible endless loop in BPF map iteration [1 file, +1/-1]
d40ca27602 fuse: Return EPERM rather than ENOSYS from link() [1 file, +2/-0]
bab0bd1389 exfat: call bh_read in get_block only when necessary [1 file, +77/-82]
01677e7ee1 io_uring/msg: initialise msg request opcode [1 file, +1/-0]
e506751b7d arm64: Add support for HIP09 Spectre-BHB mitigation [2 files, +3/-0]
4f427ca9ed tracing: Mark binary printing functions with __printf() attribute [4 files, +18/-21]
15787ab82a mailbox: use error ret code of of_parse_phandle_with_args() [1 file, +4/-3]
f48ee562c0 Bluetooth: Disable SCO support if READ_VOICE_SETTING is unsupported/broken [1 file, +3/-0]
44b79041c4 dql: Fix dql->limit value when reset. [1 file, +1/-1]
ac30595154 lockdep: Fix wait context check on softirq for PREEMPT_RT [1 file, +18/-0]
e63b634806 PCI: dwc: ep: Ensure proper iteration over outbound map windows [1 file, +1/-1]
37ac2434aa ext4: on a remount, only log the ro or r/w state when it has changed [1 file, +4/-3]
1d1e1efad1 libnvdimm/labels: Fix divide error in nd_label_data_init() [1 file, +2/-1]
123bcd8f42 pidfs: improve multi-threaded exec and premature thread-group leader exit polling [3 files, +9/-9]
8f82cf305e cgroup/rstat: avoid disabling irqs for O(num_cpu) [1 file, +5/-7]
a5a507fa5f blk-cgroup: improve policy registration error handling [1 file, +12/-10]
94c3cbc69a ext4: reorder capability check last [1 file, +2/-2]
e658f2d94a bpf: Return prog btf_id without capable check [1 file, +2/-2]
e2520cc19b PCI: dwc: Use resource start as ioremap() input in dw_pcie_pme_turn_off() [1 file, +1/-1]
50452704ec jbd2: do not try to recover wiped journal [1 file, +6/-5]
dab35f4921 tcp: reorganize tcp_in_ack_event() and tcp_count_delivered() [1 file, +32/-24]
555c0b713c bpf: Allow pre-ordering for bpf cgroup progs [5 files, +30/-9]
572ed3fb99 kconfig: do not clear SYMBOL_VALID when reading include/config/auto.conf [1 file, +12/-7]
174dedce64 dm: restrict dm device size to 2^63-512 bytes [1 file, +4/-0]
2f5f326214 ext4: reject the 'data_err=abort' option in nojournal mode [1 file, +12/-0]
d0dc233fe2 posix-timers: Add cond_resched() to posix_timer_add() search loop [1 file, +1/-0]
ae22452d15 posix-timers: Ensure that timer initialization is fully visible [1 file, +14/-7]
3fb9ee05ec timer_list: Don't use %pK through printk() [1 file, +2/-2]
21153e0974 netfilter: conntrack: Bound nf_conntrack sysctl writes [1 file, +9/-3]
236a87e9d2 PNP: Expand length of fixup id string [1 file, +1/-1]
6215143ad3 arm64/mm: Check pmd_table() in pmd_trans_huge() [1 file, +12/-12]
8ad58a7eba arm64/mm: Check PUD_TYPE_TABLE in pud_bad() [1 file, +2/-1]
28306c58da mmc: sdhci: Disable SD card clock before changing parameters [1 file, +7/-2]
3a75fe58a1 usb: xhci: Don't change the status of stalled TDs on failed Stop EP [1 file, +11/-1]
101a3b9920 printk: Check CON_SUSPEND when unblanking a console [1 file, +12/-2]
faba68a86a wifi: cfg80211: allow IR in 20 MHz configurations [5 files, +46/-25]
c1502fc84d ipv6: save dontfrag in cork [2 files, +6/-4]
75ae2a3553 badblocks: Fix a nonsense WARN_ON() which checks whether a u64 variable < 0 [1 file, +3/-2]
7caad075ac crypto: lzo - Fix compression buffer overrun [6 files, +106/-28]
73d01bcbf2 tcp: bring back NUMA dispersion in inet_ehash_locks_alloc() [1 file, +26/-11]
1c17190880 usb: xhci: set page size to the xHCI-supported size [2 files, +22/-20]
93f581d763 drm/gem: Test for imported GEM buffers with helper [2 files, +16/-2]
c4525b513d net: phylink: use pl->link_interface in phylink_expects_phy() [1 file, +1/-1]
f29c876d72 perf/core: Clean up perf_try_init_event() [1 file, +38/-27]
af73c8fd73 ublk: enforce ublks_max only for unprivileged devices [1 file, +27/-15]
592ba27580 perf/hw_breakpoint: Return EOPNOTSUPP for unsupported breakpoint type [1 file, +3/-2]
3de322a98b scsi: logging: Fix scsi_logging_level bounds [1 file, +3/-1]
f33b310eac ipv4: fib: Move fib_valid_key_len() to rtm_to_fib_config(). [2 files, +16/-24]
564f03a797 block: mark bounce buffering as incompatible with integrity [2 files, +5/-2]
82209faa87 ublk: complete command synchronously on error [1 file, +6/-5]
b98aad5e5e media: uvcvideo: Add sanity check to uvc_ioctl_xu_ctrl_map [1 file, +6/-0]
2d6231d5ce media: uvcvideo: Handle uvc menu translation inside uvc_get_le_value [1 file, +32/-45]
e359d62886 perf: arm_pmuv3: Call kvm_vcpu_pmu_resync_el0() before enabling counters [1 file, +2/-2]
673dde8d3c bpf: Search and add kfuncs in struct_ops prologue and epilogue [1 file, +24/-1]
083383aba0 cpuidle: menu: Avoid discarding useful information [1 file, +12/-1]
20a53c3689 loop: check in LO_FLAGS_DIRECT_IO in loop_default_blocksize [1 file, +1/-1]
b55a97d1bd dm: fix unconditional IO throttle caused by REQ_PREFLUSH [1 file, +6/-2]
9f27b38771 crypto: ahash - Set default reqsize from ahash_alg [2 files, +7/-0]
897c98fb32 crypto: skcipher - Zap type in crypto_alloc_sync_skcipher [1 file, +1/-0]
4d9fa2ebc0 net: ipv6: Init tunnel link-netns before registering dev [4 files, +9/-7]
53f42776e4 genirq/msi: Store the IOMMU IOVA directly in msi_desc instead of iommu_cookie [2 files, +25/-36]
2b129e89b8 bpf: don't do clean_live_states when state->loop_entry->branches > 0 [1 file, +4/-0]
46ba5757a7 bpf: copy_verifier_state() should copy 'loop_entry' field [1 file, +3/-0]
82b54455b6 PCI: Fix old_size lower bound in calculate_iosize() too [1 file, +2/-4]
dc5f5c9d2b hrtimers: Replace hrtimer_clock_to_base_table with switch-case [1 file, +12/-17]
000dd6e344 ASoC: ops: Enforce platform maximum on initial value [1 file, +28/-1]
c4260bf83b ASoC: soc-dai: check return value at snd_soc_dai_set_tdm_slot() [1 file, +5/-3]
5b1b4cb46d pinctrl: devicetree: do not goto err when probing hogs in pinctrl_dt_to_map [1 file, +8/-2]
69689d1138 media: v4l: Memset argument to 0 before calling get_mbus_config pad op [2 files, +5/-1]
e6e31b0182 sched: Reduce the default slice to avoid tasks getting an extra tick [1 file, +3/-3]
ef31dc41cf phy: core: don't require set_mode() callback for phy_get_mode() to work [1 file, +4/-3]
06daedb443 xfrm: prevent high SEQ input in non-ESN mode [1 file, +12/-0]
9f2911868a ip: fib_rules: Fetch net from fib_rule in fib[46]_rule_configure(). [2 files, +4/-4]
7fea5a9140 r8152: add vendor/device ID pair for Dell Alienware AW1022z [2 files, +2/-0]
16ddd67bb5 pstore: Change kmsg_bytes storage size to u32 [3 files, +9/-8]
73733c2fdb ext4: don't write back data before punch hole in nojournal mode [1 file, +5/-13]
1d15319323 f2fs: introduce f2fs_base_attr for global sysfs entries [1 file, +52/-22]
ded26f9e4c ipv4: ip_gre: Fix set but not used warning in ipgre_err() if IPv4-only [1 file, +10/-6]
76e56dbe50 net: flush_backlog() small changes [1 file, +8/-4]
58cdd1ee65 bridge: mdb: Allow replace of a host-joined group [2 files, +2/-2]
fcabb69674 rcu: handle unstable rdp in rcu_read_unlock_strict() [2 files, +11/-2]
d402437cde rcu: fix header guard for rcu_all_qs() [1 file, +1/-1]
887e39ac47 perf: Avoid the read if the count is already updated [3 files, +24/-18]
c80b2d159c bpf: Use kallsyms to find the function name of a struct_ops's stub function [1 file, +44/-54]
46f1c2b508 firmware: arm_scmi: Relax duplicate name constraint across protocol ids [1 file, +6/-13]
1351052877 drm/atomic: clarify the rules around drm_atomic_state->allow_modeset [1 file, +21/-2]
9fddd1f154 drm: Add valid clones check [1 file, +28/-0]
ff214b079d nvme-pci: add quirks for device 126f:1001 [1 file, +3/-0]
6d196cae4b nvme-pci: add quirks for WDC Blue SN550 15b7:5009 [1 file, +3/-0]
6a09b6bad0 ALSA: usb-audio: Fix duplicated name in MIDI substream names [1 file, +12/-4]
ad3e83a6c8 io_uring/fdinfo: annotate racy sq/cq head/tail reads [1 file, +2/-2]
7f7c8c03fe btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref [1 file, +1/-1]
8cafd7266f __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock [1 file, +1/-5]
28756f22de espintcp: fix skb leaks [3 files, +9/-3]
9cbca30102 espintcp: remove encap socket caching to avoid reference leak [4 files, +8/-94]
b1a687eb15 xfrm: Fix UDP GRO handling for some corner cases [2 files, +20/-16]
447c8f0c06 kernel/fork: only call untrack_pfn_clear() on VMAs duplicated for fork() [1 file, +5/-4]
252f78a931 xfrm: Sanitize marks before insert [2 files, +6/-0]
7207effe47 driver core: Split devres APIs to device/devres.h [2 files, +125/-118]
1e8b7e96f7 Bluetooth: L2CAP: Fix not checking l2cap_chan security level [1 file, +8/-7]
cd7f022296 loop: don't require ->write_iter for writable files in loop_configure [1 file, +0/-3]
873ebaf3c1 io_uring: fix overflow resched cqe reordering [1 file, +1/-0]
689a205cd9 net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done [1 file, +5/-0]
adb05149a9 can: slcan: allow reception of short error messages [1 file, +20/-6]
cc55dd28c2 can: bcm: add locking for bcm_op runtime updates [1 file, +45/-21]
63567ecd99 can: bcm: add missing rcu read protection for procfs content [1 file, +9/-4]
bf85e49aaf ALSA: pcm: Fix race of buffer access at PCM OSS layer [3 files, +14/-2]
e78908caf1 pmdomain: core: Fix error checking in genpd_dev_pm_attach_by_id() [1 file, +1/-1]
dc9bdfb9b0 drm/edid: fixed the bug that hdr metadata was not reset [1 file, +1/-0]
cb9a1019a6 Input: xpad - add more controllers [1 file, +3/-0]
9b8263cae6 highmem: add folio_test_partial_kmap() [2 files, +12/-5]
314bf771cb memcg: always call cond_resched() after fn() [1 file, +2/-4]
9da33ce114 mm/page_alloc.c: avoid infinite retries caused by cpuset race [1 file, +8/-0]
9f9517f156 mm: mmap: map MAP_STACK to VM_NOHUGEPAGE only if THP is enabled [1 file, +2/-0]
94efb0d656 mm: vmalloc: actually use the in-place vrealloc region [1 file, +1/-0]
483ac74183 mm: vmalloc: only zero-init on vrealloc shrink [1 file, +7/-5]
1d45e0170c spi: use container_of_cont() for to_spi_device() [1 file, +1/-4]
d28b0305f7 err.h: move IOMEM_ERR_PTR() to err.h [2 files, +3/-2]
80eb73778d bpf: abort verification if env->cur_state->loop_entry != NULL [1 file, +4/-2]
85fb1edd05 drm/gem: Internally test import_attach for imported objects [1 file, +1/-2]
Changes in 6.12.31
drm/amd/display: Configure DTBCLK_P with OPTC only for dcn401
drm/amd/display: Do not enable replay when vtotal update is pending.
drm/amd/display: Correct timing_adjust_pending flag setting.
drm/amd/display: Defer BW-optimization-blocked DRR adjustments
i2c: designware: Use temporary variable for struct device
i2c: designware: Fix an error handling path in i2c_dw_pci_probe()
phy: renesas: rcar-gen3-usb2: Move IRQ request in probe
phy: renesas: rcar-gen3-usb2: Lock around hardware registers and driver data
phy: renesas: rcar-gen3-usb2: Assert PLL reset on PHY power off
cpufreq: Add SM8650 to cpufreq-dt-platdev blocklist
nvmem: rockchip-otp: Move read-offset into variant-data
nvmem: rockchip-otp: add rk3576 variant data
nvmem: core: fix bit offsets of more than one byte
nvmem: core: verify cell's raw_len
nvmem: core: update raw_len if the bit reading is required
nvmem: qfprom: switch to 4-byte aligned reads
scsi: target: iscsi: Fix timeout on deleted connection
scsi: ufs: Introduce quirk to extend PA_HIBERN8TIME for UFS devices
virtio_ring: Fix data race by tagging event_triggered as racy for KCSAN
dma/mapping.c: dev_dbg support for dma_addressing_limited
intel_th: avoid using deprecated page->mapping, index fields
mei: vsc: Use struct vsc_tp_packet as vsc-tp tx_buf and rx_buf type
dma-mapping: avoid potential unused data compilation warning
cgroup: Fix compilation issue due to cgroup_mutex not being exported
vhost_task: fix vhost_task_create() documentation
vhost-scsi: protect vq->log_used with vq->mutex
scsi: mpi3mr: Add level check to control event logging
net: enetc: refactor bulk flipping of RX buffers to separate function
dma-mapping: Fix warning reported for missing prototype
ima: process_measurement() needlessly takes inode_lock() on MAY_READ
fs/buffer: split locking for pagecache lookups
fs/buffer: introduce sleeping flavors for pagecache lookups
fs/buffer: use sleeping version of __find_get_block()
fs/ocfs2: use sleeping version of __find_get_block()
fs/jbd2: use sleeping version of __find_get_block()
fs/ext4: use sleeping version of sb_find_get_block()
drm/amd/display: Enable urgent latency adjustment on DCN35
drm/amdgpu: Allow P2P access through XGMI
selftests/bpf: Mitigate sockmap_ktls disconnect_after_delete failure
block: fix race between set_blocksize and read paths
io_uring: don't duplicate flushing in io_req_post_cqe
bpf: fix possible endless loop in BPF map iteration
samples/bpf: Fix compilation failure for samples/bpf on LoongArch Fedora
kconfig: merge_config: use an empty file as initfile
x86/fred: Fix system hang during S4 resume with FRED enabled
s390/vfio-ap: Fix no AP queue sharing allowed message written to kernel log
cifs: Add fallback for SMB2 CREATE without FILE_READ_ATTRIBUTES
cifs: Fix querying and creating MF symlinks over SMB1
cifs: Fix negotiate retry functionality
smb: client: Store original IO parameters and prevent zero IO sizes
fuse: Return EPERM rather than ENOSYS from link()
exfat: call bh_read in get_block only when necessary
io_uring/msg: initialise msg request opcode
NFSv4: Check for delegation validity in nfs_start_delegation_return_locked()
NFS: Don't allow waiting for exiting tasks
SUNRPC: Don't allow waiting for exiting tasks
arm64: Add support for HIP09 Spectre-BHB mitigation
iommufd: Extend IOMMU_GET_HW_INFO to report PASID capability
tracing: Mark binary printing functions with __printf() attribute
ACPI: PNP: Add Intel OC Watchdog IDs to non-PNP device list
tpm: Convert warn to dbg in tpm2_start_auth_session()
mailbox: pcc: Use acpi_os_ioremap() instead of ioremap()
mailbox: use error ret code of of_parse_phandle_with_args()
riscv: Allow NOMMU kernels to access all of RAM
fbdev: fsl-diu-fb: add missing device_remove_file()
fbcon: Use correct erase colour for clearing in fbcon
fbdev: core: tileblit: Implement missing margin clearing for tileblit
cifs: Set default Netbios RFC1001 server name to hostname in UNC
cifs: add validation check for the fields in smb_aces
cifs: Fix establishing NetBIOS session for SMB2+ connection
NFSv4: Treat ENETUNREACH errors as fatal for state recovery
SUNRPC: rpc_clnt_set_transport() must not change the autobind setting
SUNRPC: rpcbind should never reset the port to the value '0'
spi-rockchip: Fix register out of bounds access
ASoC: codecs: wsa884x: Correct VI sense channel mask
ASoC: codecs: wsa883x: Correct VI sense channel mask
mctp: Fix incorrect tx flow invalidation condition in mctp-i2c
net: tn40xx: add pci-id of the aqr105-based Tehuti TN4010 cards
net: tn40xx: create swnode for mdio and aqr105 phy and add to mdiobus
thermal/drivers/mediatek/lvts: Start sensor interrupts disabled
thermal/drivers/qoriq: Power down TMU on system suspend
Bluetooth: btmtksdio: Prevent enabling interrupts after IRQ handler removal
Bluetooth: Disable SCO support if READ_VOICE_SETTING is unsupported/broken
dql: Fix dql->limit value when reset.
lockdep: Fix wait context check on softirq for PREEMPT_RT
objtool: Properly disable uaccess validation
PCI: dwc: ep: Ensure proper iteration over outbound map windows
r8169: disable RTL8126 ZRX-DC timeout
tools/build: Don't pass test log files to linker
pNFS/flexfiles: Report ENETDOWN as a connection error
drm/amdgpu/discovery: check ip_discovery fw file available
drm/amdkfd: set precise mem ops caps to disabled for gfx 11 and 12
PCI: vmd: Disable MSI remapping bypass under Xen
xen/pci: Do not register devices with segments >= 0x10000
ext4: on a remount, only log the ro or r/w state when it has changed
libnvdimm/labels: Fix divide error in nd_label_data_init()
pidfs: improve multi-threaded exec and premature thread-group leader exit polling
staging: vchiq_arm: Create keep-alive thread during probe
mmc: host: Wait for Vdd to settle on card power off
drm/amdgpu: Skip pcie_replay_count sysfs creation for VF
cgroup/rstat: avoid disabling irqs for O(num_cpu)
wifi: mt76: only mark tx-status-failed frames as ACKed on mt76x0/2
wifi: mt76: mt7996: fix SER reset trigger on WED reset
wifi: mt76: mt7996: revise TXS size
wifi: mt76: mt7925: load the appropriate CLC data based on hardware type
wifi: mt76: mt7925: fix fails to enter low power mode in suspend state
x86/headers: Replace __ASSEMBLY__ with __ASSEMBLER__ in UAPI headers
x86/stackprotector/64: Only export __ref_stack_chk_guard on CONFIG_SMP
x86/smpboot: Fix INIT delay assignment for extended Intel Families
x86/microcode: Update the Intel processor flag scan check
x86/mm: Check return value from memblock_phys_alloc_range()
i2c: qup: Vote for interconnect bandwidth to DRAM
i2c: pxa: fix call balance of i2c->clk handling routines
btrfs: make btrfs_discard_workfn() block_group ref explicit
btrfs: avoid linker error in btrfs_find_create_tree_block()
btrfs: run btrfs_error_commit_super() early
btrfs: fix non-empty delayed iputs list on unmount due to async workers
btrfs: get zone unusable bytes while holding lock at btrfs_reclaim_bgs_work()
btrfs: send: return -ENAMETOOLONG when attempting a path that is too long
blk-cgroup: improve policy registration error handling
drm/amdgpu: release xcp_mgr on exit
drm/amd/display: Guard against setting dispclk low for dcn31x
drm/amdgpu: adjust drm_firmware_drivers_only() handling
i3c: master: svc: Fix missing STOP for master request
s390/tlb: Use mm_has_pgste() instead of mm_alloc_pgste()
dlm: make tcp still work in multi-link env
clocksource/drivers/timer-riscv: Stop stimecmp when cpu hotplug
um: Store full CSGSFS and SS register from mcontext
um: Update min_low_pfn to match changes in uml_reserved
wifi: mwifiex: Fix HT40 bandwidth issue.
bnxt_en: Query FW parameters when the CAPS_CHANGE bit is set
riscv: Call secondary mmu notifier when flushing the tlb
ext4: reorder capability check last
hypfs_create_cpu_files(): add missing check for hypfs_mkdir() failure
scsi: st: Tighten the page format heuristics with MODE SELECT
scsi: st: ERASE does not change tape location
vfio/pci: Handle INTx IRQ_NOTCONNECTED
bpf: Return prog btf_id without capable check
PCI: dwc: Use resource start as ioremap() input in dw_pcie_pme_turn_off()
jbd2: do not try to recover wiped journal
tcp: reorganize tcp_in_ack_event() and tcp_count_delivered()
rtc: rv3032: fix EERD location
objtool: Fix error handling inconsistencies in check()
thunderbolt: Do not add non-active NVM if NVM upgrade is disabled for retimer
erofs: initialize decompression early
spi: spi-mux: Fix coverity issue, unchecked return value
ASoC: pcm6240: Drop bogus code handling IRQ as GPIO
ASoC: mediatek: mt6359: Add stub for mt6359_accdet_enable_jack_detect
bpf: Allow pre-ordering for bpf cgroup progs
kbuild: fix argument parsing in scripts/config
kconfig: do not clear SYMBOL_VALID when reading include/config/auto.conf
crypto: octeontx2 - suppress auth failure screaming due to negative tests
dm: restrict dm device size to 2^63-512 bytes
net/smc: use the correct ndev to find pnetid by pnetid table
xen: Add support for XenServer 6.1 platform device
pinctrl-tegra: Restore SFSEL bit when freeing pins
mfd: tps65219: Remove TPS65219_REG_TI_DEV_ID check
drm/amdgpu/gfx12: don't read registers in mqd init
drm/amdgpu/gfx11: don't read registers in mqd init
drm/amdgpu: Update SRIOV video codec caps
ASoC: sun4i-codec: support hp-det-gpios property
clk: qcom: lpassaudiocc-sc7280: Add support for LPASS resets for QCM6490
ext4: reject the 'data_err=abort' option in nojournal mode
ext4: do not convert the unwritten extents if data writeback fails
RDMA/uverbs: Propagate errors from rdma_lookup_get_uobject()
posix-timers: Add cond_resched() to posix_timer_add() search loop
posix-timers: Ensure that timer initialization is fully visible
net: stmmac: dwmac-rk: Validate GRF and peripheral GRF during probe
net: hsr: Fix PRP duplicate detection
timer_list: Don't use %pK through printk()
wifi: rtw89: set force HE TB mode when connecting to 11ax AP
netfilter: conntrack: Bound nf_conntrack sysctl writes
PNP: Expand length of fixup id string
phy: rockchip: usbdp: Only verify link rates/lanes/voltage when the corresponding set flags are set
arm64/mm: Check pmd_table() in pmd_trans_huge()
arm64/mm: Check PUD_TYPE_TABLE in pud_bad()
mmc: dw_mmc: add exynos7870 DW MMC support
mmc: sdhci: Disable SD card clock before changing parameters
usb: xhci: Don't change the status of stalled TDs on failed Stop EP
wifi: iwlwifi: mvm: fix setting the TK when associated
hwmon: (dell-smm) Increment the number of fans
iommu: Keep dev->iommu state consistent
printk: Check CON_SUSPEND when unblanking a console
wifi: iwlwifi: don't warn when if there is a FW error
wifi: iwlwifi: w/a FW SMPS mode selection
wifi: iwlwifi: fix debug actions order
wifi: iwlwifi: mark Br device not integrated
wifi: iwlwifi: fix the ECKV UEFI variable name
wifi: mac80211: fix warning on disconnect during failed ML reconf
wifi: mac80211_hwsim: Fix MLD address translation
wifi: cfg80211: allow IR in 20 MHz configurations
ipv6: save dontfrag in cork
drm/amd/display: remove minimum Dispclk and apply oem panel timing.
drm/amd/display: calculate the remain segments for all pipes
drm/amd/display: not abort link train when bw is low
drm/amd/display: Fix incorrect DPCD configs while Replay/PSR switch
gfs2: Check for empty queue in run_queue
auxdisplay: charlcd: Partially revert "Move hwidth and bwidth to struct hd44780_common"
ASoC: qcom: sm8250: explicitly set format in sm8250_be_hw_params_fixup()
badblocks: Fix a nonsense WARN_ON() which checks whether a u64 variable < 0
coresight-etb10: change etb_drvdata spinlock's type to raw_spinlock_t
iommu/amd/pgtbl_v2: Improve error handling
cpufreq: tegra186: Share policy per cluster
watchdog: aspeed: Update bootstatus handling
PCI: endpoint: pci-epf-test: Fix double free that causes kernel to oops
misc: pci_endpoint_test: Give disabled BARs a distinct error code
crypto: lzo - Fix compression buffer overrun
crypto: mxs-dcp - Only set OTP_KEY bit for OTP key
drm/amdkfd: Set per-process flags only once for gfx9/10/11/12
drm/amdkfd: Set per-process flags only once cik/vi
drm/amdgpu: Fix missing drain retry fault the last entry
arm64: tegra: p2597: Fix gpio for vdd-1v8-dis regulator
arm64: tegra: Resize aperture for the IGX PCIe C5 slot
powerpc/prom_init: Fixup missing #size-cells on PowerBook6,7
ALSA: seq: Improve data consistency at polling
tcp: bring back NUMA dispersion in inet_ehash_locks_alloc()
rtc: ds1307: stop disabling alarms on probe
ieee802154: ca8210: Use proper setters and getters for bitwise types
drm/xe: Nuke VM's mapping upon close
drm/xe: Retry BO allocation
soc: samsung: include linux/array_size.h where needed
ARM: tegra: Switch DSI-B clock parent to PLLD on Tegra114
media: c8sectpfe: Call of_node_put(i2c_bus) only once in c8sectpfe_probe()
usb: xhci: set page size to the xHCI-supported size
dm cache: prevent BUG_ON by blocking retries on failed device resumes
soc: mediatek: mtk-mutex: Add DPI1 SOF/EOF to MT8188 mutex tables
orangefs: Do not truncate file size
drm/gem: Test for imported GEM buffers with helper
net: phylink: use pl->link_interface in phylink_expects_phy()
blk-throttle: don't take carryover for prioritized processing of metadata
remoteproc: qcom_wcnss: Handle platforms with only single power domain
drm/amdgpu: Do not program AGP BAR regs under SRIOV in gfxhub_v1_0.c
drm/amd/display: Ensure DMCUB idle before reset on DCN31/DCN35
drm/amd/display: Skip checking FRL_MODE bit for PCON BW determination
drm/amd/display: Fix DMUB reset sequence for DCN401
drm/amd/display: Fix p-state type when p-state is unsupported
drm/amd/display: Request HW cursor on DCN3.2 with SubVP
perf/core: Clean up perf_try_init_event()
media: cx231xx: set device_caps for 417
pinctrl: bcm281xx: Use "unsigned int" instead of bare "unsigned"
rcu: Fix get_state_synchronize_rcu_full() GP-start detection
net: ethernet: ti: cpsw_new: populate netdev of_node
net: phy: nxp-c45-tja11xx: add match_phy_device to TJA1103/TJA1104
dpll: Add an assertion to check freq_supported_num
ublk: enforce ublks_max only for unprivileged devices
iommufd: Disallow allocating nested parent domain with fault ID
media: imx335: Set vblank immediately
net: pktgen: fix mpls maximum labels list parsing
perf/hw_breakpoint: Return EOPNOTSUPP for unsupported breakpoint type
ALSA: hda/realtek: Enable PC beep passthrough for HP EliteBook 855 G7
scsi: logging: Fix scsi_logging_level bounds
ipv4: fib: Move fib_valid_key_len() to rtm_to_fib_config().
drm/rockchip: vop2: Add uv swap for cluster window
block: mark bounce buffering as incompatible with integrity
ublk: complete command synchronously on error
media: uvcvideo: Add sanity check to uvc_ioctl_xu_ctrl_map
media: uvcvideo: Handle uvc menu translation inside uvc_get_le_value
clk: imx8mp: inform CCF of maximum frequency of clocks
x86/bugs: Make spectre user default depend on MITIGATION_SPECTRE_V2
hwmon: (gpio-fan) Add missing mutex locks
ARM: at91: pm: fix at91_suspend_finish for ZQ calibration
drm/mediatek: mtk_dpi: Add checks for reg_h_fre_con existence
fpga: altera-cvp: Increase credit timeout
perf: arm_pmuv3: Call kvm_vcpu_pmu_resync_el0() before enabling counters
soc: apple: rtkit: Use high prio work queue
soc: apple: rtkit: Implement OSLog buffers properly
wifi: ath12k: Report proper tx completion status to mac80211
PCI: brcmstb: Expand inbound window size up to 64GB
PCI: brcmstb: Add a softdep to MIP MSI-X driver
firmware: arm_ffa: Set dma_mask for ffa devices
drm/xe/vf: Retry sending MMIO request to GUC on timeout error
drm/xe/pf: Create a link between PF and VF devices
net/mlx5: Avoid report two health errors on same syndrome
selftests/net: have `gro.sh -t` return a correct exit code
pinctrl: sophgo: avoid to modify untouched bit when setting cv1800 pinconf
drm/amdkfd: KFD release_work possible circular locking
drm/xe: xe_gen_wa_oob: replace program_invocation_short_name
leds: pwm-multicolor: Add check for fwnode_property_read_u32
net: ethernet: mtk_ppe_offload: Allow QinQ, double ETH_P_8021Q only
net: xgene-v2: remove incorrect ACPI_PTR annotation
bonding: report duplicate MAC address in all situations
wifi: ath12k: Improve BSS discovery with hidden SSID in 6 GHz band
soc: ti: k3-socinfo: Do not use syscon helper to build regmap
bpf: Search and add kfuncs in struct_ops prologue and epilogue
Octeontx2-af: RPM: Register driver with PCI subsys IDs
x86/build: Fix broken copy command in genimage.sh when making isoimage
drm/amd/display: handle max_downscale_src_width fail check
drm/amd/display: fix dcn4x init failed
drm/amd/display: Fix mismatch type comparison
ASoC: mediatek: mt8188: Treat DMIC_GAINx_CUR as non-volatile
ASoC: mediatek: mt8188: Add reference for dmic clocks
x86/nmi: Add an emergency handler in nmi_desc & use it in nmi_shootdown_cpus()
vhost-scsi: Return queue full for page alloc failures during copy
vdpa/mlx5: Fix mlx5_vdpa_get_config() endianness on big-endian machines
cpuidle: menu: Avoid discarding useful information
media: adv7180: Disable test-pattern control on adv7180
media: tc358746: improve calculation of the D-PHY timing registers
net/mlx5e: Add correct match to check IPSec syndromes for switchdev mode
scsi: mpi3mr: Update timestamp only for supervisor IOCs
loop: check in LO_FLAGS_DIRECT_IO in loop_default_blocksize
libbpf: Fix out-of-bound read
dm: fix unconditional IO throttle caused by REQ_PREFLUSH
scsi: scsi_debug: First fixes for tapes
net/mlx5: Change POOL_NEXT_SIZE define value and make it global
x86/kaslr: Reduce KASLR entropy on most x86 systems
crypto: ahash - Set default reqsize from ahash_alg
crypto: skcipher - Zap type in crypto_alloc_sync_skcipher
net: ipv6: Init tunnel link-netns before registering dev
drm/xe/oa: Ensure that polled read returns latest data
MIPS: Use arch specific syscall name match function
drm/amdgpu: remove all KFD fences from the BO on release
x86/locking: Use ALT_OUTPUT_SP() for percpu_{,try_}cmpxchg{64,128}_op()
genirq/msi: Store the IOMMU IOVA directly in msi_desc instead of iommu_cookie
MIPS: pm-cps: Use per-CPU variables as per-CPU, not per-core
clocksource: mips-gic-timer: Enable counter when CPUs start
PCI: epf-mhi: Update device ID for SA8775P
scsi: mpt3sas: Send a diag reset if target reset fails
wifi: rtw88: Fix rtw_init_vht_cap() for RTL8814AU
wifi: rtw88: Fix rtw_init_ht_cap() for RTL8814AU
wifi: rtw88: Fix rtw_desc_to_mcsrate() to handle MCS16-31
wifi: rtw89: fw: propagate error code from rtw89_h2c_tx()
wifi: rtw89: fw: get sb_sel_ver via get_unaligned_le32()
wifi: rtw89: fw: add blacklist to avoid obsolete secure firmware
wifi: rtw89: 8922a: fix incorrect STA-ID in EHT MU PPDU
net: pktgen: fix access outside of user given buffer in pktgen_thread_write()
power: supply: axp20x_battery: Update temp sensor for AXP717 from device tree
EDAC/ie31200: work around false positive build warning
i3c: master: svc: Flush FIFO before sending Dynamic Address Assignment(DAA)
mfd: axp20x: AXP717: Add AXP717_TS_PIN_CFG to writeable regs
eeprom: ee1004: Check chip before probing
irqchip/riscv-imsic: Separate next and previous pointers in IMSIC vector
drm/amd/pm: Fetch current power limit from PMFW
drm/amd/display: Add support for disconnected eDP streams
drm/amd/display: Guard against setting dispclk low when active
drm/amd/display: Fix BT2020 YCbCr limited/full range input
drm/amd/display: Read LTTPR ALPM caps during link cap retrieval
Revert "drm/amd/display: Request HW cursor on DCN3.2 with SubVP"
drm/amd/display: Don't treat wb connector as physical in create_validate_stream_for_sink
serial: mctrl_gpio: split disable_ms into sync and no_sync APIs
RDMA/core: Fix best page size finding when it can cross SG entries
pmdomain: imx: gpcv2: use proper helper for property detection
can: c_can: Use of_property_present() to test existence of DT property
bpf: don't do clean_live_states when state->loop_entry->branches > 0
bpf: copy_verifier_state() should copy 'loop_entry' field
eth: mlx4: don't try to complete XDP frames in netpoll
PCI: Fix old_size lower bound in calculate_iosize() too
ACPI: HED: Always initialize before evged
vxlan: Join / leave MC group after remote changes
hrtimers: Replace hrtimer_clock_to_base_table with switch-case
irqchip/riscv-imsic: Set irq_set_affinity() for IMSIC base
media: test-drivers: vivid: don't call schedule in loop
net/mlx5: Modify LSB bitmask in temperature event to include only the first bit
net/mlx5: Apply rate-limiting to high temperature warning
firmware: arm_ffa: Reject higher major version as incompatible
firmware: arm_ffa: Handle the presence of host partition in the partition info
firmware: xilinx: Dont send linux address to get fpga config get status
ASoC: ops: Enforce platform maximum on initial value
ASoC: tas2764: Add reg defaults for TAS2764_INT_CLK_CFG
ASoC: tas2764: Mark SW_RESET as volatile
ASoC: tas2764: Power up/down amp on mute ops
ASoC: soc-dai: check return value at snd_soc_dai_set_tdm_slot()
pinctrl: devicetree: do not goto err when probing hogs in pinctrl_dt_to_map
smack: recognize ipv4 CIPSO w/o categories
smack: Revert "smackfs: Added check catlen"
kunit: tool: Use qboot on QEMU x86_64
media: i2c: imx219: Correct the minimum vblanking value
media: v4l: Memset argument to 0 before calling get_mbus_config pad op
net/mlx4_core: Avoid impossible mlx4_db_alloc() order value
drm/xe: Stop ignoring errors from xe_ttm_stolen_mgr_init()
drm/xe: Fix xe_tile_init_noalloc() error propagation
clk: qcom: ipq5018: allow it to be bulid on arm32
clk: qcom: clk-alpha-pll: Do not use random stack value for recalc rate
drm/xe/debugfs: fixed the return value of wedged_mode_set
drm/xe/debugfs: Add missing xe_pm_runtime_put in wedge_mode_set
x86/ibt: Handle FineIBT in handle_cfi_failure()
x86/traps: Cleanup and robustify decode_bug()
sched: Reduce the default slice to avoid tasks getting an extra tick
serial: sh-sci: Update the suspend/resume support
pinctrl: renesas: rzg2l: Add suspend/resume support for pull up/down
phy: phy-rockchip-samsung-hdptx: Swap the definitions of LCPLL_REF and ROPLL_REF
phy: core: don't require set_mode() callback for phy_get_mode() to work
phy: exynos5-usbdrd: fix EDS distribution tuning (gs101)
soundwire: amd: change the soundwire wake enable/disable sequence
soundwire: cadence_master: set frame shape and divider based on actual clk freq
net: stmmac: dwmac-loongson: Set correct {tx,rx}_fifo_size
drm/amdgpu/mes11: fix set_hw_resources_1 calculation
drm/amdkfd: fix missing L2 cache info in topology
drm/amdgpu: Set snoop bit for SDMA for MI series
drm/amd/display: pass calculated dram_speed_mts to dml2
drm/amd/display: Don't try AUX transactions on disconnected link
drm/amdgpu: reset psp->cmd to NULL after releasing the buffer
drm/amd/pm: Skip P2S load for SMU v13.0.12
drm/amd/display: Support multiple options during psr entry.
Revert "drm/amd/display: Exit idle optimizations before attempt to access PHY"
drm/amd/display: Update CR AUX RD interval interpretation
drm/amd/display: Initial psr_version with correct setting
drm/amd/display: Increase block_sequence array size
drm/amd/display: Use Nominal vBlank If Provided Instead Of Capping It
drm/amd/display: Populate register address for dentist for dcn401
drm/amdgpu: Use active umc info from discovery
drm/amdgpu: enlarge the VBIOS binary size limit
drm/amd/display/dm: drop hw_support check in amdgpu_dm_i2c_xfer()
scsi: target: spc: Fix loop traversal in spc_rsoc_get_descr()
net/mlx5: XDP, Enable TX side XDP multi-buffer support
net/mlx5: Extend Ethtool loopback selftest to support non-linear SKB
net/mlx5e: set the tx_queue_len for pfifo_fast
net/mlx5e: reduce rep rxq depth to 256 for ECPF
net/mlx5e: reduce the max log mpwrq sz for ECPF and reps
drm/v3d: Add clock handling
xfrm: prevent high SEQ input in non-ESN mode
wifi: ath12k: fix the ampdu id fetch in the HAL_RX_MPDU_START TLV
mptcp: pm: userspace: flags: clearer msg if no remote addr
wifi: iwlwifi: use correct IMR dump variable
wifi: iwlwifi: don't warn during reprobe
wifi: mac80211: don't unconditionally call drv_mgd_complete_tx()
wifi: mac80211: remove misplaced drv_mgd_complete_tx() call
wifi: mac80211: set ieee80211_prep_tx_info::link_id upon Auth Rx
net: fec: Refactor MAC reset to function
powerpc/pseries/iommu: memory notifier incorrectly adds TCEs for pmemory
powerpc/pseries/iommu: create DDW for devices with DMA mask less than 64-bits
arch/powerpc/perf: Check the instruction type before creating sample with perf_mem_data_src
ip: fib_rules: Fetch net from fib_rule in fib[46]_rule_configure().
r8152: add vendor/device ID pair for Dell Alienware AW1022z
iio: adc: ad7944: don't use storagebits for sizing
pstore: Change kmsg_bytes storage size to u32
leds: trigger: netdev: Configure LED blink interval for HW offload
ext4: don't write back data before punch hole in nojournal mode
ext4: remove writable userspace mappings before truncating page cache
wifi: rtw88: Fix download_firmware_validate() for RTL8814AU
wifi: rtw88: Fix __rtw_download_firmware() for RTL8814AU
wifi: rtw89: coex: Assign value over than 0 to avoid firmware timer hang
wifi: rtw89: fw: validate multi-firmware header before getting its size
wifi: rtw89: fw: validate multi-firmware header before accessing
wifi: rtw89: call power_on ahead before selecting firmware
clk: qcom: camcc-sm8250: Use clk_rcg2_shared_ops for some RCGs
net: page_pool: avoid false positive warning if NAPI was never added
tools/power turbostat: Clustered Uncore MHz counters should honor show/hide options
hwmon: (xgene-hwmon) use appropriate type for the latency value
f2fs: introduce f2fs_base_attr for global sysfs entries
media: qcom: camss: csid: Only add TPG v4l2 ctrl if TPG hardware is available
media: qcom: camss: Add default case in vfe_src_pad_code
drm/rockchip: vop2: Improve display modes handling on RK3588 HDMI0
eth: fbnic: set IFF_UNICAST_FLT to avoid enabling promiscuous mode when adding unicast addrs
tools: ynl-gen: don't output external constants
net/mlx5e: Avoid WARN_ON when configuring MQPRIO with HTB offload enabled
cpufreq: amd-pstate: Remove unnecessary driver_lock in set_boost
vxlan: Annotate FDB data races
ipv4: ip_gre: Fix set but not used warning in ipgre_err() if IPv4-only
r8169: don't scan PHY addresses > 0
net: flush_backlog() small changes
bridge: mdb: Allow replace of a host-joined group
ice: init flow director before RDMA
ice: treat dyn_allowed only as suggestion
rcu: handle quiescent states for PREEMPT_RCU=n, PREEMPT_COUNT=y
rcu: handle unstable rdp in rcu_read_unlock_strict()
rcu: fix header guard for rcu_all_qs()
perf: Avoid the read if the count is already updated
ice: count combined queues using Rx/Tx count
drm/xe/relay: Don't use GFP_KERNEL for new transactions
net/mana: fix warning in the writer of client oob
scsi: lpfc: Handle duplicate D_IDs in ndlp search-by D_ID routine
scsi: lpfc: Ignore ndlp rport mismatch in dev_loss_tmo callbk
scsi: lpfc: Free phba irq in lpfc_sli4_enable_msi() when pci_irq_vector() fails
scsi: st: Restore some drive settings after reset
wifi: ath12k: Avoid napi_sync() before napi_enable()
HID: usbkbd: Fix the bit shift number for LED_KANA
arm64: zynqmp: add clock-output-names property in clock nodes
ASoC: codecs: pcm3168a: Allow for 24-bit in provider mode
ASoC: rt722-sdca: Add some missing readable registers
irqchip/riscv-aplic: Add support for hart indexes
dm vdo indexer: prevent unterminated string warning
dm vdo: use a short static string for thread name prefix
drm/ast: Find VBIOS mode from regular display size
bpf: Use kallsyms to find the function name of a struct_ops's stub function
bpftool: Fix readlink usage in get_fd_type
firmware: arm_scmi: Relax duplicate name constraint across protocol ids
perf/amd/ibs: Fix perf_ibs_op.cnt_mask for CurCnt
perf/amd/ibs: Fix ->config to sample period calculation for OP PMU
clk: renesas: rzg2l-cpg: Refactor Runtime PM clock validation
wifi: rtl8xxxu: retry firmware download on error
wifi: rtw88: Don't use static local variable in rtw8822b_set_tx_power_index_by_rate
wifi: rtw89: add wiphy_lock() to work that isn't held wiphy_lock() yet
spi: zynqmp-gqspi: Always acknowledge interrupts
regulator: ad5398: Add device tree support
wifi: ath12k: fix ath12k_hal_tx_cmd_ext_desc_setup() info1 override
accel/qaic: Mask out SR-IOV PCI resources
drm/xe/pf: Reset GuC VF config when unprovisioning critical resource
wifi: ath9k: return by of_get_mac_address
wifi: ath12k: Fetch regdb.bin file from board-2.bin
wifi: ath12k: Fix end offset bit definition in monitor ring descriptor
drm: bridge: adv7511: fill stream capabilities
drm/nouveau: fix the broken marco GSP_MSG_MAX_SIZE
wifi: ath11k: Use dma_alloc_noncoherent for rx_tid buffer allocation
drm/xe: Move suballocator init to after display init
drm/xe: Do not attempt to bootstrap VF in execlists mode
wifi: rtw89: coex: Separated Wi-Fi connecting event from Wi-Fi scan event
drm/xe/sa: Always call drm_suballoc_manager_fini()
drm/xe: Reject BO eviction if BO is bound to current VM
drm/atomic: clarify the rules around drm_atomic_state->allow_modeset
drm/buddy: fix issue that force_merge cannot free all roots
drm/panel-edp: Add Starry 116KHD024006
drm: Add valid clones check
ASoC: imx-card: Adjust over allocation of memory in imx_card_parse_of()
book3s64/radix: Fix compile errors when CONFIG_ARCH_WANT_OPTIMIZE_DAX_VMEMMAP=n
pinctrl: meson: define the pull up/down resistor value as 60 kOhm
smb: server: smb2pdu: check return value of xa_store()
platform/x86/intel: hid: Add Pantherlake support
platform/x86: asus-wmi: Disable OOBE state after resume from hibernation
platform/x86: ideapad-laptop: add support for some new buttons
ASoC: cs42l43: Disable headphone clamps during type detection
ASoC: Intel: bytcr_rt5640: Add DMI quirk for Acer Aspire SW3-013
ALSA: hda/realtek: Add quirk for HP Spectre x360 15-df1xxx
nvme-pci: add quirks for device 126f:1001
nvme-pci: add quirks for WDC Blue SN550 15b7:5009
ALSA: usb-audio: Fix duplicated name in MIDI substream names
nvmet-tcp: don't restore null sk_state_change
io_uring/fdinfo: annotate racy sq/cq head/tail reads
cifs: Fix and improve cifs_query_path_info() and cifs_query_file_info()
cifs: Fix changing times and read-only attr over SMB1 smb_set_file_info() function
ASoC: intel/sdw_utils: Add volume limit to cs42l43 speakers
btrfs: compression: adjust cb->compressed_folios allocation type
btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref
btrfs: handle empty eb->folios in num_extent_folios()
btrfs: avoid NULL pointer dereference if no valid csum tree
tools: ynl-gen: validate 0 len strings from kernel
block: only update request sector if needed
wifi: iwlwifi: add support for Killer on MTL
x86/Kconfig: make CFI_AUTO_DEFAULT depend on !RUST or Rust >= 1.88
xenbus: Allow PVH dom0 a non-local xenstore
drm/amd/display: Call FP Protect Before Mode Programming/Mode Support
__legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock
soundwire: bus: Fix race on the creation of the IRQ domain
espintcp: fix skb leaks
espintcp: remove encap socket caching to avoid reference leak
xfrm: Fix UDP GRO handling for some corner cases
dmaengine: idxd: Fix allowing write() from different address spaces
x86/sev: Fix operator precedence in GHCB_MSR_VMPL_REQ_LEVEL macro
kernel/fork: only call untrack_pfn_clear() on VMAs duplicated for fork()
remoteproc: qcom_wcnss: Fix on platforms without fallback regulators
clk: sunxi-ng: d1: Add missing divider for MMC mod clocks
xfrm: Sanitize marks before insert
dmaengine: idxd: Fix ->poll() return value
dmaengine: fsl-edma: Fix return code for unhandled interrupts
driver core: Split devres APIs to device/devres.h
devres: Introduce devm_kmemdup_array()
ASoC: SOF: Intel: hda: Fix UAF when reloading module
irqchip/riscv-imsic: Start local sync timer on correct CPU
perf/x86/intel: Fix segfault with PEBS-via-PT with sample_freq
Bluetooth: L2CAP: Fix not checking l2cap_chan security level
Bluetooth: btusb: use skb_pull to avoid unsafe access in QCA dump handling
ptp: ocp: Limit signal/freq counts in summary output functions
bridge: netfilter: Fix forwarding of fragmented packets
ice: fix vf->num_mac count with port representors
ice: Fix LACP bonds without SRIOV environment
idpf: fix null-ptr-deref in idpf_features_check
loop: don't require ->write_iter for writable files in loop_configure
pinctrl: qcom: switch to devm_register_sys_off_handler()
net: dwmac-sun8i: Use parsed internal PHY address instead of 1
net: lan743x: Restore SGMII CTRL register on resume
io_uring: fix overflow resched cqe reordering
idpf: fix idpf_vport_splitq_napi_poll()
sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue()
octeontx2-pf: Add AF_XDP non-zero copy support
net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done
octeontx2-af: Set LMT_ENA bit for APR table entries
octeontx2-af: Fix APR entry mapping based on APR_LMT_CFG
clk: s2mps11: initialise clk_hw_onecell_data::num before accessing ::hws[] in probe()
crypto: algif_hash - fix double free in hash_accept
padata: do not leak refcount in reorder_work
can: slcan: allow reception of short error messages
can: bcm: add locking for bcm_op runtime updates
can: bcm: add missing rcu read protection for procfs content
ASoC: SOF: ipc4-control: Use SOF_CTRL_CMD_BINARY as numid for bytes_ext
ASoC: SOF: Intel: hda-bus: Use PIO mode on ACE2+ platforms
ASoc: SOF: topology: connect DAI to a single DAI link
ASoC: SOF: ipc4-pcm: Delay reporting is only supported for playback direction
ALSA: pcm: Fix race of buffer access at PCM OSS layer
ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14ASP10
llc: fix data loss when reading from a socket in llc_ui_recvmsg()
can: kvaser_pciefd: Continue parsing DMA buf after dropped RX
can: kvaser_pciefd: Fix echo_skb race
net: dsa: microchip: linearize skb for tail-tagging switches
vmxnet3: update MTU after device quiesce
pmdomain: renesas: rcar: Remove obsolete nullify checks
pmdomain: core: Fix error checking in genpd_dev_pm_attach_by_id()
platform/x86: dell-wmi-sysman: Avoid buffer overflow in current_password_store()
thermal: intel: x86_pkg_temp_thermal: Fix bogus trip temperature
drm/edid: fixed the bug that hdr metadata was not reset
smb: client: Fix use-after-free in cifs_fill_dirent
arm64: dts: marvell: uDPU: define pinctrl state for alarm LEDs
smb: client: Reset all search buffer pointers when releasing buffer
Revert "drm/amd: Keep display off while going into S4"
Input: xpad - add more controllers
highmem: add folio_test_partial_kmap()
memcg: always call cond_resched() after fn()
mm/page_alloc.c: avoid infinite retries caused by cpuset race
mm: mmap: map MAP_STACK to VM_NOHUGEPAGE only if THP is enabled
mm: vmalloc: actually use the in-place vrealloc region
mm: vmalloc: only zero-init on vrealloc shrink
nilfs2: fix deadlock warnings caused by lock dependency in init_nilfs()
Bluetooth: btmtksdio: Check function enabled before doing close
Bluetooth: btmtksdio: Do close if SDIO card removed without close
Revert "arm64: dts: allwinner: h6: Use RSB for AXP805 PMIC connection"
ksmbd: fix stream write failure
platform/x86: think-lmi: Fix attribute name usage for non-compliant items
spi: use container_of_cont() for to_spi_device()
spi: spi-fsl-dspi: restrict register range for regmap access
spi: spi-fsl-dspi: Halt the module after a new message transfer
spi: spi-fsl-dspi: Reset SR flags before sending a new message
err.h: move IOMEM_ERR_PTR() to err.h
gcc-15: make 'unterminated string initialization' just a warning
gcc-15: disable '-Wunterminated-string-initialization' entirely for now
Fix mis-uses of 'cc-option' for warning disablement
kbuild: Properly disable -Wunterminated-string-initialization for clang
drm/amd/display: Exit idle optimizations before accessing PHY
bpf: abort verification if env->cur_state->loop_entry != NULL
serial: sh-sci: Save and restore more registers
drm/amdkfd: Correct F8_MODE for gfx950
watchdog: aspeed: fix 64-bit division
pinctrl: tegra: Fix off by one in tegra_pinctrl_get_group()
i3c: master: svc: Fix implicit fallthrough in svc_i3c_master_ibi_work()
x86/mm/init: Handle the special case of device private pages in add_pages(), to not increase max_pfn and trigger dma_addressing_limited() bounce buffers bounce buffers
drm/gem: Internally test import_attach for imported objects
Linux 6.12.31
Change-Id: I017795966fb764f9320a6a0df1571d19e5e631fe
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
commit 096208592b09c2f5fc0c1a174694efa41c04209d upstream.
This initializes tclass and dontfrag before cmsg parsing, removing the
need for explicit checks against -1 in each caller.
Leave hlimit set to -1, because its full initialization
(in ip6_sk_dst_hoplimit) requires more state (dst, flowi6, ..).
This also prepares for calling sockcm_init in a follow-on patch.
Signed-off-by: Willem de Bruijn <willemb@google.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Link: https://patch.msgid.link/20250214222720.3205500-7-willemdebruijn.kernel@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 6043b794c7668c19dabc4a93c75b924a19474d59 upstream.
During ILA address translations, the L4 checksums can be handled in
different ways. One of them, adj-transport, consist in parsing the
transport layer and updating any found checksum. This logic relies on
inet_proto_csum_replace_by_diff and produces an incorrect skb->csum when
in state CHECKSUM_COMPLETE.
This bug can be reproduced with a simple ILA to SIR mapping, assuming
packets are received with CHECKSUM_COMPLETE:
$ ip a show dev eth0
14: eth0@if15: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
link/ether 62:ae:35:9e:0f:8d brd ff:ff:ff:ff:ff:ff link-netnsid 0
inet6 3333:0:0:1::c078/64 scope global
valid_lft forever preferred_lft forever
inet6 fd00:10:244:1::c078/128 scope global nodad
valid_lft forever preferred_lft forever
inet6 fe80::60ae:35ff:fe9e:f8d/64 scope link proto kernel_ll
valid_lft forever preferred_lft forever
$ ip ila add loc_match fd00:10:244:1 loc 3333:0:0:1 \
csum-mode adj-transport ident-type luid dev eth0
Then I hit [fd00:10:244:1::c078]:8000 with a server listening only on
[3333:0:0:1::c078]:8000. With the bug, the SYN packet is dropped with
SKB_DROP_REASON_TCP_CSUM after inet_proto_csum_replace_by_diff changed
skb->csum. The translation and drop are visible on pwru [1] traces:
IFACE TUPLE FUNC
eth0:9 [fd00:10:244:3::3d8]:51420->[fd00:10:244:1::c078]:8000(tcp) ipv6_rcv
eth0:9 [fd00:10:244:3::3d8]:51420->[fd00:10:244:1::c078]:8000(tcp) ip6_rcv_core
eth0:9 [fd00:10:244:3::3d8]:51420->[fd00:10:244:1::c078]:8000(tcp) nf_hook_slow
eth0:9 [fd00:10:244:3::3d8]:51420->[fd00:10:244:1::c078]:8000(tcp) inet_proto_csum_replace_by_diff
eth0:9 [fd00:10:244:3::3d8]:51420->[3333:0:0:1::c078]:8000(tcp) tcp_v6_early_demux
eth0:9 [fd00:10:244:3::3d8]:51420->[3333:0:0:1::c078]:8000(tcp) ip6_route_input
eth0:9 [fd00:10:244:3::3d8]:51420->[3333:0:0:1::c078]:8000(tcp) ip6_input
eth0:9 [fd00:10:244:3::3d8]:51420->[3333:0:0:1::c078]:8000(tcp) ip6_input_finish
eth0:9 [fd00:10:244:3::3d8]:51420->[3333:0:0:1::c078]:8000(tcp) ip6_protocol_deliver_rcu
eth0:9 [fd00:10:244:3::3d8]:51420->[3333:0:0:1::c078]:8000(tcp) raw6_local_deliver
eth0:9 [fd00:10:244:3::3d8]:51420->[3333:0:0:1::c078]:8000(tcp) ipv6_raw_deliver
eth0:9 [fd00:10:244:3::3d8]:51420->[3333:0:0:1::c078]:8000(tcp) tcp_v6_rcv
eth0:9 [fd00:10:244:3::3d8]:51420->[3333:0:0:1::c078]:8000(tcp) __skb_checksum_complete
eth0:9 [fd00:10:244:3::3d8]:51420->[3333:0:0:1::c078]:8000(tcp) kfree_skb_reason(SKB_DROP_REASON_TCP_CSUM)
eth0:9 [fd00:10:244:3::3d8]:51420->[3333:0:0:1::c078]:8000(tcp) skb_release_head_state
eth0:9 [fd00:10:244:3::3d8]:51420->[3333:0:0:1::c078]:8000(tcp) skb_release_data
eth0:9 [fd00:10:244:3::3d8]:51420->[3333:0:0:1::c078]:8000(tcp) skb_free_head
eth0:9 [fd00:10:244:3::3d8]:51420->[3333:0:0:1::c078]:8000(tcp) kfree_skbmem
This is happening because inet_proto_csum_replace_by_diff is updating
skb->csum when it shouldn't. The L4 checksum is updated such that it
"cancels" the IPv6 address change in terms of checksum computation, so
the impact on skb->csum is null.
Note this would be different for an IPv4 packet since three fields
would be updated: the IPv4 address, the IP checksum, and the L4
checksum. Two would cancel each other and skb->csum would still need
to be updated to take the L4 checksum change into account.
This patch fixes it by passing an ipv6 flag to
inet_proto_csum_replace_by_diff, to skip the skb->csum update if we're
in the IPv6 case. Note the behavior of the only other user of
inet_proto_csum_replace_by_diff, the BPF subsystem, is left as is in
this patch and fixed in the subsequent patch.
With the fix, using the reproduction from above, I can confirm
skb->csum is not touched by inet_proto_csum_replace_by_diff and the TCP
SYN proceeds to the application after the ILA translation.
Link: https://github.com/cilium/pwru [1]
Fixes: 65d7ab8de5 ("net: Identifier Locator Addressing module")
Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://patch.msgid.link/b5539869e3550d46068504feb02d37653d939c0b.1748509484.git.paul.chaignon@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ Upstream commit 4876376988081d636a4c4e5f03a5556386b49087 ]
This reverts commit 484a54c2e5. The CoDel
parameter change essentially disables CoDel on slow stations, with some
questionable assumptions, as Dave pointed out in [0]. Quoting from
there:
But here are my pithy comments as to why this part of mac80211 is so
wrong...
static void sta_update_codel_params(struct sta_info *sta, u32 thr)
{
- if (thr && thr < STA_SLOW_THRESHOLD * sta->local->num_sta) {
1) sta->local->num_sta is the number of associated, rather than
active, stations. "Active" stations in the last 50ms or so, might have
been a better thing to use, but as most people have far more than that
associated, we end up with really lousy codel parameters, all the
time. Mistake numero uno!
2) The STA_SLOW_THRESHOLD was completely arbitrary in 2016.
- sta->cparams.target = MS2TIME(50);
This, by itself, was probably not too bad. 30ms might have been
better, at the time, when we were battling powersave etc, but 20ms was
enough, really, to cover most scenarios, even where we had low rate
2Ghz multicast to cope with. Even then, codel has a hard time finding
any sane drop rate at all, with a target this high.
- sta->cparams.interval = MS2TIME(300);
But this was horrible, a total mistake, that is leading to codel being
completely ineffective in almost any scenario on clients or APS.
100ms, even 80ms, here, would be vastly better than this insanity. I'm
seeing 5+seconds of delay accumulated in a bunch of otherwise happily
fq-ing APs....
100ms of observed jitter during a flow is enough. Certainly (in 2016)
there were interactions with powersave that I did not understand, and
still don't, but if you are transmitting in the first place, powersave
shouldn't be a problemmmm.....
- sta->cparams.ecn = false;
At the time we were pretty nervous about ecn, I'm kind of sanguine
about it now, and reliably indicating ecn seems better than turning it
off for any reason.
[...]
In production, on p2p wireless, I've had 8ms and 80ms for target and
interval for years now, and it works great.
I think Dave's arguments above are basically sound on the face of it,
and various experimentation with tighter CoDel parameters in the OpenWrt
community have show promising results[1]. So I don't think there's any
reason to keep this parameter fiddling; hence this revert.
[0] https://lore.kernel.org/linux-wireless/CAA93jw6NJ2cmLmMauz0xAgC2MGbBq6n0ZiZzAdkK0u4b+O2yXg@mail.gmail.com/
[1] https://forum.openwrt.org/t/reducing-multiplexing-latencies-still-further-in-wifi/133605/130
Suggested-By: Dave Taht <dave.taht@gmail.com>
In-memory-of: Dave Taht <dave.taht@gmail.com>
Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
Link: https://patch.msgid.link/20250403183930.197716-1-toke@toke.dk
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
In the case of SME-in-driver, the driver can internally choose to
update the links based on the AP MLD recommendation and do link
reconfiguration negotiation with AP MLD.
(e.g., After the driver processing the BSS Transition Management request
frame received from the AP MLD with Neighbor Report containing
Multi-Link element with recommended links information chooses to do link
reconfiguration negotiation with AP MLD).
To support this, extend cfg80211_mlo_reconf_add_done() and
NL80211_CMD_ASSOC_MLO_RECONF to indicate added links information for
driver-initiated link reconfiguration requests. For removed links,
the driver indicates links information using the
NL80211_CMD_LINKS_REMOVED event for driver-initiated cases, the same as
supplicant initiated cases.
For the driver-initiated case, cfg80211 will receive link
reconfiguration result asynchronously from driver so holding BSSes of
the accepted add links is needed in the event path. Also, no need of
unhold call for the rejected add link BSSes since there was no hold call
happened previously.
Once the supplicant receives the NL80211_CMD_ASSOC_MLO_RECONF event,
it needs to process the information about newly added links and install
per-link group keys (e.g., GTK/IGTK/BIGTK etc.).
In case of the SME-in-driver, using a vendor interface etc. to notify
the supplicant to initiate a link reconfiguration request and then
supplicant sending command to the cfg80211 can lead to race conditions.
The correct design to avoid this is that the driver indicates the
cfg80211 directly with the results of the link reconfiguration
negotiation.
Signed-off-by: Kavita Kavita <quic_kkavita@quicinc.com>
Link: https://patch.msgid.link/20250604105757.2542-3-quic_kkavita@quicinc.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Bug: 423444463
(cherry picked from commit 7c598c653ad465138ecc2fe64492633c541effef
https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next.git
main)
Change-Id: Ib2c7d38113f76bc46dc72f339ffdba5d3dd81988
Signed-off-by: Kavita Kavita <quic_kkavita@quicinc.com>
[ Upstream commit 2660a544fdc0940bba15f70508a46cf9a6491230 ]
sk->sk_prot->sock_is_readable is a valid function pointer when sk resides
in a sockmap. After the last sk_psock_put() (which usually happens when
socket is removed from sockmap), sk->sk_prot gets restored and
sk->sk_prot->sock_is_readable becomes NULL.
This makes sk_is_readable() racy, if the value of sk->sk_prot is reloaded
after the initial check. Which in turn may lead to a null pointer
dereference.
Ensure the function pointer does not turn NULL after the check.
Fixes: 8934ce2fd0 ("bpf: sockmap redirect ingress support")
Suggested-by: Jakub Sitnicki <jakub@cloudflare.com>
Signed-off-by: Michal Luczaj <mhal@rbox.co>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Link: https://patch.msgid.link/20250609-skisreadable-toctou-v1-1-d0dfb2d62c37@rbox.co
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 9a119669fb1924cd9658c16da39a5a585e129e50 ]
fib has two modes:
1. Obtain output device according to source or destination address
2. Obtain the type of the address, e.g. local, unicast, multicast.
'fib daddr type' should return 'local' if the address is configured
in this netns or unicast otherwise.
'fib daddr . iif type' should return 'local' if the address is configured
on the input interface or unicast otherwise, i.e. more restrictive.
However, if the interface is part of a VRF, then 'fib daddr type'
returns unicast even if the address is configured on the incoming
interface.
This is broken for both ipv4 and ipv6.
In the ipv4 case, inet_dev_addr_type must only be used if the
'iif' or 'oif' (strict mode) was requested.
Else inet_addr_type_dev_table() needs to be used and the correct
dev argument must be passed as well so the correct fib (vrf) table
is used.
In the ipv6 case, the bug is similar, without strict mode, dev is NULL
so .flowi6_l3mdev will be set to 0.
Add a new 'nft_fib_l3mdev_master_ifindex_rcu()' helper and use that
to init the .l3mdev structure member.
For ipv6, use it from nft_fib6_flowi_init() which gets called from
both the 'type' and the 'route' mode eval functions.
This provides consistent behaviour for all modes for both ipv4 and ipv6:
If strict matching is requested, the input respectively output device
of the netfilter hooks is used.
Otherwise, use skb->dev to obtain the l3mdev ifindex.
Without this, most type checks in updated nft_fib.sh selftest fail:
FAIL: did not find veth0 . 10.9.9.1 . local in fibtype4
FAIL: did not find veth0 . dead:1::1 . local in fibtype6
FAIL: did not find veth0 . dead:9::1 . local in fibtype6
FAIL: did not find tvrf . 10.0.1.1 . local in fibtype4
FAIL: did not find tvrf . 10.9.9.1 . local in fibtype4
FAIL: did not find tvrf . dead:1::1 . local in fibtype6
FAIL: did not find tvrf . dead:9::1 . local in fibtype6
FAIL: fib expression address types match (iif in vrf)
(fib errounously returns 'unicast' for all of them, even
though all of these addresses are local to the vrf).
Fixes: f6d0cbcf09 ("netfilter: nf_tables: add fib expression")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit ee62ce7a1d909ccba0399680a03c2dee83bcae95 ]
When enabling DMA mapping in page_pool, pages are kept DMA mapped until
they are released from the pool, to avoid the overhead of re-mapping the
pages every time they are used. This causes resource leaks and/or
crashes when there are pages still outstanding while the device is torn
down, because page_pool will attempt an unmap through a non-existent DMA
device on the subsequent page return.
To fix this, implement a simple tracking of outstanding DMA-mapped pages
in page pool using an xarray. This was first suggested by Mina[0], and
turns out to be fairly straight forward: We simply store pointers to
pages directly in the xarray with xa_alloc() when they are first DMA
mapped, and remove them from the array on unmap. Then, when a page pool
is torn down, it can simply walk the xarray and unmap all pages still
present there before returning, which also allows us to get rid of the
get/put_device() calls in page_pool. Using xa_cmpxchg(), no additional
synchronisation is needed, as a page will only ever be unmapped once.
To avoid having to walk the entire xarray on unmap to find the page
reference, we stash the ID assigned by xa_alloc() into the page
structure itself, using the upper bits of the pp_magic field. This
requires a couple of defines to avoid conflicting with the
POINTER_POISON_DELTA define, but this is all evaluated at compile-time,
so does not affect run-time performance. The bitmap calculations in this
patch gives the following number of bits for different architectures:
- 23 bits on 32-bit architectures
- 21 bits on PPC64 (because of the definition of ILLEGAL_POINTER_VALUE)
- 32 bits on other 64-bit architectures
Stashing a value into the unused bits of pp_magic does have the effect
that it can make the value stored there lie outside the unmappable
range (as governed by the mmap_min_addr sysctl), for architectures that
don't define ILLEGAL_POINTER_VALUE. This means that if one of the
pointers that is aliased to the pp_magic field (such as page->lru.next)
is dereferenced while the page is owned by page_pool, that could lead to
a dereference into userspace, which is a security concern. The risk of
this is mitigated by the fact that (a) we always clear pp_magic before
releasing a page from page_pool, and (b) this would need a
use-after-free bug for struct page, which can have many other risks
since page->lru.next is used as a generic list pointer in multiple
places in the kernel. As such, with this patch we take the position that
this risk is negligible in practice. For more discussion, see[1].
Since all the tracking added in this patch is performed on DMA
map/unmap, no additional code is needed in the fast path, meaning the
performance overhead of this tracking is negligible there. A
micro-benchmark shows that the total overhead of the tracking itself is
about 400 ns (39 cycles(tsc) 395.218 ns; sum for both map and unmap[2]).
Since this cost is only paid on DMA map and unmap, it seems like an
acceptable cost to fix the late unmap issue. Further optimisation can
narrow the cases where this cost is paid (for instance by eliding the
tracking when DMA map/unmap is a no-op).
The extra memory needed to track the pages is neatly encapsulated inside
xarray, which uses the 'struct xa_node' structure to track items. This
structure is 576 bytes long, with slots for 64 items, meaning that a
full node occurs only 9 bytes of overhead per slot it tracks (in
practice, it probably won't be this efficient, but in any case it should
be an acceptable overhead).
[0] https://lore.kernel.org/all/CAHS8izPg7B5DwKfSuzz-iOop_YRbk3Sd6Y4rX7KBG9DcVJcyWg@mail.gmail.com/
[1] https://lore.kernel.org/r/20250320023202.GA25514@openwall.com
[2] https://lore.kernel.org/r/ae07144c-9295-4c9d-a400-153bb689fe9e@huawei.com
Reported-by: Yonglong Liu <liuyonglong@huawei.com>
Closes: https://lore.kernel.org/r/8743264a-9700-4227-a556-5f931c720211@huawei.com
Fixes: ff7d6b27f8 ("page_pool: refurbish version of page_pool code")
Suggested-by: Mina Almasry <almasrymina@google.com>
Reviewed-by: Mina Almasry <almasrymina@google.com>
Reviewed-by: Jesper Dangaard Brouer <hawk@kernel.org>
Tested-by: Jesper Dangaard Brouer <hawk@kernel.org>
Tested-by: Qiuling Ren <qren@redhat.com>
Tested-by: Yuying Ma <yuma@redhat.com>
Tested-by: Yonglong Liu <liuyonglong@huawei.com>
Acked-by: Jesper Dangaard Brouer <hawk@kernel.org>
Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
Link: https://patch.msgid.link/20250409-page-pool-track-dma-v9-2-6a9ef2e0cba8@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
GKI (arm64) relevant 18 out of 143 changes, affecting 32 files +213/-83
10d1496f85 fs/xattr.c: fix simple_xattr_list to always include security.* xattrs [1 file, +24/-0]
bc4c54cbb4 binfmt_elf: Move brk for static PIE even if ASLR disabled [1 file, +47/-24]
f0d70d8dca cgroup/cpuset: Extend kthread_is_per_cpu() check to all PF_NO_SETAFFINITY tasks [1 file, +4/-2]
517c11fe4f tracing: probes: Fix a possible race in trace_probe_log APIs [5 files, +27/-3]
94e7272b63 HID: uclogic: Add NULL check in uclogic_input_configured() [1 file, +4/-3]
28826a89fd Bluetooth: MGMT: Fix MGMT_OP_ADD_DEVICE invalid device flags [1 file, +6/-3]
d1365ca80b net_sched: Flush gso_skb list too during ->change() [7 files, +21/-6]
ddfa034da3 nvme-pci: make nvme_pci_npages_prp() __always_inline [1 file, +1/-1]
a3c147040b nvme-pci: acquire cq_poll_lock in nvme_poll_irqdisable [1 file, +2/-0]
c88f4ff535 ALSA: usb-audio: Add sample rate quirk for Audioengine D1 [1 file, +2/-0]
93152dac0b ALSA: usb-audio: Add sample rate quirk for Microdia JP001 USB Camera [1 file, +2/-0]
fe1bebd0ed dma-buf: insert memory barrier before updating num_fences [1 file, +3/-2]
7d353da580 ftrace: Fix preemption accounting for stacktrace trigger command [1 file, +1/-1]
bffc3038a2 scsi: sd_zbc: block: Respect bio vector limits for REPORT ZONES buffer [3 files, +7/-2]
20d6e621be ring-buffer: Fix persistent buffer when commit page is the reader page [1 file, +5/-3]
fe0756daad mm: userfaultfd: correct dirty flags set for both present and swap pte [1 file, +10/-2]
74953f93f4 mm/page_alloc: fix race condition in unaccepted memory handling [1 file, +0/-23]
5924b32446 usb: typec: ucsi: displayport: Fix deadlock [3 files, +47/-8]
Changes in 6.12.30
arm64: dts: rockchip: Assign RT5616 MCLK rate on rk3588-friendlyelec-cm3588
fs/xattr.c: fix simple_xattr_list to always include security.* xattrs
drivers/platform/x86/amd: pmf: Check for invalid sideloaded Smart PC Policies
drivers/platform/x86/amd: pmf: Check for invalid Smart PC Policies
riscv: dts: sophgo: fix DMA data-width configuration for CV18xx
binfmt_elf: Move brk for static PIE even if ASLR disabled
platform/x86/amd/pmc: Declare quirk_spurious_8042 for MECHREVO Wujie 14XA (GX4HRXL)
platform/x86: asus-wmi: Fix wlan_ctrl_by_user detection
arm64: dts: imx8mp-var-som: Fix LDO5 shutdown causing SD card timeout
cgroup/cpuset: Extend kthread_is_per_cpu() check to all PF_NO_SETAFFINITY tasks
tracing: probes: Fix a possible race in trace_probe_log APIs
tpm: tis: Double the timeout B to 4s
uio_hv_generic: Fix sysfs creation path for ring buffer
KVM: Add member to struct kvm_gfn_range to indicate private/shared
KVM: x86/mmu: Prevent installing hugepages when mem attributes are changing
iio: adc: ad7266: Fix potential timestamp alignment issue.
iio: chemical: pms7003: use aligned_s64 for timestamp
iio: pressure: mprls0025pa: use aligned_s64 for timestamp
drm/amd: Add Suspend/Hibernate notification callback support
Revert "drm/amd: Stop evicting resources on APUs in suspend"
xhci: dbc: Improve performance by removing delay in transfer event polling.
xhci: dbc: Avoid event polling busyloop if pending rx transfers are inactive.
iio: adc: ad7768-1: Fix insufficient alignment of timestamp.
iio: chemical: sps30: use aligned_s64 for timestamp
virtio_ring: add a func argument 'recycle_done' to virtqueue_reset()
virtio_net: ensure netdev_tx_reset_queue is called on bind xsk for tx
RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug
HID: thrustmaster: fix memory leak in thrustmaster_interrupts()
HID: uclogic: Add NULL check in uclogic_input_configured()
nfs: handle failure of nfs_get_lock_context in unlock path
spi: loopback-test: Do not split 1024-byte hexdumps
RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem
Bluetooth: MGMT: Fix MGMT_OP_ADD_DEVICE invalid device flags
net_sched: Flush gso_skb list too during ->change()
tools/net/ynl: ethtool: fix crash when Hardware Clock info is missing
mctp: no longer rely on net->dev_index_head[]
net: mctp: Don't access ifa_index when missing
selftests: ncdevmem: Redirect all non-payload output to stderr
selftests: ncdevmem: Separate out dmabuf provider
selftests: ncdevmem: Unify error handling
selftests: ncdevmem: Make client_ip optional
selftests: ncdevmem: Switch to AF_INET6
tests/ncdevmem: Fix double-free of queue array
net: mctp: Ensure keys maintain only one ref to corresponding dev
ALSA: seq: Fix delivery of UMP events to group ports
ALSA: ump: Fix a typo of snd_ump_stream_msg_device_info
net: cadence: macb: Fix a possible deadlock in macb_halt_tx.
net: dsa: sja1105: discard incoming frames in BR_STATE_LISTENING
nvme-pci: make nvme_pci_npages_prp() __always_inline
nvme-pci: acquire cq_poll_lock in nvme_poll_irqdisable
ALSA: sh: SND_AICA should depend on SH_DMA_API
net: dsa: b53: prevent standalone from trying to forward to other ports
vsock/test: Fix occasional failure in SIOCOUTQ tests
net/mlx5e: Disable MACsec offload for uplink representor profile
qlcnic: fix memory leak in qlcnic_sriov_channel_cfg_cmd()
regulator: max20086: fix invalid memory access
drm/xe: Save CTX_TIMESTAMP mmio value instead of LRC value
netlink: specs: tc: fix a couple of attribute names
netlink: specs: tc: all actions are indexed arrays
octeontx2-pf: macsec: Fix incorrect max transmit size in TX secy
net: ethernet: mtk_eth_soc: fix typo for declaration MT7988 ESW capability
octeontx2-af: Fix CGX Receive counters
octeontx2-pf: Do not reallocate all ntuple filters
wifi: mac80211: Set n_channels after allocating struct cfg80211_scan_request
mlxsw: spectrum_router: Fix use-after-free when deleting GRE net devices
net/tls: fix kernel panic when alloc_page failed
tsnep: fix timestamping with a stacked DSA driver
NFSv4/pnfs: Reset the layout state after a layoutreturn
dmaengine: Revert "dmaengine: dmatest: Fix dmatest waiting less when interrupted"
sched_ext: bpf_iter_scx_dsq_new() should always initialize iterator
udf: Make sure i_lenExtents is uptodate on inode eviction
HID: bpf: abort dispatch if device destroyed
LoongArch: Prevent cond_resched() occurring within kernel-fpu
LoongArch: Move __arch_cpu_idle() to .cpuidle.text section
LoongArch: Save and restore CSR.CNTC for hibernation
LoongArch: Fix MAX_REG_OFFSET calculation
LoongArch: uprobes: Remove user_{en,dis}able_single_step()
LoongArch: uprobes: Remove redundant code about resume_era
btrfs: fix discard worker infinite loop after disabling discard
btrfs: fix folio leak in submit_one_async_extent()
btrfs: add back warning for mount option commit values exceeding 300
Revert "drm/amd/display: Hardware cursor changes color when switched to software cursor"
drm/amdgpu: fix incorrect MALL size for GFX1151
drm/amdgpu: csa unmap use uninterruptible lock
drm/amd/display: Correct the reply value when AUX write incomplete
drm/amd/display: Avoid flooding unnecessary info messages
MAINTAINERS: Update Alexey Makhalov's email address
gpio: pca953x: fix IRQ storm on system wake up
ACPI: PPTT: Fix processor subtable walk
ALSA: es1968: Add error handling for snd_pcm_hw_constraint_pow2()
ALSA: usb-audio: Add sample rate quirk for Audioengine D1
ALSA: usb-audio: Add sample rate quirk for Microdia JP001 USB Camera
dma-buf: insert memory barrier before updating num_fences
hv_netvsc: Use vmbus_sendpacket_mpb_desc() to send VMBus messages
hv_netvsc: Preserve contiguous PFN grouping in the page buffer array
hv_netvsc: Remove rmsg_pgcnt
arm64: dts: amlogic: dreambox: fix missing clkc_audio node
arm64: dts: rockchip: Remove overdrive-mode OPPs from RK3588J SoC dtsi
Drivers: hv: Allow vmbus_sendpacket_mpb_desc() to create multiple ranges
Drivers: hv: vmbus: Remove vmbus_sendpacket_pagebuffer()
kbuild: Disable -Wdefault-const-init-unsafe
ftrace: Fix preemption accounting for stacktrace trigger command
ftrace: Fix preemption accounting for stacktrace filter command
tracing: samples: Initialize trace_array_printk() with the correct function
phy: tegra: xusb: Use a bitmask for UTMI pad power state tracking
phy: Fix error handling in tegra_xusb_port_init
phy: renesas: rcar-gen3-usb2: Fix role detection on unbind/bind
phy: renesas: rcar-gen3-usb2: Set timing registers only once
scsi: sd_zbc: block: Respect bio vector limits for REPORT ZONES buffer
smb: client: fix memory leak during error handling for POSIX mkdir
spi: tegra114: Use value to check for invalid delays
tpm: Mask TPM RC in tpm2_start_auth_session()
wifi: mt76: disable napi on driver removal
ring-buffer: Fix persistent buffer when commit page is the reader page
net: qede: Initialize qede_ll_ops with designated initializer
mm: userfaultfd: correct dirty flags set for both present and swap pte
dmaengine: ti: k3-udma: Add missing locking
dmaengine: ti: k3-udma: Use cap_mask directly from dma_device structure instead of a local copy
dmaengine: idxd: fix memory leak in error handling path of idxd_setup_wqs
dmaengine: idxd: fix memory leak in error handling path of idxd_setup_engines
dmaengine: idxd: fix memory leak in error handling path of idxd_setup_groups
dmaengine: idxd: Add missing cleanup for early error out in idxd_setup_internals
dmaengine: idxd: Add missing cleanups in cleanup internals
dmaengine: idxd: Add missing idxd cleanup to fix memory leak in remove call
dmaengine: idxd: fix memory leak in error handling path of idxd_alloc
dmaengine: idxd: fix memory leak in error handling path of idxd_pci_probe
dmaengine: idxd: Refactor remove call with idxd_cleanup() helper
CIFS: New mount option for cifs.upcall namespace resolution
drm/xe/gsc: do not flush the GSC worker from the reset path
mm/page_alloc: fix race condition in unaccepted memory handling
accel/ivpu: Rename ivpu_log_level to fw_log_level
accel/ivpu: Reset fw log on cold boot
accel/ivpu: Refactor functions in ivpu_fw_log.c
accel/ivpu: Fix fw log printing
iio: light: opt3001: fix deadlock due to concurrent flag access
Bluetooth: btnxpuart: Fix kernel panic during FW release
drm/fbdev-dma: Support struct drm_driver.fbdev_probe
drm/panel-mipi-dbi: Run DRM default client setup
drm/tiny: panel-mipi-dbi: Use drm_client_setup_with_fourcc()
usb: typec: ucsi: displayport: Fix deadlock
phy: tegra: xusb: remove a stray unlock
drm/amdgpu: fix pm notifier handling
Linux 6.12.30
Change-Id: I4fefed85c02f1ed826b7ee014700b80c10300bb5
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
[ Upstream commit 028363685bd0b7a19b4a820f82dd905b1dc83999 ]
The current scheme for caching the encap socket can lead to reference
leaks when we try to delete the netns.
The reference chain is: xfrm_state -> enacp_sk -> netns
Since the encap socket is a userspace socket, it holds a reference on
the netns. If we delete the espintcp state (through flush or
individual delete) before removing the netns, the reference on the
socket is dropped and the netns is correctly deleted. Otherwise, the
netns may not be reachable anymore (if all processes within the ns
have terminated), so we cannot delete the xfrm state to drop its
reference on the socket.
This patch results in a small (~2% in my tests) performance
regression.
A GC-type mechanism could be added for the socket cache, to clear
references if the state hasn't been used "recently", but it's a lot
more complex than just not caching the socket.
Fixes: e27cca96cd ("xfrm: add espintcp (RFC 8229)")
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This reverts commit 65d3c57061 which is
commit a1356ac7749cafc4e27aa62c0c4604b5dca4983e upstream.
It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.
Bug: 161946584
Change-Id: I15acb18ebd9dd5a0d2fb0bf4153c5ced269f978a
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
GKI (arm64) relevant 33 out of 166 changes, affecting 52 files +454/-363
0aaae77be5 ALSA: usb-audio: Add retry on -EPROTO from usb_set_interface() [1 file, +7/-0]
fdf0ae5e9e ALSA: usb-audio: Add second USB ID for Jabra Evolve 65 headset [1 file, +2/-1]
38d9ca7405 binder: fix offset calculation in debug log [1 file, +1/-1]
f1dfc94584 drm/fdinfo: Protect against driver unbind [1 file, +6/-0]
090c8714ef arm64: errata: Add missing sentinels to Spectre-BHB MIDR arrays [1 file, +2/-0]
eb9b72e4fe mm/memblock: pass size instead of end to memblock_set_node() [1 file, +1/-1]
9c4ddea497 mm/memblock: repeat setting reserved region nid if array is doubled [1 file, +10/-0]
0988dd0263 tracing: Do not take trace_event_sem in print_event_fields() [1 file, +2/-2]
f451082572 dm-bufio: don't schedule in atomic context [1 file, +8/-1]
510aea4ef0 dm: always update the array size in realloc_argv on success [1 file, +3/-2]
2e303d0107 iommu: Fix two issues in iommu_copy_struct_from_user() [1 file, +4/-4]
573b047229 cpufreq: Avoid using inconsistent policy->min and policy->max [1 file, +25/-7]
962d88304c cpufreq: Fix setting policy limits when frequency tables are used [4 files, +73/-41]
1f27a3e93b tracing: Fix oob write in trace_seq_to_buffer() [1 file, +3/-2]
220395054c ASoC: soc-core: Stop using of_property_read_bool() for non-boolean properties [1 file, +13/-19]
29a4a29112 ASoC: soc-pcm: Fix hw_params() and DAPM widget sequence [1 file, +4/-1]
65d3c57061 xsk: Fix race condition in AF_XDP generic RX path [4 files, +6/-6]
fe81c26d2d Bluetooth: hci_conn: Remove alloc from critical section [1 file, +10/-18]
eb8b860e87 Bluetooth: hci_conn: Fix not setting conn_timeout for Broadcast Receiver [6 files, +95/-107]
620810ac1f Bluetooth: hci_conn: Fix not setting timeout for BIG Create Sync [7 files, +88/-109]
432572d536 Bluetooth: L2CAP: copy RX timestamp to new fragments [1 file, +3/-0]
6b1355860d scsi: ufs: core: Remove redundant query_complete trace [1 file, +0/-2]
5ad0b1b554 nvme-pci: fix queue unquiesce check on slot_reset [1 file, +1/-1]
6effe1c0fa net: ipv6: fix UDPv6 GSO segmentation with NAT [1 file, +60/-1]
c0dba059b1 net: use sock_gen_put() when sk_state is TCP_TIME_WAIT [2 files, +2/-2]
e10ec6e32b blk-mq: create correct map for fallback case [1 file, +1/-2]
dab2a13059 mm, slab: clean up slab->obj_exts always [1 file, +7/-20]
0a188c0e19 sch_htb: make htb_qlen_notify() idempotent [1 file, +2/-0]
969d8beaa2 firmware: arm_scmi: Balance device refcount when destroying devices [1 file, +3/-0]
3b41b5efae kernel: param: rename locate_module_kobject [1 file, +3/-3]
69113bf740 kernel: globalize lookup_or_create_module_kobject() [2 files, +3/-1]
e1eea69858 drivers: base: handle module_kobject creation [1 file, +5/-8]
db62809197 dm: fix copying after src array boundaries [1 file, +1/-1]
Changes in 6.12.28
Bluetooth: btusb: add Foxconn 0xe0fc for Qualcomm WCN785x
Bluetooth: btusb: Add one more ID 0x0489:0xe0f3 for Qualcomm WCN785x
Bluetooth: btusb: Add one more ID 0x13d3:0x3623 for Qualcomm WCN785x
Bluetooth: btusb: Add ID 0x2c7c:0x0130 for Qualcomm WCN785x
Bluetooth: btusb: Add new VID/PID for WCN785x
Bluetooth: btusb: Add 13 USB device IDs for Qualcomm WCN785x
Revert "rndis_host: Flag RNDIS modems as WWAN devices"
ALSA: usb-audio: Add retry on -EPROTO from usb_set_interface()
ALSA: usb-audio: Add second USB ID for Jabra Evolve 65 headset
binder: fix offset calculation in debug log
btrfs: adjust subpage bit start based on sectorsize
btrfs: fix COW handling in run_delalloc_nocow()
cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode
drm/fdinfo: Protect against driver unbind
drm/nouveau: Fix WARN_ON in nouveau_fence_context_kill()
EDAC/altera: Test the correct error reg offset
EDAC/altera: Set DDR and SDMMC interrupt mask before registration
i2c: imx-lpi2c: Fix clock count when probe defers
arm64: errata: Add missing sentinels to Spectre-BHB MIDR arrays
parisc: Fix double SIGFPE crash
perf/x86/intel: Only check the group flag for X86 leader
perf/x86/intel: KVM: Mask PEBS_ENABLE loaded for guest with vCPU's value.
amd-xgbe: Fix to ensure dependent features are toggled with RX checksum offload
irqchip/qcom-mpm: Prevent crash when trying to handle non-wake GPIOs
mm/memblock: pass size instead of end to memblock_set_node()
mm/memblock: repeat setting reserved region nid if array is doubled
mmc: renesas_sdhi: Fix error handling in renesas_sdhi_probe
spi: tegra114: Don't fail set_cs_timing when delays are zero
tracing: Do not take trace_event_sem in print_event_fields()
wifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage()
x86/boot/sev: Support memory acceptance in the EFI stub under SVSM
dm-bufio: don't schedule in atomic context
dm-integrity: fix a warning on invalid table line
dm: always update the array size in realloc_argv on success
drm/amdgpu: Fix offset for HDP remap in nbio v7.11
drm: Select DRM_KMS_HELPER from DRM_DEBUG_DP_MST_TOPOLOGY_REFS
iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid
iommu/arm-smmu-v3: Fix iommu_device_probe bug due to duplicated stream ids
iommu/arm-smmu-v3: Fix pgsize_bit for sva domains
iommu/vt-d: Apply quirk_iommu_igfx for 8086:0044 (QM57/QS57)
iommu: Fix two issues in iommu_copy_struct_from_user()
platform/x86/amd: pmc: Require at least 2.5 seconds between HW sleep cycles
platform/x86/intel-uncore-freq: Fix missing uncore sysfs during CPU hotplug
ksmbd: fix use-after-free in ksmbd_session_rpc_open
ksmbd: fix use-after-free in kerberos authentication
ksmbd: fix use-after-free in session logoff
smb: client: fix zero length for mkdir POSIX create context
cpufreq: Avoid using inconsistent policy->min and policy->max
cpufreq: Fix setting policy limits when frequency tables are used
tracing: Fix oob write in trace_seq_to_buffer()
drm/amd/display: Default IPS to RCG_IN_ACTIVE_IPS2_IN_OFF
ASoC: soc-core: Stop using of_property_read_bool() for non-boolean properties
ASoC: cs-amp-lib-test: Don't select SND_SOC_CS_AMP_LIB
ASoC: soc-pcm: Fix hw_params() and DAPM widget sequence
book3s64/radix : Align section vmemmap start address to PAGE_SIZE
pinctrl: imx: Return NULL if no group is matched and found
powerpc/boot: Check for ld-option support
ASoC: Intel: sof_sdw: Add NULL check in asoc_sdw_rt_dmic_rtd_init()
ALSA: hda/realtek - Enable speaker for HP platform
drm/i915/pxp: fix undefined reference to `intel_pxp_gsccs_is_ready_for_sessions'
wifi: iwlwifi: don't warn if the NIC is gone in resume
wifi: iwlwifi: fix the check for the SCRATCH register upon resume
wifi: plfxlc: Remove erroneous assert in plfxlc_mac_release
powerpc/boot: Fix dash warning
vxlan: vnifilter: Fix unlocked deletion of default FDB entry
xsk: Fix race condition in AF_XDP generic RX path
net/mlx5e: Use custom tunnel header for vxlan gbp
net/mlx5: E-Switch, Initialize MAC Address for Default GID
net/mlx5e: TC, Continue the attr process even if encap entry is invalid
net/mlx5e: Fix lock order in mlx5e_tx_reporter_ptpsq_unhealthy_recover
net/mlx5: E-switch, Fix error handling for enabling roce
accel/ivpu: Correct DCT interrupt handling
ASoC: amd: acp: Fix NULL pointer deref in acp_i2s_set_tdm_slot
Bluetooth: hci_conn: Remove alloc from critical section
Bluetooth: hci_conn: Fix not setting conn_timeout for Broadcast Receiver
Bluetooth: hci_conn: Fix not setting timeout for BIG Create Sync
Bluetooth: btintel_pcie: Avoid redundant buffer allocation
Bluetooth: btusb: avoid NULL pointer dereference in skb_dequeue()
Bluetooth: btintel_pcie: Add additional to checks to clear TX/RX paths
Bluetooth: L2CAP: copy RX timestamp to new fragments
net: mscc: ocelot: delete PVID VLAN when readding it as non-PVID
octeon_ep_vf: Resolve netdevice usage count issue
bnxt_en: improve TX timestamping FIFO configuration
rtase: Modify the condition used to detect overflow in rtase_calc_time_mitigation
net: ethernet: mtk-star-emac: fix spinlock recursion issues on rx/tx poll
net: ethernet: mtk-star-emac: rearm interrupts in rx_poll only when advised
net: ethernet: mtk_eth_soc: sync mtk_clks_source_name array
pds_core: make pdsc_auxbus_dev_del() void
pds_core: specify auxiliary_device to be created
pds_core: remove write-after-free of client_id
net_sched: drr: Fix double list add in class with netem as child qdisc
net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc
net_sched: ets: Fix double list add in class with netem as child qdisc
net_sched: qfq: Fix double list add in class with netem as child qdisc
ice: Check VF VSI Pointer Value in ice_vc_add_fdir_fltr()
idpf: fix offloads support for encapsulated packets
scsi: ufs: core: Remove redundant query_complete trace
ALSA: ump: Fix buffer overflow at UMP SysEx message conversion
nvme-pci: fix queue unquiesce check on slot_reset
drm/tests: shmem: Fix memleak
drm/mipi-dbi: Fix blanking for non-16 bit formats
net: dlink: Correct endianness handling of led_mode
net: mdio: mux-meson-gxl: set reversed bit when using internal phy
idpf: fix potential memory leak on kcalloc() failure
idpf: protect shutdown from reset
igc: fix lock order in igc_ptp_reset
net: ethernet: mtk_eth_soc: fix SER panic with 4GB+ RAM
net: dsa: felix: fix broken taprio gate states after clock jump
net: ipv6: fix UDPv6 GSO segmentation with NAT
ALSA: hda/realtek: Fix built-mic regression on other ASUS models
bnxt_en: Fix error handling path in bnxt_init_chip()
bnxt_en: Fix ethtool selftest output in one of the failure cases
bnxt_en: Add missing skb_mark_for_recycle() in bnxt_rx_vlan()
bnxt_en: call pci_alloc_irq_vectors() after bnxt_reserve_rings()
bnxt_en: Fix coredump logic to free allocated buffer
bnxt_en: Fix out-of-bound memcpy() during ethtool -w
bnxt_en: Fix ethtool -d byte order for 32-bit values
nvme-tcp: fix premature queue removal and I/O failover
nvme-tcp: select CONFIG_TLS from CONFIG_NVME_TCP_TLS
nvmet-tcp: select CONFIG_TLS from CONFIG_NVME_TARGET_TCP_TLS
ASoC: simple-card-utils: Fix pointer check in graph_util_parse_link_direction
bnxt_en: fix module unload sequence
net: use sock_gen_put() when sk_state is TCP_TIME_WAIT
ptp: ocp: Fix NULL dereference in Adva board SMA sysfs operations
net: lan743x: Fix memleak issue when GSO enabled
net: fec: ERR007885 Workaround for conventional TX
octeon_ep: Fix host hang issue during device reboot
net: hns3: store rx VLAN tag offload state for VF
net: hns3: fix an interrupt residual problem
net: hns3: fixed debugfs tm_qset size
net: hns3: defer calling ptp_clock_register()
net: vertexcom: mse102x: Fix possible stuck of SPI interrupt
net: vertexcom: mse102x: Fix LEN_MASK
net: vertexcom: mse102x: Add range check for CMD_RTS
net: vertexcom: mse102x: Fix RX error handling
blk-mq: create correct map for fallback case
mm, slab: clean up slab->obj_exts always
bcachefs: Remove incorrect __counted_by annotation
net: Fix the devmem sock opts and msgs for parisc
accel/ivpu: Make DB_ID and JOB_ID allocations incremental
accel/ivpu: Use xa_alloc_cyclic() instead of custom function
accel/ivpu: Fix a typo
accel/ivpu: Update VPU FW API headers
accel/ivpu: Abort all jobs after command queue unregister
accel/ivpu: Fix locking order in ivpu_job_submit
accel/ivpu: Add handling of VPU_JSM_STATUS_MVNCI_CONTEXT_VIOLATION_HW
sch_htb: make htb_qlen_notify() idempotent
sch_drr: make drr_qlen_notify() idempotent
sch_hfsc: make hfsc_qlen_notify() idempotent
sch_qfq: make qfq_qlen_notify() idempotent
sch_ets: make est_qlen_notify() idempotent
drm/xe: Ensure fixed_slice_mode gets set after ccs_mode change
firmware: arm_scmi: Balance device refcount when destroying devices
firmware: arm_ffa: Skip Rx buffer ownership release if not acquired
arm64: dts: imx95: Correct the range of PCIe app-reg region
ARM: dts: opos6ul: add ksz8081 phy properties
arm64: dts: st: Adjust interrupt-controller for stm32mp25 SoCs
arm64: dts: st: Use 128kB size for aliased GIC400 register access on stm32mp25 SoCs
Revert "drm/meson: vclk: fix calculation of 59.94 fractional rates"
kernel: param: rename locate_module_kobject
kernel: globalize lookup_or_create_module_kobject()
drivers: base: handle module_kobject creation
drm/amd/display: Add scoped mutexes for amdgpu_dm_dhcp
drm/amd/display: Fix slab-use-after-free in hdcp
dm: fix copying after src array boundaries
Linux 6.12.28
Change-Id: I79f3d50a10acfe53f329b4b5a4af502f488c61f3
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
[ Upstream commit 2d3cbfd6d54a2c39ce3244f33f85c595844bd7b8 ]
Previously, when reducing a qdisc's limit via the ->change() operation, only
the main skb queue was trimmed, potentially leaving packets in the gso_skb
list. This could result in NULL pointer dereference when we only check
sch->limit against sch->q.qlen.
This patch introduces a new helper, qdisc_dequeue_internal(), which ensures
both the gso_skb list and the main queue are properly flushed when trimming
excess packets. All relevant qdiscs (codel, fq, fq_codel, fq_pie, hhf, pie)
are updated to use this helper in their ->change() routines.
Fixes: 76e3cc126b ("codel: Controlled Delay AQM")
Fixes: 4b549a2ef4 ("fq_codel: Fair Queue Codel AQM")
Fixes: afe4fd0624 ("pkt_sched: fq: Fair Queue packet scheduler")
Fixes: ec97ecf1eb ("net: sched: add Flow Queue PIE packet scheduler")
Fixes: 10239edf86 ("net-qdisc-hhf: Heavy-Hitter Filter (HHF) qdisc")
Fixes: d4b36210c2 ("net: pkt_sched: PIE AQM scheme")
Reported-by: Will <willsroot@protonmail.com>
Reported-by: Savy <savy@syst3mfailure.io>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
GKI (arm64) relevant 69 out of 278 changes, affecting 88 files +585/-290
0b603e7759 tracing: Add __print_dynamic_array() helper [3 files, +15/-1]
0312735402 tracing: Verify event formats that have "%*p.." [2 files, +13/-2]
1c9798bf81 mm/vmscan: don't try to reclaim hwpoison folio [1 file, +7/-0]
db3b3964af PM: EM: use kfree_rcu() to simplify the code [1 file, +1/-9]
9d5752b853 PM: EM: Address RCU-related sparse warnings [2 files, +26/-25]
3e12e8c273 block: remove the write_hint field from struct request [4 files, +13/-12]
ed7535b141 block: remove the ioprio field from struct request [4 files, +11/-15]
2afa5ea7c4 block: make sure ->nr_integrity_segments is cloned in blk_rq_prep_clone [1 file, +1/-0]
46d3575209 PCI/MSI: Handle the NOMASK flag correctly for all PCI/MSI backends [1 file, +6/-12]
35ba7b2d4d PCI/MSI: Add an option to write MSIX ENTRY_DATA before any reads [2 files, +5/-0]
16c8aa5de1 dma/contiguous: avoid warning about unused size_bytes [1 file, +1/-2]
7ccfadfb25 cpufreq: scmi: Fix null-ptr-deref in scmi_cpufreq_get_rate() [1 file, +8/-2]
28fbd7b13b cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate() [1 file, +10/-3]
7d002f5914 scsi: ufs: mcq: Add NULL check in ufshcd_mcq_abort() [1 file, +5/-7]
5d92e582d1 cgroup/cpuset-v1: Add missing support for cpuset_v2_mode [1 file, +29/-0]
29daa63f2c scsi: core: Clear flags for scsi_cmnd that did not complete [1 file, +5/-1]
eeab661803 scsi: ufs: core: Add NULL check in ufshcd_mcq_compl_pending_transfer() [1 file, +2/-0]
41143e7105 net: phy: leds: fix memory leak [1 file, +13/-10]
0ceef62a32 tipc: fix NULL pointer dereference in tipc_mon_reinit_self() [1 file, +2/-1]
a61afd5482 fix a couple of races in MNT_TREE_BENEATH handling by do_move_mount() [1 file, +36/-33]
7f24ea6a46 block: never reduce ra_pages in blk_apply_bdi_limits [1 file, +7/-1]
3decda1a3c splice: remove duplicate noinline from pipe_clear_nowait [1 file, +1/-1]
30c0d6e778 virtio_console: fix missing byte order handling for cols and rows [1 file, +4/-3]
c2a6b4d78c net: selftests: initialize TCP header and skb payload with zero [1 file, +13/-5]
3939d6f29d irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode() [1 file, +1/-1]
7a8a6b627f io_uring: fix 'sync' handling of io_fallback_tw() [1 file, +7/-6]
1f439fe4d8 scsi: Improve CDL control [1 file, +24/-12]
3670dee376 char: misc: register chrdev region with all possible minors [1 file, +1/-1]
ea0d806b94 USB: serial: ftdi_sio: add support for Abacus Electrics Optical Probe [2 files, +7/-0]
1777714865 xhci: Limit time spent with xHC interrupts disabled during bus resume [3 files, +20/-16]
bce3055b08 usb: xhci: Fix invalid pointer dereference in Etron workaround [1 file, +1/-1]
52a7c9d930 usb: dwc3: gadget: check that event count does not exceed event buffer length [1 file, +6/-0]
9924ee1bcd usb: quirks: add DELAY_INIT quirk for Silicon Motion Flash Drive [1 file, +3/-0]
d85b7af3bd usb: quirks: Add delay init quirk for SanDisk 3.2Gen1 Flash Drive [1 file, +3/-0]
3e52ae347e USB: VLI disk crashes if LPM is used [1 file, +3/-0]
0486de3c1b crypto: null - Use spin lock instead of mutex [1 file, +26/-13]
7758e308ae bpf: Fix kmemleak warning for percpu hashmap [1 file, +3/-3]
c5c833f637 bpf: Fix deadlock between rcu_tasks_trace and event_mutex. [1 file, +4/-3]
4139072087 clk: check for disabled clock-provider in of_clk_get_hw_from_clkspec() [1 file, +4/-0]
4131411f42 bpf: Only fails the busy counter check in bpf_cgrp_storage_get if it creates storage [1 file, +6/-5]
b817d2bfd6 bpf: Reject attaching fexit/fmod_ret to __noreturn functions [1 file, +32/-0]
2ecae00138 usb: dwc3: gadget: Refactor loop to avoid NULL endpoints [1 file, +18/-4]
cbfa55bda1 usb: xhci: Complete 'error mid TD' transfers when handling Missed Service [1 file, +5/-1]
16a7a8e6c4 usb: xhci: Fix isochronous Ring Underrun/Overrun event handling [1 file, +14/-6]
635be13606 xhci: Handle spurious events on Etron host isoc enpoints [2 files, +27/-13]
9ff59cb815 usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running [1 file, +7/-4]
0485bdf88f objtool, panic: Disable SMAP in __stack_chk_fail() [2 files, +10/-1]
c548f95688 9p/net: fix improper handling of bogus negative read/write replies [1 file, +16/-14]
18296b5951 9p/trans_fd: mark concurrent read and writes to p9_conn->err [1 file, +10/-7]
3568fd9e44 io_uring: always do atomic put from iowq [2 files, +8/-1]
90dc6c1e3b perf/core: Fix WARN_ON(!ctx) in __free_event() for partial init [1 file, +3/-3]
24ede35eb2 nvme: requeue namespace scan on missed AENs [1 file, +4/-0]
b9c89c97d7 nvme: re-read ANA log page after ns scan completes [1 file, +5/-0]
ee5521176a nvme: multipath: fix return value of nvme_available_path [1 file, +1/-1]
5e58b93a12 gpiolib: of: Move Atmel HSMCI quirk up out of the regulator comment [1 file, +3/-3]
9f8eeac3a6 timekeeping: Add a lockdep override in tick_freeze() [1 file, +22/-0]
b14d986413 iommu: Clear iommu-dma ops on cleanup [1 file, +3/-0]
b626bc3c1d ext4: make block validity check resistent to sb bh corruption [2 files, +6/-6]
2ef6eea2ef netfs: Only create /proc/fs/netfs with CONFIG_PROC_FS [1 file, +4/-0]
d53b2d49a8 iomap: skip unnecessary ifs_block_is_uptodate check [1 file, +1/-1]
bfc66c4c28 Revert "drivers: core: synchronize really_probe() and dev_uevent()" [1 file, +0/-3]
de7c24febd usb: typec: class: Fix NULL pointer access [2 files, +14/-2]
45314999f9 ext4: goto right label 'out_mmap_sem' in ext4_setattr() [1 file, +1/-1]
40966fc993 usb: typec: class: Invalidate USB device pointers on partner unregistration [1 file, +6/-2]
4833d0a92b iommu: Handle race with default domain setup [1 file, +5/-0]
1042d22942 nvme: fixup scan failure for non-ANA multipath controllers [1 file, +1/-1]
1b7647efad usb: xhci: Fix Short Packet handling rework ignoring errors [1 file, +1/-1]
ab5281d21e usb: typec: class: Unlocked on error in typec_register_partner() [1 file, +1/-0]
6b9ebcbd31 mq-deadline: don't call req_get_ioprio from the I/O completion handler [1 file, +4/-9]
Changes in 6.12.26
module: sign with sha512 instead of sha1 by default
tracing: Add __print_dynamic_array() helper
tracing: Verify event formats that have "%*p.."
mm/vmscan: don't try to reclaim hwpoison folio
soc: qcom: ice: introduce devm_of_qcom_ice_get
mmc: sdhci-msm: fix dev reference leaked through of_qcom_ice_get
PM: EM: use kfree_rcu() to simplify the code
PM: EM: Address RCU-related sparse warnings
media: i2c: imx214: Use subdev active state
media: i2c: imx214: Simplify with dev_err_probe()
media: i2c: imx214: Convert to CCI register access helpers
media: i2c: imx214: Replace register addresses with macros
media: i2c: imx214: Check number of lanes from device tree
media: i2c: imx214: Fix link frequency validation
media: ov08x40: Move ov08x40_identify_module() function up
media: ov08x40: Add missing ov08x40_identify_module() call on stream-start
block: remove the write_hint field from struct request
block: remove the ioprio field from struct request
block: make sure ->nr_integrity_segments is cloned in blk_rq_prep_clone
net: dsa: mv88e6xxx: fix VTU methods for 6320 family
iio: adc: ad7768-1: Move setting of val a bit later to avoid unnecessary return value check
iio: adc: ad7768-1: Fix conversion result sign
arm64: dts: ti: Refactor J784s4 SoC files to a common file
arm64: dts: ti: k3-j784s4-j742s2-main-common: Fix serdes_ln_ctrl reg-masks
of: resolver: Simplify of_resolve_phandles() using __free()
of: resolver: Fix device node refcount leakage in of_resolve_phandles()
scsi: ufs: qcom: fix dev reference leaked through of_qcom_ice_get
PCI/MSI: Convert pci_msi_ignore_mask to per MSI domain flag
PCI/MSI: Handle the NOMASK flag correctly for all PCI/MSI backends
PCI/MSI: Add an option to write MSIX ENTRY_DATA before any reads
accel/ivpu: Add auto selection logic for job scheduler
accel/ivpu: Fix the NPU's DPU frequency calculation
ksmbd: use __GFP_RETRY_MAYFAIL
ksmbd: add netdev-up/down event debug print
ksmbd: browse interfaces list on FSCTL_QUERY_INTERFACE_INFO IOCTL
ksmbd: fix use-after-free in __smb2_lease_break_noti()
scsi: ufs: exynos: Remove empty drv_init method
scsi: ufs: exynos: Remove superfluous function parameter
scsi: ufs: exynos: Add gs101_ufs_drv_init() hook and enable WriteBooster
scsi: ufs: exynos: Move UFS shareability value to drvdata
scsi: ufs: exynos: Disable iocc if dma-coherent property isn't set
net/niu: Niu requires MSIX ENTRY_DATA fields touch before entry reads
drm/xe/bmg: Add one additional PCI ID
drm/amd/display: Fix unnecessary cast warnings from checkpatch
drm/amd/display/dml2: use vzalloc rather than kzalloc
lib/Kconfig.ubsan: Remove 'default UBSAN' from UBSAN_INTEGER_WRAP
ceph: Fix incorrect flush end position calculation
cpufreq: sun50i: prevent out-of-bounds access
dma/contiguous: avoid warning about unused size_bytes
cpufreq: apple-soc: Fix null-ptr-deref in apple_soc_cpufreq_get_rate()
cpufreq: scmi: Fix null-ptr-deref in scmi_cpufreq_get_rate()
cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate()
scsi: ufs: mcq: Add NULL check in ufshcd_mcq_abort()
cpufreq: cppc: Fix invalid return value in .get() callback
cpufreq: Do not enable by default during compile testing
cpufreq: fix compile-test defaults
btrfs: avoid page_lockend underflow in btrfs_punch_hole_lock_range()
btrfs: zoned: return EIO on RAID1 block group write pointer mismatch
cgroup/cpuset-v1: Add missing support for cpuset_v2_mode
vhost-scsi: Add better resource allocation failure handling
vhost-scsi: Fix vhost_scsi_send_bad_target()
vhost-scsi: Fix vhost_scsi_send_status()
net/mlx5: Fix null-ptr-deref in mlx5_create_{inner_,}ttc_table()
net/mlx5: Move ttc allocation after switch case to prevent leaks
scsi: core: Clear flags for scsi_cmnd that did not complete
scsi: ufs: core: Add NULL check in ufshcd_mcq_compl_pending_transfer()
net: lwtunnel: disable BHs when required
net: phy: leds: fix memory leak
tipc: fix NULL pointer dereference in tipc_mon_reinit_self()
net: ethernet: mtk_eth_soc: net: revise NETSYSv3 hardware configuration
fix a couple of races in MNT_TREE_BENEATH handling by do_move_mount()
net_sched: hfsc: Fix a UAF vulnerability in class handling
net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too
net: dsa: mt7530: sync driver-specific behavior of MT7531 variants
pds_core: Prevent possible adminq overflow/stuck condition
pds_core: handle unsupported PDS_CORE_CMD_FW_CONTROL result
pds_core: Remove unnecessary check in pds_client_adminq_cmd()
pds_core: make wait_context part of q_info
block: never reduce ra_pages in blk_apply_bdi_limits
iommu/amd: Return an error if vCPU affinity is set for non-vCPU IRTE
riscv: Replace function-like macro by static inline function
riscv: uprobes: Add missing fence.i after building the XOL buffer
splice: remove duplicate noinline from pipe_clear_nowait
bpf: Add namespace to BPF internal symbols
perf/x86: Fix non-sampling (counting) events on certain x86 platforms
LoongArch: Select ARCH_USE_MEMTEST
LoongArch: Make regs_irqs_disabled() more clear
LoongArch: Make do_xyz() exception handlers more robust
KVM: SVM: Disable AVIC on SNP-enabled system without HvInUseWrAllowed feature
netfilter: fib: avoid lookup if socket is available
virtio_console: fix missing byte order handling for cols and rows
sched_ext: Use kvzalloc for large exit_dump allocation
crypto: atmel-sha204a - Set hwrng quality to lowest possible
xen-netfront: handle NULL returned by xdp_convert_buff_to_frame()
net: selftests: initialize TCP header and skb payload with zero
net: phy: microchip: force IRQ polling mode for lan88xx
scsi: mpi3mr: Fix pending I/O counter
rust: firmware: Use `ffi::c_char` type in `FwFunc`
drm: panel: jd9365da: fix reset signal polarity in unprepare
drm/amd/display: Fix gpu reset in multidisplay config
drm/amd/display: Force full update in gpu reset
x86/insn: Fix CTEST instruction decoding
irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode()
LoongArch: Handle fp, lsx, lasx and lbt assembly symbols
LoongArch: Return NULL from huge_pte_offset() for invalid PMD
LoongArch: Remove a bogus reference to ZONE_DMA
LoongArch: KVM: Fully clear some CSRs when VM reboot
LoongArch: KVM: Fix PMU pass-through issue if VM exits to host finally
io_uring: fix 'sync' handling of io_fallback_tw()
KVM: SVM: Allocate IR data using atomic allocation
cxl/core/regs.c: Skip Memory Space Enable check for RCD and RCH Ports
mcb: fix a double free bug in chameleon_parse_gdd()
ata: libata-scsi: Improve CDL control
ata: libata-scsi: Fix ata_mselect_control_ata_feature() return type
ata: libata-scsi: Fix ata_msense_control_ata_feature()
USB: storage: quirk for ADATA Portable HDD CH94
scsi: Improve CDL control
mei: me: add panther lake H DID
mei: vsc: Fix fortify-panic caused by invalid counted_by() use
KVM: x86: Explicitly treat routing entry type changes as changes
KVM: x86: Reset IRTE to host control if *new* route isn't postable
KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer
char: misc: register chrdev region with all possible minors
misc: microchip: pci1xxxx: Fix Kernel panic during IRQ handler registration
misc: microchip: pci1xxxx: Fix incorrect IRQ status handling during ack
firmware: stratix10-svc: Add of_platform_default_populate()
tty: Require CAP_SYS_ADMIN for all usages of TIOCL_SELMOUSEREPORT
serial: msm: Configure correct working mode before starting earlycon
serial: sifive: lock port in startup()/shutdown() callbacks
USB: serial: ftdi_sio: add support for Abacus Electrics Optical Probe
USB: serial: option: add Sierra Wireless EM9291
USB: serial: simple: add OWON HDS200 series oscilloscope support
xhci: Limit time spent with xHC interrupts disabled during bus resume
usb: xhci: Fix invalid pointer dereference in Etron workaround
usb: cdns3: Fix deadlock when using NCM gadget
usb: chipidea: ci_hdrc_imx: fix usbmisc handling
usb: chipidea: ci_hdrc_imx: fix call balance of regulator routines
usb: chipidea: ci_hdrc_imx: implement usb_phy_init() error handling
USB: OHCI: Add quirk for LS7A OHCI controller (rev 0x02)
usb: dwc3: gadget: check that event count does not exceed event buffer length
usb: dwc3: xilinx: Prevent spike in reset signal
usb: quirks: add DELAY_INIT quirk for Silicon Motion Flash Drive
usb: quirks: Add delay init quirk for SanDisk 3.2Gen1 Flash Drive
USB: VLI disk crashes if LPM is used
USB: wdm: handle IO errors in wdm_wwan_port_start
USB: wdm: close race between wdm_open and wdm_wwan_port_stop
USB: wdm: wdm_wwan_port_tx_complete mutex in atomic context
USB: wdm: add annotation
selftests/bpf: Fix stdout race condition in traffic monitor
pinctrl: renesas: rza2: Fix potential NULL pointer dereference
pinctrl: mcp23s08: Get rid of spurious level interrupts
MIPS: cm: Detect CM quirks from device tree
crypto: ccp - Add support for PCI device 0x1134
crypto: lib/Kconfig - Fix lib built-in failure when arch is modular
crypto: null - Use spin lock instead of mutex
bpf: Fix kmemleak warning for percpu hashmap
bpf: Fix deadlock between rcu_tasks_trace and event_mutex.
clk: check for disabled clock-provider in of_clk_get_hw_from_clkspec()
parisc: PDT: Fix missing prototype warning
s390/sclp: Add check for get_zeroed_page()
s390/tty: Fix a potential memory leak bug
bpf: bpftool: Setting error code in do_loader()
bpf: Only fails the busy counter check in bpf_cgrp_storage_get if it creates storage
bpf: Reject attaching fexit/fmod_ret to __noreturn functions
mailbox: pcc: Fix the possible race in updation of chan_in_use flag
mailbox: pcc: Always clear the platform ack interrupt first
usb: host: max3421-hcd: Add missing spi_device_id table
fs/ntfs3: Keep write operations atomic
fs/ntfs3: Fix WARNING in ntfs_extend_initialized_size
usb: dwc3: gadget: Refactor loop to avoid NULL endpoints
usb: dwc3: gadget: Avoid using reserved endpoints on Intel Merrifield
sound/virtio: Fix cancel_sync warnings on uninitialized work_structs
usb: xhci: Complete 'error mid TD' transfers when handling Missed Service
usb: xhci: Fix isochronous Ring Underrun/Overrun event handling
xhci: Handle spurious events on Etron host isoc enpoints
i3c: master: svc: Add support for Nuvoton npcm845 i3c
dmaengine: dmatest: Fix dmatest waiting less when interrupted
usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running
phy: rockchip: usbdp: Avoid call hpd_event_trigger in dp_phy_init
usb: gadget: aspeed: Add NULL pointer check in ast_vhub_init_dev()
usb: host: xhci-plat: mvebu: use ->quirks instead of ->init_quirk() func
thunderbolt: Scan retimers after device router has been enumerated
um: work around sched_yield not yielding in time-travel mode
objtool: Silence more KCOV warnings
objtool, panic: Disable SMAP in __stack_chk_fail()
objtool, ASoC: codecs: wcd934x: Remove potential undefined behavior in wcd934x_slim_irq_handler()
objtool, regulator: rk808: Remove potential undefined behavior in rk806_set_mode_dcdc()
objtool, lkdtm: Obfuscate the do_nothing() pointer
qibfs: fix _another_ leak
ntb: reduce stack usage in idt_scan_mws
ntb_hw_amd: Add NTB PCI ID for new gen CPU
9p/net: fix improper handling of bogus negative read/write replies
9p/trans_fd: mark concurrent read and writes to p9_conn->err
rtc: pcf85063: do a SW reset if POR failed
io_uring: always do atomic put from iowq
kbuild: add dependency from vmlinux to sorttable
sched/isolation: Make CONFIG_CPU_ISOLATION depend on CONFIG_SMP
KVM: s390: Don't use %pK through tracepoints
KVM: s390: Don't use %pK through debug printing
cgroup/cpuset: Don't allow creation of local partition over a remote one
selftests: ublk: fix test_stripe_04
perf/core: Fix WARN_ON(!ctx) in __free_event() for partial init
xen: Change xen-acpi-processor dom0 dependency
nvme: requeue namespace scan on missed AENs
ACPI: EC: Set ec_no_wakeup for Lenovo Go S
ACPI PPTT: Fix coding mistakes in a couple of sizeof() calls
drm/amdgpu: Increase KIQ invalidate_tlbs timeout
drm/xe/xe3lpg: Apply Wa_14022293748, Wa_22019794406
nvme: re-read ANA log page after ns scan completes
nvme: multipath: fix return value of nvme_available_path
objtool: Stop UNRET validation on UD2
gpiolib: of: Move Atmel HSMCI quirk up out of the regulator comment
x86/xen: disable CPU idle and frequency drivers for PVH dom0
selftests/mincore: Allow read-ahead pages to reach the end of the file
x86/bugs: Use SBPB in write_ibpb() if applicable
x86/bugs: Don't fill RSB on VMEXIT with eIBRS+retpoline
x86/bugs: Don't fill RSB on context switch with eIBRS
nvmet-fc: take tgtport reference only once
nvmet-fc: put ref when assoc->del_work is already scheduled
cifs: Fix encoding of SMB1 Session Setup Kerberos Request in non-UNICODE mode
timekeeping: Add a lockdep override in tick_freeze()
cifs: Fix querying of WSL CHR and BLK reparse points over SMB1
iommu: Clear iommu-dma ops on cleanup
ext4: make block validity check resistent to sb bh corruption
scsi: hisi_sas: Fix I/O errors caused by hardware port ID changes
scsi: ufs: exynos: Ensure pre_link() executes before exynos_ufs_phy_init()
scsi: ufs: exynos: Enable PRDT pre-fetching with UFSHCD_CAP_CRYPTO
scsi: ufs: exynos: Move phy calls to .exit() callback
scsi: ufs: exynos: gs101: Put UFS device in reset on .suspend()
scsi: pm80xx: Set phy_attached to zero when device is gone
ASoC: fsl_asrc_dma: get codec or cpu dai from backend
x86/i8253: Call clockevent_i8253_disable() with interrupts disabled
netfs: Only create /proc/fs/netfs with CONFIG_PROC_FS
iomap: skip unnecessary ifs_block_is_uptodate check
riscv: Provide all alternative macros all the time
ksmbd: fix WARNING "do not call blocking ops when !TASK_RUNNING"
spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts
spi: tegra210-quad: add rate limiting and simplify timeout error message
ubsan: Fix panic from test_ubsan_out_of_bounds
x86/cpu: Add CPU model number for Bartlett Lake CPUs with Raptor Cove cores
md/raid1: Add check for missing source disk in process_checks()
drm/amdgpu: use a dummy owner for sysfs triggered cleaner shaders v4
drm/amdgpu: Use the right function for hdp flush
spi: spi-imx: Add check for spi_imx_setupxfer()
Revert "drivers: core: synchronize really_probe() and dev_uevent()"
driver core: introduce device_set_driver() helper
driver core: fix potential NULL pointer dereference in dev_uevent()
xfs: do not check NEEDSREPAIR if ro,norecovery mount.
xfs: Do not allow norecovery mount with quotacheck
xfs: rename xfs_iomap_swapfile_activate to xfs_vm_swap_activate
xfs: flush inodegc before swapon
selftests/bpf: fix bpf_map_redirect call for cpu map test
selftests/bpf: make xdp_cpumap_attach keep redirect prog attached
selftests/bpf: check program redirect in xdp_cpumap_attach
selftests/bpf: Adjust data size to have ETH_HLEN
usb: typec: class: Fix NULL pointer access
vmxnet3: Fix malformed packet sizing in vmxnet3_process_xdp
comedi: jr3_pci: Fix synchronous deletion of timer
ext4: goto right label 'out_mmap_sem' in ext4_setattr()
usb: typec: class: Invalidate USB device pointers on partner unregistration
Revert "net: dsa: mv88e6xxx: fix internal PHYs for 6320 family"
net: dsa: mv88e6xxx: fix atu_move_port_mask for 6341 family
net: dsa: mv88e6xxx: enable PVT for 6321 switch
net: dsa: mv88e6xxx: enable .port_set_policy() for 6320 family
net: dsa: mv88e6xxx: enable STU methods for 6320 family
iommu: Handle race with default domain setup
crypto: lib/Kconfig - Hide arch options from user
media: i2c: imx214: Fix uninitialized variable in imx214_set_ctrl()
MIPS: cm: Fix warning if MIPS_CM is disabled
nvme: fixup scan failure for non-ANA multipath controllers
usb: xhci: Fix Short Packet handling rework ignoring errors
objtool: Ignore end-of-section jumps for KCOV/GCOV
objtool: Silence more KCOV warnings, part 2
usb: typec: class: Unlocked on error in typec_register_partner()
crypto: Kconfig - Select LIB generic option
arm64: dts: ti: k3-j784s4-j742s2-main-common: Correct the GICD size
mq-deadline: don't call req_get_ioprio from the I/O completion handler
Linux 6.12.26
Change-Id: Iff5be8c388b8b915652fafb787156a4653f060aa
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
[ Upstream commit 23fa6a23d97182d36ca3c71e43c804fa91e46a03 ]
Older drivers and drivers with lower queue counts often have a static
array of queues, rather than allocating structs for each queue on demand.
Add a helper for adding up qstats from a queue range. Expectation is
that driver will pass a queue range [netdev->real_num_*x_queues, MAX).
It was tempting to always use num_*x_queues as the end, but virtio
seems to clamp its queue count after allocating the netdev. And this
way we can trivaly reuse the helper for [0, real_..).
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Link: https://patch.msgid.link/20250507003221.823267-2-kuba@kernel.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Stable-dep-of: 001160ec8c59 ("virtio-net: fix total qstat values")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Some vendors want to add things to 'struct nf_conn', so give them a u64
where they can then have a pointer off to their private data and they
can do whatever they want to do without breaking or changing any abi for
anyone else.
Note, usually an android trace hook is also needed to use this properly,
so be aware that this will be required as well.
Bug: 171013716
Change-Id: I245c162ee3fb083e3f39cf7bec3bd78cb624e005
Signed-off-by: Aditya Agrawal <aditya.a1@samsung.com>
(cherry picked from commit 56285b8656590c47079b1e8cfcbbe59a3b2f57a3)
Add the initial set of ABI padding fields in android16-6.12 based on what
is in the android15-6.6 branch.
Bug: 151154716
Change-Id: Icdb394863b2911389bfdced0fd1ea20236ca4ce1
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Add hardware offload configuration to XFRM_MSG_MIGRATE
using an option netlink attribute XFRMA_OFFLOAD_DEV.
In the existing xfrm_state_migrate(), the xfrm_init_state()
is called assuming no hardware offload by default. Even the
original xfrm_state is configured with offload, the setting will
be reset. If the device is configured with hardware offload,
it's reasonable to allow the device to maintain its hardware
offload mode. But the device will end up with offload disabled
after receiving a migration event when the device migrates the
connection from one netdev to another one.
The devices that support migration may work with different
underlying networks, such as mobile devices. The hardware setting
should be forwarded to the different netdev based on the
migration configuration. This change provides the capability
for user space to migrate from one netdev to another.
Test: Tested with kernel test in the Android tree located
in https://android.googlesource.com/kernel/tests/
The xfrm_tunnel_test.py under the tests folder in
particular.
Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Bug: 397317276
Change-Id: Ic684084f174ff13bd710e557c75fba7e45c060e9
Link: https://lore.kernel.org/netdev/20250313023641.1007052-2-chiachangwang@google.com/
Signed-off-by: Chiachang Wang <chiachangwang@google.com>
GKI (arm64) relevant 98 out of 394 changes, affecting 131 files +1443/-762
40bc55e4fc cgroup/cpuset: Fix incorrect isolated_cpus update in update_parent_effective_cpumask() [1 file, +3/-3]
9701dcbf5f cgroup/cpuset: Fix error handling in remote_partition_disable() [1 file, +20/-9]
2dbd1b1660 cgroup/cpuset: Revert "Allow suppression of sched domain rebuild in update_cpumasks_hier()" [1 file, +14/-25]
6b145f8b22 cgroup/cpuset: Enforce at most one rebuild_sched_domains_locked() call per operation [1 file, +33/-16]
1b06f00eda cgroup/cpuset: Further optimize code if CONFIG_CPUSETS_V1 not set [1 file, +19/-20]
cdb6e724e7 cgroup/cpuset: Fix race between newly created partition and dying one [4 files, +25/-4]
179ef2f810 gpiolib: of: Fix the choice for Ingenic NAND quirk [1 file, +2/-0]
cb8372e54f ublk: refactor recovery configuration flag helpers [1 file, +42/-20]
caa5c8a235 ublk: fix handling recovery & reissue in ublk_abort_queue() [1 file, +26/-4]
7c5957f790 tipc: fix memory leak in tipc_link_xmit [1 file, +1/-0]
4d55144b12 codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() [2 files, +3/-8]
b2f3c3d57a tc: Ensure we have enough buffer space when sending filter netlink notifications [1 file, +45/-21]
a065b99605 net: ethtool: Don't call .cleanup_data when prepare_data fails [1 file, +5/-3]
70449ca406 net_sched: sch_sfq: use a temporary work area for validating configuration [1 file, +44/-12]
f86293adce net_sched: sch_sfq: move the limit validation [1 file, +6/-4]
6d98cd6342 net: phy: move phy_link_change() prior to mdio_bus_phy_may_suspend() [1 file, +13/-13]
a6ed6f8ec8 net: phy: allow MDIO bus PM ops to start/stop state machine for phylink-controlled PHY [1 file, +29/-2]
cc16f7402a ipv6: Align behavior across nexthops during path selection [1 file, +4/-4]
c61feda373 perf/core: Add aux_pause, aux_resume, aux_start_paused [4 files, +110/-5]
7ef5aa081f perf/core: Simplify the perf_event_alloc() error path [2 files, +78/-76]
fa1827fa96 perf: Fix hang while freeing sigtrap event [2 files, +18/-47]
52535688c2 fs: consistently deref the files table with rcu_dereference_raw() [1 file, +17/-9]
67e85cfa95 umount: Allow superblock owners to force umount [1 file, +2/-1]
1b3ebfb15d perf: arm_pmu: Don't disable counter in armpmu_add() [1 file, +3/-5]
11ae4fec1f PM: hibernate: Avoid deadlock in hibernate_compressor_param_set() [1 file, +3/-3]
ead1fc9f93 Flush console log from kernel_power_off() [3 files, +8/-3]
cb58e90920 arm64: cputype: Add QCOM_CPU_PART_KRYO_3XX_GOLD [1 file, +2/-0]
3c057a4904 media: uvcvideo: Add quirk for Actions UVC05 [1 file, +9/-0]
cb1c6cb110 ALSA: usb-audio: Fix CME quirk for UF series keyboards [1 file, +74/-6]
a6bf0fd322 net: page_pool: don't cast mp param to devmem [1 file, +1/-1]
c6e50cb8bf f2fs: don't retry IO for corrupted data scenario [1 file, +4/-0]
de94d0ca9e net: usb: asix_devices: add FiberGecko DeviceID [1 file, +17/-0]
7204335d19 page_pool: avoid infinite loop to schedule delayed worker [1 file, +7/-1]
ecc4613316 f2fs: fix to avoid out-of-bounds access in f2fs_truncate_inode_blocks() [1 file, +8/-1]
5f815757e6 ext4: protect ext4_release_dquot against freezing [1 file, +17/-0]
aa39d45071 Revert "f2fs: rebuild nat_bits during umount" [3 files, +59/-95]
eb59cc31b6 ext4: ignore xattrs past end [1 file, +10/-1]
a8a8076210 cdc_ether|r8152: ThinkPad Hybrid USB-C/A Dock quirk [3 files, +19/-0]
299d7d27af net: vlan: don't propagate flags on open [1 file, +4/-27]
40c70ff44b tracing: fix return value in __ftrace_event_enable_disable for TRACE_REG_UNREGISTER [1 file, +3/-1]
6b7a32fa9b Bluetooth: hci_uart: fix race during initialization [1 file, +2/-1]
fe6f1f349d Bluetooth: hci_qca: use the power sequencer for wcn6750 [1 file, +1/-1]
feed98579d Bluetooth: qca: simplify WCN399x NVM loading [1 file, +6/-7]
035e1bffc0 Bluetooth: Add quirk for broken READ_VOICE_SETTING [3 files, +15/-0]
09246dfb5c Bluetooth: Add quirk for broken READ_PAGE_SCAN_TYPE [2 files, +10/-1]
044c1b3528 drm: allow encoder mode_set even when connectors change for crtc [1 file, +1/-1]
df33b535f0 drm: panel-orientation-quirks: Add support for AYANEO 2S [1 file, +2/-2]
6fe4ed94ee drm: panel-orientation-quirks: Add quirks for AYA NEO Flip DS and KB [1 file, +18/-0]
5dd6fdb889 drm: panel-orientation-quirks: Add quirk for AYA NEO Slide [1 file, +6/-0]
a64e097426 drm: panel-orientation-quirks: Add new quirk for GPD Win 2 [1 file, +6/-0]
ba5a998f84 drm: panel-orientation-quirks: Add quirk for OneXPlayer Mini (Intel) [1 file, +12/-0]
f04612890c drm/debugfs: fix printk format for bridge index [1 file, +1/-1]
b22cb42a5e drm/bridge: panel: forbid initializing a panel with unknown connector type [1 file, +4/-1]
1c38108a49 drivers: base: devres: Allow to release group on device release [1 file, +7/-0]
8feefd106a PCI: Enable Configuration RRS SV early [1 file, +5/-3]
73d2b96250 PCI: Check BAR index for validity [4 files, +57/-10]
9a6be23eb0 tracing: probe-events: Add comments about entry data storing code [1 file, +28/-0]
7b9bdd7059 erofs: set error to bio if file-backed IO fails [1 file, +2/-0]
806908d5d9 bpf: support SKF_NET_OFF and SKF_LL_OFF on skb frags [1 file, +44/-36]
dd3edffae8 ext4: don't treat fhandle lookup of ea_inode as FS corruption [1 file, +48/-20]
2ff58c5b26 arm64: cputype: Add MIDR_CORTEX_A76AE [1 file, +2/-0]
4af2858435 arm64: errata: Add QCOM_KRYO_4XX_GOLD to the spectre_bhb_k24_list [1 file, +1/-0]
3b0f2526c8 arm64: errata: Assume that unknown CPUs _are_ vulnerable to Spectre BHB [2 files, +102/-102]
20c105f587 arm64: errata: Add KRYO 2XX/3XX/4XX silver cores to Spectre BHB safe list [1 file, +3/-0]
c322789613 KVM: arm64: Tear down vGIC on failed vCPU creation [1 file, +5/-1]
baea1762cd media: v4l2-dv-timings: prevent possible overflow in v4l2_detect_gtf() [1 file, +2/-2]
0828d6e9ad io_uring/net: fix accept multishot handling [1 file, +2/-0]
b7c6d081c1 io_uring/net: fix io_req_post_cqe abuse by send bundle [3 files, +6/-2]
3e0356857e io_uring/kbuf: reject zero sized provided buffers [1 file, +2/-0]
16d9067f00 ext4: fix off-by-one error in do_split [1 file, +1/-1]
a1dde7457d f2fs: fix to avoid atomicity corruption of atomic file [2 files, +5/-3]
e6bba32857 i3c: Add NULL pointer check in i3c_master_queue_ibi() [1 file, +3/-0]
9eaec071f1 jbd2: remove wrong sb->s_sequence check [1 file, +0/-1]
eec737e17e arm64: mops: Do not dereference src reg for a set operation [1 file, +2/-2]
1dd288783d arm64: mm: Correct the update of max_pfn [1 file, +2/-1]
5f7f6abd92 net: Fix null-ptr-deref by sock_lock_init_class_and_name() and rmmod. [2 files, +43/-2]
53dc6b00c0 mm/rmap: reject hugetlb folios in folio_make_device_exclusive() [1 file, +1/-1]
83b6b5061e mm: make page_mapped_in_vma() hugetlb walk aware [1 file, +9/-4]
6dd8d9440f mm: fix lazy mmu docs and usage [1 file, +8/-6]
2532df0a9b mm/mremap: correctly handle partial mremap() of VMA starting at 0 [1 file, +5/-5]
cc98577f91 mm: add missing release barrier on PGDAT_RECLAIM_LOCKED unlock [1 file, +1/-1]
14936034de mm/userfaultfd: fix release hang over concurrent GUP [1 file, +25/-26]
65b259e3e0 mm/hwpoison: introduce folio_contain_hwpoisoned_page() helper [3 files, +8/-4]
9e7c37fadb sctp: detect and prevent references to a freed transport in sendmsg [3 files, +18/-9]
474b3194c8 tracing: Do not add length to print format in synthetic events [1 file, +0/-1]
74f01c2ca8 dm-verity: fix prefetch-vs-suspend race [1 file, +8/-0]
fae0a8796c KVM: Allow building irqbypass.ko as as module when kvm.ko is a module [3 files, +7/-7]
dc83eccc93 of/irq: Fix device node refcount leakage in API of_irq_parse_one() [1 file, +27/-32]
3540164c75 of/irq: Fix device node refcount leakage in API of_irq_parse_raw() [1 file, +8/-0]
29cb94963c of/irq: Fix device node refcount leakages in of_irq_count() [1 file, +3/-1]
d0f25a9977 of/irq: Fix device node refcount leakage in API irq_of_parse_and_map() [1 file, +5/-1]
712d84459a of/irq: Fix device node refcount leakages in of_irq_init() [1 file, +3/-0]
d69ad6e1a5 PCI: Fix reference leak in pci_alloc_child_bus() [1 file, +4/-1]
9707d0c932 PCI: Fix reference leak in pci_register_host_bridge() [1 file, +7/-2]
869202291a PCI: Fix wrong length of devres array [1 file, +1/-1]
92ca7270fe ring-buffer: Use flush_kernel_vmap_range() over flush_dcache_folio() [1 file, +3/-2]
9ca4fe3574 arm64: errata: Add newer ARM cores to the spectre_bhb_loop_affected() lists [1 file, +14/-1]
281782d2c6 Bluetooth: hci_uart: Fix another race during initialization [2 files, +15/-6]
Changes in 6.12.24
ASoC: Intel: adl: add 2xrt1316 audio configuration
cgroup/cpuset: Fix incorrect isolated_cpus update in update_parent_effective_cpumask()
cgroup/cpuset: Fix error handling in remote_partition_disable()
cgroup/cpuset: Revert "Allow suppression of sched domain rebuild in update_cpumasks_hier()"
cgroup/cpuset: Enforce at most one rebuild_sched_domains_locked() call per operation
cgroup/cpuset: Further optimize code if CONFIG_CPUSETS_V1 not set
cgroup/cpuset: Fix race between newly created partition and dying one
gpiolib: of: Fix the choice for Ingenic NAND quirk
selftests/futex: futex_waitv wouldblock test should fail
ublk: refactor recovery configuration flag helpers
ublk: fix handling recovery & reissue in ublk_abort_queue()
drm/i915: Disable RPG during live selftest
x86/acpi: Don't limit CPUs to 1 for Xen PV guests due to disabled ACPI
drm/xe/hw_engine: define sysfs_ops on all directories
ata: pata_pxa: Fix potential NULL pointer dereference in pxa_ata_probe()
objtool: Fix INSN_CONTEXT_SWITCH handling in validate_unret()
tipc: fix memory leak in tipc_link_xmit
codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()
net: tls: explicitly disallow disconnect
octeontx2-pf: qos: fix VF root node parent queue index
tc: Ensure we have enough buffer space when sending filter netlink notifications
net: ethtool: Don't call .cleanup_data when prepare_data fails
drm/tests: modeset: Fix drm_display_mode memory leak
drm/tests: helpers: Create kunit helper to destroy a drm_display_mode
drm/tests: cmdline: Fix drm_display_mode memory leak
drm/tests: modes: Fix drm_display_mode memory leak
drm/tests: probe-helper: Fix drm_display_mode memory leak
net: libwx: handle page_pool_dev_alloc_pages error
ata: sata_sx4: Add error handling in pdc20621_i2c_read()
drm/i915/huc: Fix fence not released on early probe errors
nvmet-fcloop: swap list_add_tail arguments
net_sched: sch_sfq: use a temporary work area for validating configuration
net_sched: sch_sfq: move the limit validation
smb: client: fix UAF in decryption with multichannel
net: phy: move phy_link_change() prior to mdio_bus_phy_may_suspend()
net: phy: allow MDIO bus PM ops to start/stop state machine for phylink-controlled PHY
ipv6: Align behavior across nexthops during path selection
net: ppp: Add bound checking for skb data on ppp_sync_txmung
nft_set_pipapo: fix incorrect avx2 match of 5th field octet
iommu/exynos: Fix suspend/resume with IDENTITY domain
iommu/mediatek: Fix NULL pointer deference in mtk_iommu_device_group
perf/core: Add aux_pause, aux_resume, aux_start_paused
perf/core: Simplify the perf_event_alloc() error path
perf: Fix hang while freeing sigtrap event
fs: consistently deref the files table with rcu_dereference_raw()
umount: Allow superblock owners to force umount
pm: cpupower: bench: Prevent NULL dereference on malloc failure
x86/mm: Clear _PAGE_DIRTY for kernel mappings when we clear _PAGE_RW
x86/percpu: Disable named address spaces for UBSAN_BOOL with KASAN for GCC < 14.2
x86/ia32: Leave NULL selector values 0~3 unchanged
x86/cpu: Don't clear X86_FEATURE_LAHF_LM flag in init_amd_k8() on AMD when running in a virtual machine
perf: arm_pmu: Don't disable counter in armpmu_add()
perf/dwc_pcie: fix some unreleased resources
PM: hibernate: Avoid deadlock in hibernate_compressor_param_set()
Flush console log from kernel_power_off()
arm64: cputype: Add QCOM_CPU_PART_KRYO_3XX_GOLD
xen/mcelog: Add __nonstring annotations for unterminated strings
zstd: Increase DYNAMIC_BMI2 GCC version cutoff from 4.8 to 11.0 to work around compiler segfault
platform/chrome: cros_ec_lpc: Match on Framework ACPI device
ASoC: SOF: topology: Use krealloc_array() to replace krealloc()
HID: pidff: Convert infinite length from Linux API to PID standard
HID: pidff: Do not send effect envelope if it's empty
HID: pidff: Add MISSING_DELAY quirk and its detection
HID: pidff: Add MISSING_PBO quirk and its detection
HID: pidff: Add PERMISSIVE_CONTROL quirk
HID: pidff: Add hid_pidff_init_with_quirks and export as GPL symbol
HID: pidff: Add FIX_WHEEL_DIRECTION quirk
HID: Add hid-universal-pidff driver and supported device ids
HID: pidff: Add PERIODIC_SINE_ONLY quirk
HID: pidff: Fix null pointer dereference in pidff_find_fields
ASoC: amd: ps: use macro for ACP6.3 pci revision id
ALSA: hda: intel: Fix Optimus when GPU has no sound
ALSA: hda: intel: Add Lenovo IdeaPad Z570 to probe denylist
ASoC: fsl_audmix: register card device depends on 'dais' property
media: uvcvideo: Add quirk for Actions UVC05
media: s5p-mfc: Corrected NV12M/NV21M plane-sizes
mmc: dw_mmc: add a quirk for accessing 64-bit FIFOs in two halves
ALSA: usb-audio: Fix CME quirk for UF series keyboards
ASoC: amd: Add DMI quirk for ACP6X mic support
ASoC: amd: yc: update quirk data for new Lenovo model
platform/x86: x86-android-tablets: Add select POWER_SUPPLY to Kconfig
wifi: ath11k: Fix DMA buffer allocation to resolve SWIOTLB issues
wifi: ath11k: fix memory leak in ath11k_xxx_remove()
wifi: ath12k: fix memory leak in ath12k_pci_remove()
wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process
ata: libata-core: Add 'external' to the libata.force kernel parameter
scsi: mpi3mr: Avoid reply queue full condition
scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue
net: page_pool: don't cast mp param to devmem
f2fs: don't retry IO for corrupted data scenario
wifi: mac80211: add strict mode disabling workarounds
wifi: mac80211: ensure sdata->work is canceled before initialized.
scsi: target: spc: Fix RSOC parameter data header size
net: usb: asix_devices: add FiberGecko DeviceID
page_pool: avoid infinite loop to schedule delayed worker
can: flexcan: Add quirk to handle separate interrupt lines for mailboxes
can: flexcan: add NXP S32G2/S32G3 SoC support
jfs: Fix uninit-value access of imap allocated in the diMount() function
fs/jfs: cast inactags to s64 to prevent potential overflow
fs/jfs: Prevent integer overflow in AG size calculation
jfs: Prevent copying of nlink with value 0 from disk inode
jfs: add sanity check for agwidth in dbMount
ata: libata-eh: Do not use ATAPI DMA for a device limited to PIO mode
net: sfp: add quirk for 2.5G OEM BX SFP
wifi: ath12k: Fix invalid data access in ath12k_dp_rx_h_undecap_nwifi
f2fs: fix to avoid out-of-bounds access in f2fs_truncate_inode_blocks()
net: sfp: add quirk for FS SFP-10GM-T copper SFP+ module
ahci: add PCI ID for Marvell 88SE9215 SATA Controller
ext4: protect ext4_release_dquot against freezing
Revert "f2fs: rebuild nat_bits during umount"
ext4: ignore xattrs past end
cdc_ether|r8152: ThinkPad Hybrid USB-C/A Dock quirk
scsi: st: Fix array overflow in st_setup()
ahci: Marvell 88SE9215 controllers prefer DMA for ATAPI
btrfs: harden block_group::bg_list against list_del() races
wifi: mt76: mt76x2u: add TP-Link TL-WDN6200 ID to device table
net: vlan: don't propagate flags on open
tracing: fix return value in __ftrace_event_enable_disable for TRACE_REG_UNREGISTER
Bluetooth: btintel_pcie: Add device id of Whale Peak
Bluetooth: hci_uart: fix race during initialization
Bluetooth: btusb: Add 2 HWIDs for MT7922
Bluetooth: hci_qca: use the power sequencer for wcn6750
Bluetooth: qca: simplify WCN399x NVM loading
Bluetooth: Add quirk for broken READ_VOICE_SETTING
Bluetooth: Add quirk for broken READ_PAGE_SCAN_TYPE
drm: allow encoder mode_set even when connectors change for crtc
drm/xe/bmg: Add new PCI IDs
drm/xe/vf: Don't try to trigger a full GT reset if VF
drm/amd/display: Update Cursor request mode to the beginning prefetch always
drm/amdgpu: Unlocked unmap only clear page table leaves
drm: panel-orientation-quirks: Add support for AYANEO 2S
drm: panel-orientation-quirks: Add quirks for AYA NEO Flip DS and KB
drm: panel-orientation-quirks: Add quirk for AYA NEO Slide
drm: panel-orientation-quirks: Add new quirk for GPD Win 2
drm: panel-orientation-quirks: Add quirk for OneXPlayer Mini (Intel)
drm/debugfs: fix printk format for bridge index
drm/bridge: panel: forbid initializing a panel with unknown connector type
drm/amd/display: stop DML2 from removing pipes based on planes
drivers: base: devres: Allow to release group on device release
drm/amdkfd: clamp queue size to minimum
drm/amdkfd: Fix mode1 reset crash issue
drm/amdkfd: Fix pqm_destroy_queue race with GPU reset
drm/amdkfd: debugfs hang_hws skip GPU with MES
drm/xe/xelp: Move Wa_16011163337 from tunings to workarounds
drm/mediatek: mtk_dpi: Move the input_2p_en bit to platform data
drm/mediatek: mtk_dpi: Explicitly manage TVD clock in power on/off
PCI: Add Rockchip Vendor ID
drm/amdgpu: handle amdgpu_cgs_create_device() errors in amd_powerplay_create()
PCI: Enable Configuration RRS SV early
drm/amdgpu: Fix the race condition for draining retry fault
PCI: Check BAR index for validity
PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type
drm/amdgpu: grab an additional reference on the gang fence v2
fbdev: omapfb: Add 'plane' value check
tracing: probe-events: Add comments about entry data storing code
ktest: Fix Test Failures Due to Missing LOG_FILE Directories
tpm, tpm_tis: Workaround failed command reception on Infineon devices
tpm: End any active auth session before shutdown
pwm: mediatek: Prevent divide-by-zero in pwm_mediatek_config()
pwm: rcar: Improve register calculation
pwm: fsl-ftm: Handle clk_get_rate() returning 0
erofs: set error to bio if file-backed IO fails
bpf: support SKF_NET_OFF and SKF_LL_OFF on skb frags
ext4: don't treat fhandle lookup of ea_inode as FS corruption
s390/pci: Fix s390_mmio_read/write syscall page fault handling
HID: pidff: Clamp PERIODIC effect period to device's logical range
HID: pidff: Stop all effects before enabling actuators
HID: pidff: Completely rework and fix pidff_reset function
HID: pidff: Simplify pidff_upload_effect function
HID: pidff: Define values used in pidff_find_special_fields
HID: pidff: Rescale time values to match field units
HID: pidff: Factor out code for setting gain
HID: pidff: Move all hid-pidff definitions to a dedicated header
HID: pidff: Simplify pidff_rescale_signed
HID: pidff: Use macros instead of hardcoded min/max values for shorts
HID: pidff: Factor out pool report fetch and remove excess declaration
HID: pidff: Make sure to fetch pool before checking SIMULTANEOUS_MAX
HID: hid-universal-pidff: Add Asetek wheelbases support
HID: pidff: Comment and code style update
HID: pidff: Support device error response from PID_BLOCK_LOAD
HID: pidff: Remove redundant call to pidff_find_special_keys
HID: pidff: Rename two functions to align them with naming convention
HID: pidff: Clamp effect playback LOOP_COUNT value
HID: pidff: Compute INFINITE value instead of using hardcoded 0xffff
HID: pidff: Fix 90 degrees direction name North -> East
HID: pidff: Fix set_device_control()
auxdisplay: hd44780: Fix an API misuse in hd44780.c
dt-bindings: media: st,stmipid02: correct lane-polarities maxItems
media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization
media: mtk-vcodec: venc: avoid -Wenum-compare-conditional warning
media: uapi: rkisp1-config: Fix typo in extensible params example
media: mgb4: Fix CMT registers update logic
media: i2c: adv748x: Fix test pattern selection mask
media: mgb4: Fix switched CMT frequency range "magic values" sets
media: intel/ipu6: set the dev_parent of video device to pdev
media: venus: hfi: add a check to handle OOB in sfr region
media: venus: hfi: add check to handle incorrect queue size
media: vim2m: print device name after registering device
media: siano: Fix error handling in smsdvb_module_init()
media: rockchip: rga: fix rga offset lookup
xenfs/xensyms: respect hypervisor's "next" indication
arm64: cputype: Add MIDR_CORTEX_A76AE
arm64: errata: Add QCOM_KRYO_4XX_GOLD to the spectre_bhb_k24_list
arm64: errata: Assume that unknown CPUs _are_ vulnerable to Spectre BHB
arm64: errata: Add KRYO 2XX/3XX/4XX silver cores to Spectre BHB safe list
KVM: arm64: Tear down vGIC on failed vCPU creation
spi: cadence-qspi: Fix probe on AM62A LP SK
mtd: rawnand: brcmnand: fix PM resume warning
tpm, tpm_tis: Fix timeout handling when waiting for TPM status
accel/ivpu: Fix PM related deadlocks in MS IOCTLs
media: streamzap: prevent processing IR data on URB failure
media: hi556: Fix memory leak (on error) in hi556_check_hwcfg()
media: visl: Fix ERANGE error when setting enum controls
media: platform: stm32: Add check for clk_enable()
media: imx219: Adjust PLL settings based on the number of MIPI lanes
media: v4l2-dv-timings: prevent possible overflow in v4l2_detect_gtf()
Revert "media: imx214: Fix the error handling in imx214_probe()"
media: i2c: ccs: Set the device's runtime PM status correctly in remove
media: i2c: ccs: Set the device's runtime PM status correctly in probe
media: i2c: ov7251: Set enable GPIO low in probe
media: i2c: ov7251: Introduce 1 ms delay between regulators and en GPIO
media: nuvoton: Fix reference handling of ece_node
media: nuvoton: Fix reference handling of ece_pdev
media: venus: hfi_parser: add check to avoid out of bound access
media: venus: hfi_parser: refactor hfi packet parsing logic
media: i2c: imx319: Rectify runtime PM handling probe and remove
media: i2c: imx219: Rectify runtime PM handling in probe and remove
media: i2c: imx214: Rectify probe error handling related to runtime PM
media: chips-media: wave5: Fix gray color on screen
media: chips-media: wave5: Avoid race condition in the interrupt handler
media: chips-media: wave5: Fix a hang after seeking
media: chips-media: wave5: Fix timeout while testing 10bit hevc fluster
mptcp: sockopt: fix getting IPV6_V6ONLY
mptcp: sockopt: fix getting freebind & transparent
mtd: Add check for devm_kcalloc()
net: dsa: mv88e6xxx: workaround RGMII transmit delay erratum for 6320 family
net: dsa: mv88e6xxx: fix internal PHYs for 6320 family
mtd: Replace kcalloc() with devm_kcalloc()
clocksource/drivers/stm32-lptimer: Use wakeup capable instead of init wakeup
wifi: mt76: Add check for devm_kstrdup()
wifi: mac80211: fix integer overflow in hwmp_route_info_get()
wifi: mt76: mt7925: ensure wow pattern command align fw format
wifi: mt76: mt7925: fix country count limitation for CLC
wifi: mt76: mt7925: fix the wrong link_idx when a p2p_device is present
wifi: mt76: mt7925: fix the wrong simultaneous cap for MLO
io_uring/net: fix accept multishot handling
io_uring/net: fix io_req_post_cqe abuse by send bundle
io_uring/kbuf: reject zero sized provided buffers
ASoC: codecs: wcd937x: fix a potential memory leak in wcd937x_soc_codec_probe()
ASoC: q6apm: add q6apm_get_hw_pointer helper
ASoC: q6apm-dai: schedule all available frames to avoid dsp under-runs
ASoC: q6apm-dai: make use of q6apm_get_hw_pointer
ASoC: qdsp6: q6apm-dai: set 10 ms period and buffer alignment.
ASoC: qdsp6: q6apm-dai: fix capture pipeline overruns.
ASoC: qdsp6: q6asm-dai: fix q6asm_dai_compr_set_params error path
ALSA: hda/realtek: Enable Mute LED on HP OMEN 16 Laptop xd000xx
accel/ivpu: Fix warning in ivpu_ipc_send_receive_internal()
accel/ivpu: Fix deadlock in ivpu_ms_cleanup()
bus: mhi: host: Fix race between unprepare and queue_buf
ext4: fix off-by-one error in do_split
f2fs: fix to avoid atomicity corruption of atomic file
vdpa/mlx5: Fix oversized null mkey longer than 32bit
udf: Fix inode_getblk() return value
tpm: do not start chip while suspended
svcrdma: do not unregister device for listeners
soc: samsung: exynos-chipid: Add NULL pointer check in exynos_chipid_probe()
smb311 client: fix missing tcon check when mounting with linux/posix extensions
ima: limit the number of open-writers integrity violations
ima: limit the number of ToMToU integrity violations
i3c: master: svc: Use readsb helper for reading MDB
i3c: Add NULL pointer check in i3c_master_queue_ibi()
jbd2: remove wrong sb->s_sequence check
kbuild: exclude .rodata.(cst|str)* when building ranges
leds: rgb: leds-qcom-lpg: Fix pwm resolution max for Hi-Res PWMs
leds: rgb: leds-qcom-lpg: Fix calculation of best period Hi-Res PWMs
mfd: ene-kb3930: Fix a potential NULL pointer dereference
mailbox: tegra-hsp: Define dimensioning masks in SoC data
locking/lockdep: Decrease nr_unused_locks if lock unused in zap_class()
lib: scatterlist: fix sg_split_phys to preserve original scatterlist offsets
mptcp: fix NULL pointer in can_accept_new_subflow
mptcp: only inc MPJoinAckHMacFailure for HMAC failures
mtd: inftlcore: Add error check for inftl_read_oob()
mtd: rawnand: Add status chack in r852_ready()
arm64: mops: Do not dereference src reg for a set operation
arm64: tegra: Remove the Orin NX/Nano suspend key
arm64: mm: Correct the update of max_pfn
arm64: dts: mediatek: mt8173: Fix disp-pwm compatible string
arm64: dts: exynos: gs101: disable pinctrl_gsacore node
backlight: led_bl: Hold led_access lock when calling led_sysfs_disable()
btrfs: fix non-empty delayed iputs list on unmount due to compressed write workers
btrfs: tests: fix chunk map leak after failure to add it to the tree
btrfs: zoned: fix zone activation with missing devices
btrfs: zoned: fix zone finishing with missing devices
iommufd: Fix uninitialized rc in iommufd_access_rw()
iommu/tegra241-cmdqv: Fix warnings due to dmam_free_coherent()
iommu/vt-d: Put IRTE back into posted MSI mode if vCPU posting is disabled
iommu/vt-d: Don't clobber posted vCPU IRTE when host IRQ affinity changes
iommu/vt-d: Fix possible circular locking dependency
iommu/vt-d: Wire up irq_ack() to irq_move_irq() for posted MSIs
sparc/mm: disable preemption in lazy mmu mode
sparc/mm: avoid calling arch_enter/leave_lazy_mmu() in set_ptes
net: Fix null-ptr-deref by sock_lock_init_class_and_name() and rmmod.
mm/damon/ops: have damon_get_folio return folio even for tail pages
mm/rmap: reject hugetlb folios in folio_make_device_exclusive()
mm: make page_mapped_in_vma() hugetlb walk aware
mm: fix lazy mmu docs and usage
mm/mremap: correctly handle partial mremap() of VMA starting at 0
mm: add missing release barrier on PGDAT_RECLAIM_LOCKED unlock
mm/userfaultfd: fix release hang over concurrent GUP
mm/hwpoison: do not send SIGBUS to processes with recovered clean pages
mm/hugetlb: move hugetlb_sysctl_init() to the __init section
mm/hwpoison: introduce folio_contain_hwpoisoned_page() helper
sctp: detect and prevent references to a freed transport in sendmsg
x86/xen: fix balloon target initialization for PVH dom0
tracing: fprobe events: Fix possible UAF on modules
tracing: Do not add length to print format in synthetic events
thermal/drivers/rockchip: Add missing rk3328 mapping entry
CIFS: Propagate min offload along with other parameters from primary to secondary channels.
cifs: avoid NULL pointer dereference in dbg call
cifs: fix integer overflow in match_server()
cifs: Ensure that all non-client-specific reparse points are processed by the server
clk: renesas: r9a07g043: Fix HP clock source for RZ/Five
clk: qcom: clk-branch: Fix invert halt status bit check for votable clocks
clk: qcom: gdsc: Release pm subdomains in reverse add order
clk: qcom: gdsc: Capture pm_genpd_add_subdomain result code
clk: qcom: gdsc: Set retain_ff before moving to HW CTRL
crypto: ccp - Fix check for the primary ASP device
crypto: ccp - Fix uAPI definitions of PSP errors
dlm: fix error if inactive rsb is not hashed
dlm: fix error if active rsb is not hashed
dm-ebs: fix prefetch-vs-suspend race
dm-integrity: set ti->error on memory allocation failure
dm-integrity: fix non-constant-time tag verification
dm-verity: fix prefetch-vs-suspend race
dt-bindings: coresight: qcom,coresight-tpda: Fix too many 'reg'
dt-bindings: coresight: qcom,coresight-tpdm: Fix too many 'reg'
ftrace: Add cond_resched() to ftrace_graph_set_hash()
ftrace: Properly merge notrace hashes
gpio: tegra186: fix resource handling in ACPI probe path
gpio: zynq: Fix wakeup source leaks on device unbind
gve: handle overflow when reporting TX consumed descriptors
KVM: Allow building irqbypass.ko as as module when kvm.ko is a module
KVM: PPC: Enable CAP_SPAPR_TCE_VFIO on pSeries KVM guests
KVM: x86: Explicitly zero-initialize on-stack CPUID unions
KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses
landlock: Move code to ease future backports
landlock: Add the errata interface
landlock: Add erratum for TCP fix
landlock: Always allow signals between threads of the same process
landlock: Prepare to add second errata
selftests/landlock: Split signal_scoping_threads tests
selftests/landlock: Add a new test for setuid()
misc: pci_endpoint_test: Fix displaying 'irq_type' after 'request_irq' error
net: mana: Switch to page pool for jumbo frames
ntb: use 64-bit arithmetic for the MSI doorbell mask
of/irq: Fix device node refcount leakage in API of_irq_parse_one()
of/irq: Fix device node refcount leakage in API of_irq_parse_raw()
of/irq: Fix device node refcount leakages in of_irq_count()
of/irq: Fix device node refcount leakage in API irq_of_parse_and_map()
of/irq: Fix device node refcount leakages in of_irq_init()
PCI: brcmstb: Fix missing of_node_put() in brcm_pcie_probe()
PCI: j721e: Fix the value of .linkdown_irq_regfield for J784S4
PCI: pciehp: Avoid unnecessary device replacement check
PCI: Fix reference leak in pci_alloc_child_bus()
PCI: Fix reference leak in pci_register_host_bridge()
PCI: Fix wrong length of devres array
phy: freescale: imx8m-pcie: assert phy reset and perst in power off
pinctrl: qcom: Clear latched interrupt status when changing IRQ type
pinctrl: samsung: add support for eint_fltcon_offset
ring-buffer: Use flush_kernel_vmap_range() over flush_dcache_folio()
s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs
s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues
s390: Fix linker error when -no-pie option is unavailable
sched_ext: create_dsq: Return -EEXIST on duplicate request
selftests: mptcp: close fd_in before returning in main_loop
selftests: mptcp: fix incorrect fd checks in main_loop
thermal/drivers/mediatek/lvts: Disable monitor mode during suspend
thermal/drivers/mediatek/lvts: Disable Stage 3 thermal threshold
arm64: errata: Add newer ARM cores to the spectre_bhb_loop_affected() lists
iommufd: Make attach_handle generic than fault specific
iommufd: Fail replace if device has not been attached
x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT
ACPI: platform-profile: Fix CFI violation when accessing sysfs files
NFSD: fix decoding in nfs4_xdr_dec_cb_getattr
NFSD: Fix CB_GETATTR status fix
nfsd: don't ignore the return code of svc_proc_register()
x86/e820: Fix handling of subpage regions when calculating nosave ranges in e820__register_nosave_regions()
libbpf: Prevent compiler warnings/errors
kbuild: Add '-fno-builtin-wcslen'
media: mediatek: vcodec: mark vdec_vp9_slice_map_counts_eob_coef noinline
Bluetooth: hci_uart: Fix another race during initialization
s390/cpumf: Fix double free on error in cpumf_pmu_event_init()
HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition
Linux 6.12.24
Change-Id: I272e8aac67399f2eb57ca25e05cded24172d2d76
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Steps on the way to 6.12.24
Resolves merge conflicts in:
include/net/sock.h
Change-Id: Iad709683ab2604d124bedc3902f48588b28253bb
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
[ Upstream commit 024421cf39923927ab2b5fe895d1d922b9abe67f ]
BIG Create Sync requires the command to just generates a status so this
makes use of __hci_cmd_sync_status_sk to wait for
HCI_EVT_LE_BIG_SYNC_ESTABLISHED, also because of this chance it is not
longer necessary to use a custom method to serialize the process of
creating the BIG sync since the cmd_work_sync itself ensures only one
command would be pending which now awaits for
HCI_EVT_LE_BIG_SYNC_ESTABLISHED before proceeding to next connection.
Fixes: 42ecf1947135 ("Bluetooth: ISO: Do not emit LE BIG Create Sync if previous is pending")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 6d0417e4e1cf66fd917f06f0454958362714ef7d ]
Broadcast Receiver requires creating PA sync but the command just
generates a status so this makes use of __hci_cmd_sync_status_sk to wait
for HCI_EV_LE_PA_SYNC_ESTABLISHED, also because of this chance it is not
longer necessary to use a custom method to serialize the process of
creating the PA sync since the cmd_work_sync itself ensures only one
command would be pending which now awaits for
HCI_EV_LE_PA_SYNC_ESTABLISHED before proceeding to next connection.
Fixes: 4a5e0ba68676 ("Bluetooth: ISO: Do not emit LE PA Create Sync if previous is pending")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit a1356ac7749cafc4e27aa62c0c4604b5dca4983e ]
Move rx_lock from xsk_socket to xsk_buff_pool.
Fix synchronization for shared umem mode in
generic RX path where multiple sockets share
single xsk_buff_pool.
RX queue is exclusive to xsk_socket, while FILL
queue can be shared between multiple sockets.
This could result in race condition where two
CPU cores access RX path of two different sockets
sharing the same umem.
Protect both queues by acquiring spinlock in shared
xsk_buff_pool.
Lock contention may be minimized in the future by some
per-thread FQ buffering.
It's safe and necessary to move spin_lock_bh(rx_lock)
after xsk_rcv_check():
* xs->pool and spinlock_init is synchronized by
xsk_bind() -> xsk_is_bound() memory barriers.
* xsk_rcv_check() may return true at the moment
of xsk_release() or xsk_unbind_dev(),
however this will not cause any data races or
race conditions. xsk_unbind_dev() removes xdp
socket from all maps and waits for completion
of all outstanding rx operations. Packets in
RX path will either complete safely or drop.
Signed-off-by: Eryk Kubanski <e.kubanski@partner.samsung.com>
Fixes: bf0bdd1343 ("xdp: fix race on generic receive path")
Acked-by: Magnus Karlsson <magnus.karlsson@intel.com>
Link: https://patch.msgid.link/20250416101908.10919-1-e.kubanski@partner.samsung.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
commit eaaff9b6702e99be5d79135f2afa9fc48a0d59e0 upstream.
In case the fib match is used from the input hook we can avoid the fib
lookup if early demux assigned a socket for us: check that the input
interface matches sk-cached one.
Rework the existing 'lo bypass' logic to first check sk, then
for loopback interface type to elide the fib lookup.
This speeds up fib matching a little, before:
93.08 GBit/s (no rules at all)
75.1 GBit/s ("fib saddr . iif oif missing drop" in prerouting)
75.62 GBit/s ("fib saddr . iif oif missing drop" in input)
After:
92.48 GBit/s (no rules at all)
75.62 GBit/s (fib rule in prerouting)
90.37 GBit/s (fib rule in input).
Numbers for the 'no rules' and 'prerouting' are expected to
closely match in-between runs, the 3rd/input test case exercises the
the 'avoid lookup if cached ifindex in sk matches' case.
Test used iperf3 via veth interface, lo can't be used due to existing
loopback test.
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ Upstream commit ab6ab707a4d060a51c45fc13e3b2228d5f7c0b87 ]
This reverts commit 4d94f05558271654670d18c26c912da0c1c15549 which has
problems (see [1]) and is no longer needed since 581dd2dc168f
("Bluetooth: hci_event: Fix using rcu_read_(un)lock while iterating")
has reworked the code where the original bug has been found.
[1] Link: https://lore.kernel.org/linux-bluetooth/877c55ci1r.wl-tiwai@suse.de/T/#t
Fixes: 4d94f0555827 ("Bluetooth: hci_core: Fix sleeping function called from invalid context")
Change-Id: If816d3b42cb7b1c18e250c0a5ee266cdd48b4b01
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit 55b098a2be)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Although commit 75ddcd5ad40e ("Bluetooth: btusb: Configure altsetting
for HCI_USER_CHANNEL") has enabled the HCI_USER_CHANNEL user to send out
SCO data through USB Bluetooth chips, it's observed that with the patch
HFP is flaky on most of the existing USB Bluetooth controllers: Intel
chips sometimes send out no packet for Transparent codec; MTK chips may
generate SCO data with a wrong handle for CVSD codec; RTK could split
the data with a wrong packet size for Transparent codec; ... etc.
To address the issue above one needs to reset the altsetting back to
zero when there is no active SCO connection, which is the same as the
BlueZ behavior, and another benefit is the bus doesn't need to reserve
bandwidth when no SCO connection.
This patch adds the infrastructure that allow the user space program to
talk to Bluetooth drivers directly:
- Define the new packet type HCI_DRV_PKT which is specifically used for
communication between the user space program and the Bluetooth drviers
- hci_send_frame intercepts the packets and invokes drivers' HCI Drv
callbacks (so far only defined for btusb)
- 2 kinds of events to user space: Command Status and Command Complete,
the former simply returns the status while the later may contain
additional response data.
Cc: chromeos-bluetooth-upstreaming@chromium.org
Fixes: b16b327edb4d ("Bluetooth: btusb: add sysfs attribute to control USB alt setting")
Signed-off-by: Hsin-chen Chuang <chharry@chromium.org>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Bug: 387425332
(cherry picked from commit 4a740b78ddf3ce6894779f4526007ad24fbc049a
https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git master)
Change-Id: I226c67c4230cf6d0f324c2d8c00327ae875283c7
Signed-off-by: Hsin-chen Chuang <chharry@google.com>
This reverts commit f87271d21d which is
commit ab4eedb790cae44313759b50fe47da285e2519d5 upstream.
It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.
Bug: 161946584
Change-Id: I3ee05b3e7584529cb41ab496d14e7391cbf73260
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
GKI (arm64) relevant 45 out of 232 changes, affecting 66 files +537/-357
a74979dce9 mm/slab/kvfree_rcu: Switch to WQ_MEM_RECLAIM wq [1 file, +10/-4]
4e95072462 mm: fix kernel BUG when userfaultfd_move encounters swapcache [1 file, +66/-9]
99012b24ca userfaultfd: fix PTE unmapping stack-allocated PTE copies [1 file, +10/-10]
a5396ee0f5 netfilter: nf_conncount: garbage collection is not skipped when jiffies wrap around [1 file, +2/-2]
0befa32ac3 netfilter: nf_tables: make destruction work queue pernet [3 files, +21/-15]
0677a4f3c0 Bluetooth: hci_event: Fix enabling passive scanning [1 file, +22/-15]
55b098a2be Revert "Bluetooth: hci_core: Fix sleeping function called from invalid context" [6 files, +57/-97]
db1e0c0856 netfilter: nf_conncount: Fully initialize struct nf_conncount_tuple in insert_tree() [1 file, +2/-0]
5c3ca9cb48 net_sched: Prevent creation of classes with TC_H_ROOT [1 file, +6/-0]
a4d42b5901 gre: Fix IPv6 link-local address generation. [1 file, +9/-6]
ae5716b463 hrtimers: Mark is_migration_base() with __always_inline [1 file, +12/-10]
ccdec7ea9a powercap: call put_device() on an error path in powercap_register_control_type() [1 file, +1/-2]
aa189c3941 futex: Pass in task to futex_queue() [5 files, +15/-9]
1207e5d1a2 scsi: core: Use GFP_NOIO to avoid circular locking dependency [1 file, +1/-1]
3be0408451 scsi: ufs: core: Fix error return with query response [1 file, +6/-1]
705f251518 HID: hid-steam: Fix issues with disabling both gamepad mode and lizard mode [1 file, +3/-3]
024d7e006a HID: hid-apple: Apple Magic Keyboard a3203 USB-C support [2 files, +6/-0]
3ceaafa26f HID: apple: fix up the F6 key on the Omoton KB066 keyboard [1 file, +3/-0]
30a40b5925 sched: Clarify wake_up_q()'s write to task->wake_q.next [1 file, +3/-2]
a91922e9ea thermal/cpufreq_cooling: Remove structure member documentation [1 file, +0/-2]
aa3b0ea474 arm64: amu: Delay allocating cpumask for AMU FIE support [1 file, +10/-12]
f8094625a5 Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd [1 file, +34/-5]
4ed43c26b7 PCI: pci_ids: add INTEL_HDA_PTL_H [1 file, +1/-0]
b349a3d1b1 io-wq: backoff when retrying worker creation [1 file, +18/-5]
fd903dd301 nvme-pci: quirk Acer FA100 for non-uniqueue identifiers [1 file, +2/-0]
bfe7f298ee nvme: only allow entering LIVE from CONNECTING state [1 file, +0/-2]
df2ae00d96 fuse: don't truncate cached, mutated symlink [3 files, +22/-6]
d1ceef54b2 net: Handle napi_schedule() calls from non-interrupt [1 file, +1/-1]
7184e99610 block: fix 'kmem_cache of name 'bio-108' already exists' [1 file, +1/-1]
1936b189fa Input: xpad - add 8BitDo SN30 Pro, Hyperkin X91 and Gamesir G7 SE controllers [1 file, +8/-5]
e2304bbf87 Input: xpad - add multiple supported devices [1 file, +19/-1]
d91dd818f1 Input: xpad - add support for ZOTAC Gaming Zone [1 file, +2/-0]
f7ccf4eb4b Input: xpad - add support for TECNO Pocket Go [1 file, +2/-0]
0ff93d8956 Input: xpad - rename QH controller to Legion Go S [1 file, +2/-2]
87ede08ef2 USB: serial: ftdi_sio: add support for Altera USB Blaster 3 [2 files, +27/-0]
962912aaf8 drm/atomic: Filter out redundant DPMS calls [2 files, +8/-0]
454825019d netmem: prevent TX of unreadable skbs [1 file, +3/-0]
f6bbea2ffe arm64: mm: Populate vmemmap at the page level if not section aligned [1 file, +4/-1]
608bbf7ff5 Fix mmu notifiers for range-based invalidates [1 file, +12/-10]
a46a9371f8 ASoC: ops: Consistently treat platform_max as control value [2 files, +11/-9]
77213a424a nvme: move error logging from nvme_end_req() to __nvme_end_req() [1 file, +6/-6]
f415148282 mm/hugetlb: wait for hugetlb folios to be freed [3 files, +23/-0]
f87271d21d Bluetooth: L2CAP: Fix corrupted list in hci_chan_del [3 files, +58/-98]
8f324d9930 HID: apple: disable Fn key handling on the Omoton KB066 [1 file, +7/-4]
62b9ad7e52 fs/netfs/read_collect: add to next->prev_donated [1 file, +1/-1]
Changes in 6.12.20
mm/slab/kvfree_rcu: Switch to WQ_MEM_RECLAIM wq
mm: fix kernel BUG when userfaultfd_move encounters swapcache
userfaultfd: fix PTE unmapping stack-allocated PTE copies
fbdev: hyperv_fb: iounmap() the correct memory when removing a device
pinctrl: bcm281xx: Fix incorrect regmap max_registers value
pinctrl: nuvoton: npcm8xx: Add NULL check in npcm8xx_gpio_fw
netfilter: nft_ct: Use __refcount_inc() for per-CPU nft_ct_pcpu_template.
ice: do not configure destination override for switchdev
ice: fix memory leak in aRFS after reset
ice: Fix switchdev slow-path in LAG
netfilter: nf_conncount: garbage collection is not skipped when jiffies wrap around
netfilter: nf_tables: make destruction work queue pernet
sched: address a potential NULL pointer dereference in the GRED scheduler.
wifi: iwlwifi: mvm: fix PNVM timeout for non-MSI-X platforms
wifi: mac80211: don't queue sdata::work for a non-running sdata
wifi: cfg80211: cancel wiphy_work before freeing wiphy
Bluetooth: hci_event: Fix enabling passive scanning
Revert "Bluetooth: hci_core: Fix sleeping function called from invalid context"
net/mlx5: Fill out devlink dev info only for PFs
net: dsa: mv88e6xxx: Verify after ATU Load ops
net: mctp i3c: Copy headers if cloned
net: mctp i2c: Copy headers if cloned
netpoll: hold rcu read lock in __netpoll_send_skb()
drm/hyperv: Fix address space leak when Hyper-V DRM device is removed
fbdev: hyperv_fb: Fix hang in kdump kernel when on Hyper-V Gen 2 VMs
fbdev: hyperv_fb: Simplify hvfb_putmem
fbdev: hyperv_fb: Allow graceful removal of framebuffer
Drivers: hv: vmbus: Don't release fb_mmio resource in vmbus_free_mmio()
net/mlx5: handle errors in mlx5_chains_create_table()
eth: bnxt: fix truesize for mb-xdp-pass case
eth: bnxt: return fail if interface is down in bnxt_queue_mem_alloc()
eth: bnxt: do not use BNXT_VNIC_NTUPLE unconditionally in queue restart logic
eth: bnxt: do not update checksum in bnxt_xdp_build_skb()
eth: bnxt: fix kernel panic in the bnxt_get_queue_stats{rx | tx}
eth: bnxt: use page pool for head frags
bnxt_en: refactor tpa_info alloc/free into helpers
bnxt_en: handle tpa_info in queue API implementation
eth: bnxt: fix memory leak in queue reset
net: switchdev: Convert blocking notification chain to a raw one
net: mctp: unshare packets when reassembling
bonding: fix incorrect MAC address setting to receive NS messages
selftests: bonding: fix incorrect mac address
rtase: Fix improper release of ring list entries in rtase_sw_reset
netfilter: nf_conncount: Fully initialize struct nf_conncount_tuple in insert_tree()
ipvs: prevent integer overflow in do_ip_vs_get_ctl()
net_sched: Prevent creation of classes with TC_H_ROOT
netfilter: nft_exthdr: fix offset with ipv4_find_option()
gre: Fix IPv6 link-local address generation.
net: openvswitch: remove misbehaving actions length check
Revert "openvswitch: switch to per-action label counting in conntrack"
net/mlx5: HWS, Rightsize bwc matcher priority
net/mlx5: Fix incorrect IRQ pool usage when releasing IRQs
net/mlx5: Lag, Check shared fdb before creating MultiPort E-Switch
net/mlx5: Bridge, fix the crash caused by LAG state check
net/mlx5e: Prevent bridge link show failure for non-eswitch-allowed devices
nvme-fc: go straight to connecting state when initializing
nvme-fc: do not ignore connectivity loss during connecting
hrtimers: Mark is_migration_base() with __always_inline
powercap: call put_device() on an error path in powercap_register_control_type()
btrfs: avoid starting new transaction when cleaning qgroup during subvolume drop
futex: Pass in task to futex_queue()
iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic()
sched/debug: Provide slice length for fair tasks
platform/x86/intel: pmc: fix ltr decode in pmc_core_ltr_show()
drm/amd/display: Fix out-of-bound accesses
scsi: core: Use GFP_NOIO to avoid circular locking dependency
scsi: ufs: core: Fix error return with query response
scsi: qla1280: Fix kernel oops when debug level > 2
ACPI: resource: IRQ override for Eluktronics MECH-17
smb: client: fix noisy when tree connecting to DFS interlink targets
alpha/elf: Fix misc/setarch test of util-linux by removing 32bit support
vboxsf: fix building with GCC 15
selftests: always check mask returned by statmount(2)
sched_ext: selftests/dsp_local_on: Fix sporadic failures
HID: intel-ish-hid: fix the length of MNG_SYNC_FW_CLOCK in doorbell
HID: intel-ish-hid: Send clock sync message immediately after reset
HID: ignore non-functional sensor in HP 5MP Camera
HID: hid-steam: Fix issues with disabling both gamepad mode and lizard mode
usb: phy: generic: Use proper helper for property detection
HID: intel-ish-hid: ipc: Add Panther Lake PCI device IDs
HID: topre: Fix n-key rollover on Realforce R3S TKL boards
selftests/cgroup: use bash in test_cpuset_v1_hp.sh
HID: hid-apple: Apple Magic Keyboard a3203 USB-C support
HID: apple: fix up the F6 key on the Omoton KB066 keyboard
btrfs: fix two misuses of folio_shift()
objtool: Ignore dangling jump table entries
sched: Clarify wake_up_q()'s write to task->wake_q.next
platform/x86: thinkpad_acpi: Fix invalid fan speed on ThinkPad X120e
platform/x86: thinkpad_acpi: Support for V9 DYTC platform profiles
platform/x86: int3472: Use correct type for "polarity", call it gpio_flags
platform/x86: int3472: Call "reset" GPIO "enable" for INT347E
s390/cio: Fix CHPID "configure" attribute caching
thermal/cpufreq_cooling: Remove structure member documentation
LoongArch: Fix kernel_page_present() for KPRANGE/XKPRANGE
LoongArch: KVM: Set host with kernel mode when switch to VM mode
arm64: amu: Delay allocating cpumask for AMU FIE support
Xen/swiotlb: mark xen_swiotlb_fixup() __init
Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd
drm/tests: hdmi: Remove redundant assignments
drm/tests: hdmi: Reorder DRM entities variables assignment
drm/tests: hdmi: Fix recursive locking
selftests/bpf: Fix invalid flag of recv()
ASoC: Intel: sof_sdw: Add lookup of quirk using PCI subsystem ID
ASoC: Intel: sof_sdw: Add quirk for Asus Zenbook S14
ASoC: Intel: soc-acpi-intel-mtl-match: declare adr as ull
ASoC: simple-card-utils.c: add missing dlc->of_node
ALSA: hda/realtek: Limit mic boost on Positivo ARN50
ASoC: rsnd: indicate unsupported clock rate
ASoC: rsnd: don't indicate warning on rsnd_kctrl_accept_runtime()
ASoC: rsnd: adjust convert rate limitation
ASoC: arizona/madera: use fsleep() in up/down DAPM event delays.
ASoC: SOF: Intel: hda: add softdep pre to snd-hda-codec-hdmi module
PCI: pci_ids: add INTEL_HDA_PTL_H
ALSA: hda: intel-dsp-config: Add PTL-H support
ASoC: SOF: Intel: pci-ptl: Add support for PTL-H
ALSA: hda: hda-intel: add Panther Lake-H support
ASoC: SOF: amd: Add post_fw_run_delay ACP quirk
ASoC: SOF: amd: Handle IPC replies before FW_BOOT_COMPLETE
net: wwan: mhi_wwan_mbim: Silence sequence number glitch errors
io-wq: backoff when retrying worker creation
nvme-pci: quirk Acer FA100 for non-uniqueue identifiers
nvmet-rdma: recheck queue state is LIVE in state lock in recv done
apple-nvme: Release power domains when probe fails
cifs: Treat unhandled directory name surrogate reparse points as mount directory nodes
sctp: Fix undefined behavior in left shift operation
nvme: only allow entering LIVE from CONNECTING state
phy: ti: gmii-sel: Do not use syscon helper to build regmap
ASoC: tas2770: Fix volume scale
ASoC: tas2764: Fix power control mask
ASoC: tas2764: Set the SDOUT polarity correctly
fuse: don't truncate cached, mutated symlink
ASoC: dapm-graph: set fill colour of turned on nodes
ASoC: SOF: Intel: don't check number of sdw links when set dmic_fixup
drm/vkms: Round fixp2int conversion in lerp_u16
perf/x86/intel: Use better start period for frequency mode
x86/of: Don't use DTB for SMP setup if ACPI is enabled
x86/irq: Define trace events conditionally
perf/x86/rapl: Add support for Intel Arrow Lake U
mptcp: safety check before fallback
drm/nouveau: Do not override forced connector status
net: Handle napi_schedule() calls from non-interrupt
block: fix 'kmem_cache of name 'bio-108' already exists'
vhost: return task creation error instead of NULL
cifs: Validate content of WSL reparse point buffers
cifs: Throw -EOPNOTSUPP error on unsupported reparse point type from parse_reparse_point()
Input: goodix-berlin - fix vddio regulator references
Input: ads7846 - fix gpiod allocation
Input: iqs7222 - preserve system status register
Input: xpad - add 8BitDo SN30 Pro, Hyperkin X91 and Gamesir G7 SE controllers
Input: xpad - add multiple supported devices
Input: xpad - add support for ZOTAC Gaming Zone
Input: xpad - add support for TECNO Pocket Go
Input: xpad - rename QH controller to Legion Go S
Input: i8042 - swap old quirk combination with new quirk for NHxxRZQ
Input: i8042 - add required quirks for missing old boardnames
Input: i8042 - swap old quirk combination with new quirk for several devices
Input: i8042 - swap old quirk combination with new quirk for more devices
USB: serial: ftdi_sio: add support for Altera USB Blaster 3
USB: serial: option: add Telit Cinterion FE990B compositions
USB: serial: option: fix Telit Cinterion FE990A name
USB: serial: option: match on interface class for Telit FN990B
rust: lockdep: Remove support for dynamically allocated LockClassKeys
rust: remove leftover mentions of the `alloc` crate
rust: alloc: satisfy POSIX alignment requirement
rust: Disallow BTF generation with Rust + LTO
rust: init: fix `Zeroable` implementation for `Option<NonNull<T>>` and `Option<KBox<T>>`
x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes
spi: microchip-core: prevent RX overflows when transmit size > FIFO size
drm/i915/cdclk: Do cdclk post plane programming later
drm/panic: use `div_ceil` to clean Clippy warning
drm/panic: fix overindented list items in documentation
drm/atomic: Filter out redundant DPMS calls
drm/dp_mst: Fix locking when skipping CSN before topology probing
drm/amdgpu: NULL-check BO's backing store when determining GFX12 PTE flags
drm/amd/amdkfd: Evict all queues even HWS remove queue failed
drm/amdgpu/display: Allow DCC for video formats on GFX12
drm/amd/display: Disable unneeded hpd interrupts during dm_init
drm/amd/display: fix default brightness
drm/amd/display: fix missing .is_two_pixels_per_container
drm/amd/display: Restore correct backlight brightness after a GPU reset
drm/amd/display: Assign normalized_pix_clk when color depth = 14
drm/amd/display: Fix slab-use-after-free on hdcp_work
ksmbd: fix use-after-free in ksmbd_free_work_struct
ksmbd: prevent connection release during oplock break notification
clk: samsung: update PLL locktime for PLL142XX used on FSD platform
clk: samsung: gs101: fix synchronous external abort in samsung_clk_save()
ASoC: Intel: sof_sdw: Fix unlikely uninitialized variable use in create_sdw_dailinks()
ASoC: amd: yc: Support mic on another Lenovo ThinkPad E16 Gen 2 model
netmem: prevent TX of unreadable skbs
dm-flakey: Fix memory corruption in optional corrupt_bio_byte feature
arm64: mm: Populate vmemmap at the page level if not section aligned
Fix mmu notifiers for range-based invalidates
qlcnic: fix memory leak issues in qlcnic_sriov_common.c
smb: client: fix regression with guest option
net: phy: nxp-c45-tja11xx: add TJA112X PHY configuration errata
net: phy: nxp-c45-tja11xx: add TJA112XB SGMII PCS restart errata
sched_ext: Validate prev_cpu in scx_bpf_select_cpu_dfl()
ASoC: ops: Consistently treat platform_max as control value
rust: error: add missing newline to pr_warn! calls
drm/gma500: Add NULL check for pci_gfx_root in mid_get_vbt_data()
ASoC: cs42l43: Fix maximum ADC Volume
rust: init: add missing newline to pr_info! calls
ASoC: rt722-sdca: add missing readable registers
drm/xe: cancel pending job timer before freeing scheduler
drm/xe: Release guc ids before cancelling work
drm/xe/userptr: Fix an incorrect assert
drm/xe/pm: Temporarily disable D3Cold on BMG
nvme: move error logging from nvme_end_req() to __nvme_end_req()
ASoC: codecs: wm0010: Fix error handling path in wm0010_spi_probe()
drm/i915: Increase I915_PARAM_MMAP_GTT_VERSION version to indicate support for partial mmaps
scripts: generate_rust_analyzer: add missing macros deps
scripts: generate_rust_analyzer: add missing include_dirs
scripts: generate_rust_analyzer: add uapi crate
block: change blk_mq_add_to_batch() third argument type to bool
cifs: Fix integer overflow while processing acregmax mount option
cifs: Fix integer overflow while processing acdirmax mount option
cifs: Fix integer overflow while processing actimeo mount option
cifs: Fix integer overflow while processing closetimeo mount option
x86/vmware: Parse MP tables for SEV-SNP enabled guests under VMware hypervisors
i2c: ali1535: Fix an error handling path in ali1535_probe()
i2c: ali15x3: Fix an error handling path in ali15x3_probe()
i2c: sis630: Fix an error handling path in sis630_probe()
mm/hugetlb: wait for hugetlb folios to be freed
smb3: add support for IAKerb
smb: client: Fix match_session bug preventing session reuse
sched_ext: selftests/dsp_local_on: Fix selftest on UP systems
tools/sched_ext: Add helper to check task migration state
Bluetooth: L2CAP: Fix corrupted list in hci_chan_del
nvme-fc: rely on state transitions to handle connectivity loss
HID: apple: disable Fn key handling on the Omoton KB066
fs/netfs/read_collect: add to next->prev_donated
Linux 6.12.20
Change-Id: I5a7652336baaa64b019b6306f78ee5f96aa829aa
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
This reverts commit 55b098a2be which is
commit ab6ab707a4d060a51c45fc13e3b2228d5f7c0b87 upstream.
It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.
Bug: 161946584
Change-Id: I16716919ad640cccea5ecbfd92fbe185333024e9
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Greg Kroah-Hartman
Kuniyuki Iwashima
Willem de Bruijn
Paul Chaignon
Toke Høiland-Jørgensen
Kavita Kavita
Michal Luczaj
Luiz Augusto von Dentz
Florian Westphal
Toke Høiland-Jørgensen
Sabrina Dubroca
Emmanuel Grumbach
Anjaneyulu
Cong Wang
Jakub Kicinski
Aditya Agrawal
Chiachang Wang
e.kubanski
Hsin-chen Chuang