GKI (arm64) relevant 87 out of 414 changes, affecting 112 files +738/-352
bdb71ee651 configfs: Do not override creating attribute file failure in populate_attrs() [1 file, +1/-1]
ba789be63d io_uring: account drain memory to cgroup [1 file, +1/-1]
c58b577cf7 io_uring/kbuf: account ring io_buffer_list memory [1 file, +1/-1]
f78b38af35 jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() [1 file, +3/-2]
2429bb9fad media: v4l2-dev: fix error handling in __video_register_device() [1 file, +7/-7]
5d8b057ed7 media: videobuf2: use sgtable-based scatterlist wrappers [1 file, +2/-2]
b52dc88361 media: uvcvideo: Return the number of processed controls [1 file, +10/-1]
6d2b12e7c5 media: uvcvideo: Send control events for partial succeeds [1 file, +9/-3]
aac91ae06c media: uvcvideo: Fix deferred probing error [1 file, +19/-8]
86d9837e46 arm64/mm: Close theoretical race where stale TLB entry remains valid [1 file, +5/-4]
5538af3843 block: use plug request list tail for one-shot backmerge attempt [1 file, +13/-13]
943801c380 block: Clear BIO_EMULATES_ZONE_APPEND flag on BIO completion [1 file, +1/-0]
1c71f3cf5f cgroup,freezer: fix incomplete freezing when attaching tasks [1 file, +1/-2]
a0890b7805 bus: firewall: Fix missing static inline annotations for stubs [1 file, +9/-6]
5766da2237 ext4: inline: fix len overflow in ext4_prepare_inline_data [1 file, +1/-1]
796632e6f8 ext4: fix calculation of credits for extent tree modification [1 file, +6/-5]
4b36399711 ext4: ensure i_size is smaller than maxbytes [1 file, +2/-1]
be5f3061a6 ext4: only dirty folios when data journaling regular files [1 file, +6/-1]
a0b1c91ada Input: gpio-keys - fix possible concurrent access in gpio_keys_irq_timer() [1 file, +2/-0]
fed611bd8c f2fs: fix to do sanity check on ino and xnid [1 file, +6/-0]
aaa644e7ff f2fs: prevent kernel warning due to negative i_nlink from corrupted image [1 file, +9/-0]
ee1b421c46 f2fs: fix to do sanity check on sit_bitmap_size [1 file, +8/-0]
f16a797dce watchdog: fix watchdog may detect false positive of softlockup [1 file, +27/-14]
02137179ff mm: fix ratelimit_pages update error in dirty_ratio_handler() [1 file, +1/-1]
462eee6d42 firmware: arm_scmi: Ensure that the message-id supports fastchannel [2 files, +45/-33]
e3cf1ef571 dm-verity: fix a memory leak if some arguments are specified multiple times [3 files, +24/-5]
f2986bccf2 dm: lock limits when reading them [1 file, +7/-1]
ec5f0b4412 ovl: Fix nested backing file paths [1 file, +2/-2]
92776ca0cc remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach() [1 file, +2/-3]
f4ef928ca5 remoteproc: core: Release rproc->clean_table after rproc_attach() fails [1 file, +1/-0]
68e58f5791 PCI: dwc: ep: Correct PBA offset in .set_msix() callback [1 file, +3/-2]
b20701d594 PCI: Add ACS quirk for Loongson PCIe [1 file, +23/-0]
be0cf75cbd PCI: Fix lock symmetry in pci_slot_unlock() [1 file, +2/-1]
7b45d2401d clocksource: Fix the CPUs' choice in the watchdog per CPU verification [1 file, +1/-1]
c05aba32a9 ACPICA: Avoid sequence overread in call to strncmp() [1 file, +1/-1]
66613b13cd ACPI: Add missing prototype for non CONFIG_SUSPEND/CONFIG_X86 case [1 file, +8/-1]
33cd650d38 pmdomain: core: Reset genpd->states to avoid freeing invalid data [1 file, +3/-1]
f34e0c1556 platform-msi: Add msi_remove_device_irq_domain() in platform_device_msi_free_irqs_all() [1 file, +1/-0]
c519f81e9c gpiolib: of: Add polarity quirk for s5m8767 [1 file, +9/-0]
1f152ae557 PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn() [1 file, +1/-1]
6c1151d53c tipc: use kfree_sensitive() for aead cleanup [1 file, +1/-1]
b0e647442c f2fs: use vmalloc instead of kvmalloc in .init_{,de}compress_ctx [2 files, +15/-13]
2d834477bb bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem() [1 file, +2/-1]
77ff6aec7c cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs [1 file, +35/-1]
0a8446058c tcp: always seek for minimal rtt in tcp_rcv_rtt_update() [1 file, +8/-14]
f97085d365 tcp: remove zero TCP TS samples for autotuning [1 file, +5/-5]
89b20c406e tcp: fix initial tp->rcvq_space.space value for passive TS enabled flows [1 file, +3/-3]
84c156a351 tcp: add receive queue awareness in tcp_rcv_space_adjust() [2 files, +5/-3]
3a9e74d158 ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT [1 file, +4/-0]
5eb9c50e0c net: page_pool: Don't recycle into cache on PREEMPT_RT [1 file, +4/-0]
8b0741b167 xfrm: validate assignment of maximal possible SEQ number [1 file, +42/-10]
8fdf2f79eb bpf: Pass the same orig_call value to trampoline functions [1 file, +1/-1]
f0023d7a2a f2fs: fix to bail out in get_new_segment() [2 files, +6/-1]
448dc45eea bpf: Use proper type to calculate bpf_raw_tp_null_args.mask index [1 file, +2/-2]
78f768e36c net: bridge: mcast: re-implement br_multicast_{enable, disable}_port functions [1 file, +69/-8]
4b3383110b software node: Correct a OOB check in software_node_get_reference_args() [1 file, +1/-1]
b7129ef57d sock: Correct error checking condition for (assign|release)_proto_idx() [1 file, +2/-2]
a58f0a0e99 f2fs: fix to set atomic write status more clear [3 files, +12/-2]
b8b4b8bb34 bpf, sockmap: Fix data lost during EAGAIN retries [1 file, +2/-1]
7c41f73b64 fs/xattr.c: fix simple_xattr_list() [1 file, +1/-0]
2e10dc9c2a io_uring/kbuf: don't truncate end buffer for multiple buffer peeks [1 file, +4/-1]
1a4254ab06 io_uring: fix task leak issue in io_wq_create() [1 file, +3/-1]
4220cc0b98 nvme: always punt polled uring_cmd end_io work to task_work [1 file, +7/-14]
f9b97d466e net_sched: sch_sfq: reject invalid perturb period [1 file, +8/-2]
2a3ad42a57 net: clear the dst when changing skb protocol [1 file, +13/-6]
510a29d776 mm: close theoretical race where stale TLB entries could linger [1 file, +2/-0]
57ec081869 sched_ext, sched/core: Don't call scx_group_set_weight() prematurely from sched_create_group() [3 files, +9/-2]
3d828519bd atm: Revert atm_account_tx() if copy_from_iter_full() fails. [3 files, +8/-1]
47f34289d1 arm64: Restrict pagetable teardown to avoid false warning [1 file, +2/-1]
9cf5b2a3b7 mm/hugetlb: unshare page tables during VMA split, not before [5 files, +57/-16]
dc5f0aef9e net: Fix checksum update for ILA adj-transport [4 files, +7/-7]
2516299184 bpf: Fix L4 csum update on IPv6 in CHECKSUM_COMPLETE [3 files, +7/-2]
50189d9c5e erofs: remove unused trace event erofs_destroy_inode [1 file, +0/-18]
348e541fef ipv6: remove leftover ip6 cookie initializer [1 file, +0/-2]
3c44ebad5a ipv6: replace ipcm6_init calls with ipcm6_init_sk [4 files, +3/-29]
6b358b3adf io_uring/sqpoll: don't put task_struct on tctx setup failure [1 file, +1/-4]
8873080b88 workqueue: Initialize wq_isolated_cpumask in workqueue_init_early() [1 file, +2/-1]
ac462a75fd net: netmem: fix skb_ensure_writable with unreadable skbs [1 file, +0/-3]
61b39e189d ptp: allow reading of currently dialed frequency to succeed on free-running clocks [1 file, +2/-1]
397c1faf8f tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen() behavior [1 file, +25/-12]
0d3d91c350 tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer [1 file, +2/-2]
31d50dfe9c tcp: fix passive TFO socket having invalid NAPI ID [1 file, +3/-0]
0f8df5d6f2 ublk: santizize the arguments from userspace when adding a device [1 file, +3/-0]
456019adaa perf: Fix sample vs do_exit() [2 files, +16/-8]
7335c33d62 perf: Fix cgroup state vs ERROR [1 file, +30/-21]
fd199366bf perf/core: Fix WARN in perf_cgroup_switch() [1 file, +20/-2]
22f935bc86 arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() [1 file, +1/-1]
Changes in 6.12.35
configfs: Do not override creating attribute file failure in populate_attrs()
crypto: marvell/cesa - Do not chain submitted requests
gfs2: move msleep to sleepable context
crypto: qat - add shutdown handler to qat_c3xxx
crypto: qat - add shutdown handler to qat_420xx
crypto: qat - add shutdown handler to qat_4xxx
crypto: qat - add shutdown handler to qat_c62x
crypto: qat - add shutdown handler to qat_dh895xcc
ASoC: qcom: sdm845: Add error handling in sdm845_slim_snd_hw_params()
ASoC: meson: meson-card-utils: use of_property_present() for DT parsing
ASoC: amd: sof_amd_sdw: Fix unlikely uninitialized variable use in create_sdw_dailinks()
io_uring: account drain memory to cgroup
io_uring/kbuf: account ring io_buffer_list memory
powerpc/pseries/msi: Avoid reading PCI device registers in reduced power states
s390/pci: Remove redundant bus removal and disable from zpci_release_device()
s390/pci: Prevent self deletion in disable_slot()
s390/pci: Allow re-add of a reserved but not yet removed device
s390/pci: Serialize device addition and removal
regulator: max20086: Fix MAX200086 chip id
regulator: max20086: Change enable gpio to optional
net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr()
net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid()
wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback()
wifi: mt76: mt7925: fix host interrupt register initialization
wifi: ath11k: fix rx completion meta data corruption
wifi: rtw88: usb: Upload the firmware in bigger chunks
wifi: ath11k: fix ring-buffer corruption
NFSD: unregister filesystem in case genl_register_family() fails
NFSD: fix race between nfsd registration and exports_proc
NFSD: Implement FATTR4_CLONE_BLKSIZE attribute
nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request
nfsd: Initialize ssc before laundromat_work to prevent NULL dereference
SUNRPC: Prevent hang on NFS mount with xprtsec=[m]tls
NFSv4: Don't check for OPEN feature support in v4.1
fs/nfs/read: fix double-unlock bug in nfs_return_empty_folio()
wifi: ath12k: fix ring-buffer corruption
jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata()
svcrdma: Unregister the device if svc_rdma_accept() fails
wifi: rtw88: usb: Reduce control message timeout to 500 ms
wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID 11ad:1723
media: ov8856: suppress probe deferral errors
media: ov5675: suppress probe deferral errors
media: imx335: Use correct register width for HNUM
media: nxp: imx8-isi: better handle the m2m usage_count
media: i2c: ds90ub913: Fix returned fmt from .set_fmt()
media: ccs-pll: Start VT pre-PLL multiplier search from correct value
media: ov2740: Move pm-runtime cleanup on probe-errors to proper place
media: ccs-pll: Start OP pre-PLL multiplier search from correct value
media: ccs-pll: Correct the upper limit of maximum op_pre_pll_clk_div
media: ccs-pll: Check for too high VT PLL multiplier in dual PLL case
media: cxusb: no longer judge rbuf when the write fails
media: davinci: vpif: Fix memory leak in probe error path
media: gspca: Add error handling for stv06xx_read_sensor()
media: i2c: imx335: Fix frame size enumeration
media: imagination: fix a potential memory leak in e5010_probe()
media: intel/ipu6: Fix dma mask for non-secure mode
media: ipu6: Remove workaround for Meteor Lake ES2
media: mediatek: vcodec: Correct vsi_core framebuffer size
media: omap3isp: use sgtable-based scatterlist wrappers
media: v4l2-dev: fix error handling in __video_register_device()
media: venus: Fix probe error handling
media: videobuf2: use sgtable-based scatterlist wrappers
media: vidtv: Terminating the subsequent process of initialization failure
media: vivid: Change the siize of the composing
media: imx-jpeg: Drop the first error frames
media: imx-jpeg: Move mxc_jpeg_free_slot_data() ahead
media: imx-jpeg: Reset slot data pointers when freed
media: imx-jpeg: Cleanup after an allocation error
media: uvcvideo: Return the number of processed controls
media: uvcvideo: Send control events for partial succeeds
media: uvcvideo: Fix deferred probing error
arm64/mm: Close theoretical race where stale TLB entry remains valid
ARM: 9447/1: arm/memremap: fix arch_memremap_can_ram_remap()
ARM: omap: pmic-cpcap: do not mess around without CPCAP or OMAP4
ASoC: codecs: wcd9375: Fix double free of regulator supplies
ASoC: codecs: wcd937x: Drop unused buck_supply
block: use plug request list tail for one-shot backmerge attempt
block: Clear BIO_EMULATES_ZONE_APPEND flag on BIO completion
bus: mhi: ep: Update read pointer only after buffer is written
bus: mhi: host: Fix conflict between power_up and SYSERR
can: kvaser_pciefd: refine error prone echo_skb_max handling logic
can: tcan4x5x: fix power regulator retrieval during probe
ceph: avoid kernel BUG for encrypted inode with unaligned file size
ceph: set superblock s_magic for IMA fsmagic matching
cgroup,freezer: fix incomplete freezing when attaching tasks
bus: firewall: Fix missing static inline annotations for stubs
ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330
ata: ahci: Disallow LPM for ASUSPRO-D840SA motherboard
ata: ahci: Disallow LPM for Asus B550-F motherboard
bus: fsl-mc: do not add a device-link for the UAPI used DPMCP device
bus: fsl-mc: fix GET/SET_TAILDROP command ids
ext4: inline: fix len overflow in ext4_prepare_inline_data
ext4: fix calculation of credits for extent tree modification
ext4: factor out ext4_get_maxbytes()
ext4: ensure i_size is smaller than maxbytes
ext4: only dirty folios when data journaling regular files
Input: ims-pcu - check record size in ims_pcu_flash_firmware()
Input: gpio-keys - fix possible concurrent access in gpio_keys_irq_timer()
f2fs: fix to do sanity check on ino and xnid
f2fs: prevent kernel warning due to negative i_nlink from corrupted image
f2fs: fix to do sanity check on sit_bitmap_size
hwmon: (ftsteutates) Fix TOCTOU race in fts_read()
NFC: nci: uart: Set tty->disc_data only in success path
net/sched: fix use-after-free in taprio_dev_notifier
net: ftgmac100: select FIXED_PHY
iommu/vt-d: Restore context entry setup order for aliased devices
fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var
EDAC/altera: Use correct write width with the INTTEST register
fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var
parisc/unaligned: Fix hex output to show 8 hex chars
vgacon: Add check for vc_origin address range in vgacon_scroll()
parisc: fix building with gcc-15
clk: meson-g12a: add missing fclk_div2 to spicc
ipc: fix to protect IPCS lookups using RCU
watchdog: fix watchdog may detect false positive of softlockup
RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction
mm: fix ratelimit_pages update error in dirty_ratio_handler()
soc: qcom: pmic_glink_altmode: fix spurious DP hotplug events
configfs-tsm-report: Fix NULL dereference of tsm_ops
firmware: arm_scmi: Ensure that the message-id supports fastchannel
mtd: rawnand: sunxi: Add randomizer configuration in sunxi_nfc_hw_ecc_write_chunk
mtd: nand: sunxi: Add randomizer configuration before randomizer enable
KVM: SVM: Clear current_vmcb during vCPU free for all *possible* CPUs
KVM: VMX: Flush shadow VMCS on emergency reboot
dm-mirror: fix a tiny race condition
dm-verity: fix a memory leak if some arguments are specified multiple times
mtd: rawnand: qcom: Fix read len for onfi param page
ftrace: Fix UAF when lookup kallsym after ftrace disabled
dm: lock limits when reading them
phy: fsl-imx8mq-usb: fix phy_tx_vboost_level_from_property()
net: ch9200: fix uninitialised access during mii_nway_restart
KVM: s390: rename PROT_NONE to PROT_TYPE_DUMMY
sysfb: Fix screen_info type check for VGA
video: screen_info: Relocate framebuffers behind PCI bridges
pwm: axi-pwmgen: fix missing separate external clock
staging: iio: ad5933: Correct settling cycles encoding per datasheet
mips: Add -std= flag specified in KBUILD_CFLAGS to vdso CFLAGS
ovl: Fix nested backing file paths
regulator: max14577: Add error check for max14577_read_reg()
remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach()
remoteproc: core: Release rproc->clean_table after rproc_attach() fails
remoteproc: k3-m4: Don't assert reset in detach routine
cifs: reset connections for all channels when reconnect requested
cifs: update dstaddr whenever channel iface is updated
cifs: dns resolution is needed only for primary channel
smb: client: add NULL check in automount_fullpath
Drivers: hv: Allocate interrupt and monitor pages aligned to system page boundary
uio_hv_generic: Use correct size for interrupt and monitor pages
uio_hv_generic: Align ring size to system page
PCI: cadence-ep: Correct PBA offset in .set_msix() callback
PCI: dwc: ep: Correct PBA offset in .set_msix() callback
PCI: Add ACS quirk for Loongson PCIe
PCI: Fix lock symmetry in pci_slot_unlock()
PCI: dw-rockchip: Remove PCIE_L0S_ENTRY check from rockchip_pcie_link_up()
PCI: dw-rockchip: Fix PHY function call sequence in rockchip_pcie_phy_deinit()
iio: accel: fxls8962af: Fix temperature scan element sign
accel/ivpu: Improve buffer object logging
accel/ivpu: Use firmware names from upstream repo
accel/ivpu: Use dma_resv_lock() instead of a custom mutex
accel/ivpu: Fix warning in ivpu_gem_bo_free()
dummycon: Trigger redraw when switching consoles with deferred takeover
mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race
iio: imu: inv_icm42600: Fix temperature calculation
iio: adc: ad7944: mask high bits on direct read
iio: adc: ti-ads1298: Kconfig: add kfifo dependency to fix module build
iio: adc: ad7606_spi: fix reg write value mask
ACPICA: fix acpi operand cache leak in dswstate.c
ASoC: amd: yc: Add quirk for Lenovo Yoga Pro 7 14ASP9
clocksource: Fix the CPUs' choice in the watchdog per CPU verification
power: supply: collie: Fix wakeup source leaks on device unbind
mmc: Add quirk to disable DDR50 tuning
ACPICA: Avoid sequence overread in call to strncmp()
ASoC: tas2770: Power cycle amp on ISENSE/VSENSE change
ASoC: intel/sdw_utils: Assign initial value in asoc_sdw_rt_amp_spk_rtd_init()
ACPI: bus: Bail out if acpi_kobj registration fails
ACPI: Add missing prototype for non CONFIG_SUSPEND/CONFIG_X86 case
ACPICA: fix acpi parse and parseext cache leaks
ACPICA: Apply pack(1) to union aml_resource
ALSA: hda: cs35l41: Fix swapped l/r audio channels for Acer Helios laptops
power: supply: bq27xxx: Retrieve again when busy
pmdomain: core: Reset genpd->states to avoid freeing invalid data
ACPICA: utilities: Fix overflow check in vsnprintf()
platform-msi: Add msi_remove_device_irq_domain() in platform_device_msi_free_irqs_all()
ASoC: tegra210_ahub: Add check to of_device_get_match_data()
Make 'cc-option' work correctly for the -Wno-xyzzy pattern
gpiolib: of: Add polarity quirk for s5m8767
PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn()
power: supply: max17040: adjust thermal channel scaling
ACPI: battery: negate current when discharging
net: macb: Check return value of dma_set_mask_and_coherent()
net: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices
tipc: use kfree_sensitive() for aead cleanup
f2fs: use vmalloc instead of kvmalloc in .init_{,de}compress_ctx
bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem()
Bluetooth: btusb: Add new VID/PID 13d3/3584 for MT7922
i2c: designware: Invoke runtime suspend on quick slave re-registration
wifi: mt76: mt7996: drop fragments with multicast or broadcast RA
emulex/benet: correct command version selection in be_cmd_get_stats()
Bluetooth: btusb: Add new VID/PID 13d3/3630 for MT7925
wifi: mt76: mt76x2: Add support for LiteOn WN4516R,WN4519R
wifi: mt76: mt7921: add 160 MHz AP for mt7922 device
wifi: mt76: mt7925: introduce thermal protection
wifi: mac80211: validate SCAN_FLAG_AP in scan request during MLO
sctp: Do not wake readers in __sctp_write_space()
libbpf/btf: Fix string handling to support multi-split BTF
cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs
i2c: tegra: check msg length in SMBUS block read
i2c: npcm: Add clock toggle recovery
clk: qcom: gcc-x1e80100: Set FORCE MEM CORE for UFS clocks
net: dlink: add synchronization for stats update
wifi: ath12k: fix macro definition HAL_RX_MSDU_PKT_LENGTH_GET
wifi: ath12k: fix a possible dead lock caused by ab->base_lock
wifi: ath11k: Fix QMI memory reuse logic
iommu/amd: Allow matching ACPI HID devices without matching UIDs
wifi: rtw89: leave idle mode when setting WEP encryption for AP mode
tcp: always seek for minimal rtt in tcp_rcv_rtt_update()
tcp: remove zero TCP TS samples for autotuning
tcp: fix initial tp->rcvq_space.space value for passive TS enabled flows
tcp: add receive queue awareness in tcp_rcv_space_adjust()
x86/sgx: Prevent attempts to reclaim poisoned pages
ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT
net: page_pool: Don't recycle into cache on PREEMPT_RT
xfrm: validate assignment of maximal possible SEQ number
net: atlantic: generate software timestamp just before the doorbell
pinctrl: armada-37xx: propagate error from armada_37xx_pmx_set_by_name()
pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get_direction()
bpf: Pass the same orig_call value to trampoline functions
net: stmmac: generate software timestamp just before the doorbell
pinctrl: armada-37xx: propagate error from armada_37xx_pmx_gpio_set_direction()
libbpf: Check bpf_map_skeleton link for NULL
pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get()
net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info
net: vertexcom: mse102x: Return code for mse102x_rx_pkt_spi
wireless: purelifi: plfxlc: fix memory leak in plfxlc_usb_wreq_asyn()
wifi: mac80211: do not offer a mesh path if forwarding is disabled
clk: rockchip: rk3036: mark ddrphy as critical
hid-asus: check ROG Ally MCU version and warn
wifi: iwlwifi: mvm: fix beacon CCK flag
f2fs: fix to bail out in get_new_segment()
netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX
libbpf: Add identical pointer detection to btf_dedup_is_equiv()
scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64 commands
scsi: smartpqi: Add new PCI IDs
iommu/amd: Ensure GA log notifier callbacks finish running before module unload
wifi: iwlwifi: pcie: make sure to lock rxq->read
wifi: rtw89: 8922a: fix TX fail with wrong VCO setting
wifi: mac80211_hwsim: Prevent tsf from setting if beacon is disabled
netdevsim: Mark NAPI ID on skb in nsim_rcv
net/mlx5: HWS, Fix IP version decision
bpf: Use proper type to calculate bpf_raw_tp_null_args.mask index
wifi: mac80211: VLAN traffic in multicast path
Revert "mac80211: Dynamically set CoDel parameters per station"
wifi: iwlwifi: Add missing MODULE_FIRMWARE for Qu-c0-jf-b0
net: bridge: mcast: update multicast contex when vlan state is changed
net: bridge: mcast: re-implement br_multicast_{enable, disable}_port functions
vxlan: Do not treat dst cache initialization errors as fatal
bnxt_en: Remove unused field "ref_count" in struct bnxt_ulp
wifi: ath12k: using msdu end descriptor to check for rx multicast packets
net: ethernet: ti: am65-cpsw: handle -EPROBE_DEFER
software node: Correct a OOB check in software_node_get_reference_args()
isofs: fix Y2038 and Y2156 issues in Rock Ridge TF entry
pinctrl: mcp23s08: Reset all pins to input at probe
wifi: ath12k: fix failed to set mhi state error during reboot with hardware grouping
scsi: lpfc: Use memcpy() for BIOS version
sock: Correct error checking condition for (assign|release)_proto_idx()
i40e: fix MMIO write access to an invalid page in i40e_clear_hw
ixgbe: Fix unreachable retry logic in combined and byte I2C write functions
RDMA/hns: initialize db in update_srq_db()
ice: fix check for existing switch rule
usbnet: asix AX88772: leave the carrier control to phylink
f2fs: fix to set atomic write status more clear
bpf, sockmap: Fix data lost during EAGAIN retries
net: ethernet: cortina: Use TOE/TSO on all TCP
octeontx2-pf: Add error log forcn10k_map_unmap_rq_policer()
wifi: ath11k: determine PM policy based on machine model
wifi: ath12k: fix link valid field initialization in the monitor Rx
wifi: ath12k: fix incorrect CE addresses
wifi: ath12k: Pass correct values of center freq1 and center freq2 for 160 MHz
net/mlx5: HWS, Harden IP version definer checks
fbcon: Make sure modelist not set on unregistered console
watchdog: da9052_wdt: respect TWDMIN
bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value
ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY
tee: Prevent size calculation wraparound on 32-bit kernels
Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first"
fs/xattr.c: fix simple_xattr_list()
platform/x86/amd: pmc: Clear metrics table at start of cycle
platform/x86/amd: pmf: Prevent amd_pmf_tee_deinit() from running twice
platform/x86: dell_rbu: Fix list usage
platform/x86: dell_rbu: Stop overwriting data buffer
powerpc/vdso: Fix build of VDSO32 with pcrel
powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH recovery
io_uring/kbuf: don't truncate end buffer for multiple buffer peeks
io_uring: fix task leak issue in io_wq_create()
drivers/rapidio/rio_cm.c: prevent possible heap overwrite
platform/loongarch: laptop: Get brightness setting from EC on probe
platform/loongarch: laptop: Unregister generic_sub_drivers on exit
platform/loongarch: laptop: Add backlight power control support
LoongArch: vDSO: Correctly use asm parameters in syscall wrappers
LoongArch: Avoid using $r0/$r1 as "mask" for csrxchg
LoongArch: Fix panic caused by NULL-PMD in huge_pte_offset()
jffs2: check that raw node were preallocated before writing summary
jffs2: check jffs2_prealloc_raw_node_refs() result in few other places
cifs: deal with the channel loading lag while picking channels
cifs: serialize other channels when query server interfaces is pending
cifs: do not disable interface polling on failure
smb: improve directory cache reuse for readdir operations
scsi: storvsc: Increase the timeouts to storvsc_timeout
scsi: s390: zfcp: Ensure synchronous unit_add
nvme: always punt polled uring_cmd end_io work to task_work
net_sched: sch_sfq: reject invalid perturb period
net: clear the dst when changing skb protocol
mm: close theoretical race where stale TLB entries could linger
udmabuf: use sgtable-based scatterlist wrappers
x86/virt/tdx: Avoid indirect calls to TDX assembly functions
selftests/x86: Add a test to detect infinite SIGTRAP handler loop
ksmbd: fix null pointer dereference in destroy_previous_session
platform/x86: ideapad-laptop: use usleep_range() for EC polling
selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len
platform/x86/intel-uncore-freq: Fail module load when plat_info is NULL
sched_ext, sched/core: Don't call scx_group_set_weight() prematurely from sched_create_group()
atm: Revert atm_account_tx() if copy_from_iter_full() fails.
wifi: rtw89: phy: add dummy C2H event handler for report of TAS power
cpufreq/amd-pstate: Add missing NULL ptr check in amd_pstate_update
Input: sparcspkr - avoid unannotated fall-through
wifi: ath12k: Clear affinity hint before calling ath12k_pci_free_irq() in error path
wifi: cfg80211: init wiphy_work before allocating rfkill fails
arm64: Restrict pagetable teardown to avoid false warning
ALSA: usb-audio: Rename ALSA kcontrol PCM and PCM1 for the KTMicro sound card
ALSA: hda/intel: Add Thinkpad E15 to PM deny list
ALSA: hda/realtek - Add mute LED support for HP Victus 16-s1xxx and HP Victus 15-fa1xxx
ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged
ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X513EA
ALSA: hda/realtek: Add quirk for Asus GU605C
iio: accel: fxls8962af: Fix temperature calculation
mm/hugetlb: unshare page tables during VMA split, not before
drm/amdgpu: read back register after written for VCN v4.0.5
kbuild: rust: add rustc-min-version support function
rust: compile libcore with edition 2024 for 1.87+
net: Fix checksum update for ILA adj-transport
bpf: Fix L4 csum update on IPv6 in CHECKSUM_COMPLETE
erofs: remove unused trace event erofs_destroy_inode
nfsd: use threads array as-is in netlink interface
sunrpc: handle SVC_GARBAGE during svc auth processing as auth error
drm/v3d: Avoid NULL pointer dereference in `v3d_job_update_stats()`
Kunit to check the longest symbol length
x86/tools: Drop duplicate unlikely() definition in insn_decoder_test.c
ipv6: remove leftover ip6 cookie initializer
ipv6: replace ipcm6_init calls with ipcm6_init_sk
smb: fix secondary channel creation issue with kerberos by populating hostname when adding channels
drm/msm/disp: Correct porch timing for SDM845
drm/msm/dsi/dsi_phy_10nm: Fix missing initial VCO rate
drm/msm: Fix CP_RESET_CONTEXT_STATE bitfield names
drm/msm/a7xx: Call CP_RESET_CONTEXT_STATE
drm/ssd130x: fix ssd132x_clear_screen() columns
ionic: Prevent driver/fw getting out of sync on devcmd(s)
drm/nouveau/bl: increase buffer size to avoid truncate warning
drm/i915/pmu: Fix build error with GCOV and AutoFDO enabled
hwmon: (occ) Rework attribute registration for stack usage
hwmon: (occ) fix unaligned accesses
hwmon: (ltc4282) avoid repeated register write
pldmfw: Select CRC32 when PLDMFW is selected
aoe: clean device rq_list in aoedev_downdev()
io_uring/sqpoll: don't put task_struct on tctx setup failure
net: ice: Perform accurate aRFS flow match
ice: fix eswitch code memory leak in reset scenario
e1000e: set fixed clock frequency indication for Nahum 11 and Nahum 13
workqueue: Initialize wq_isolated_cpumask in workqueue_init_early()
ksmbd: add free_transport ops in ksmbd connection
net: netmem: fix skb_ensure_writable with unreadable skbs
bnxt_en: Fix double invocation of bnxt_ulp_stop()/bnxt_ulp_start()
eth: bnxt: fix out-of-range access of vnic_info array
bnxt_en: Add a helper function to configure MRU and RSS
bnxt_en: Update MRU and RSS table of RSS contexts on queue reset
ptp: fix breakage after ptp_vclock_in_use() rework
ptp: allow reading of currently dialed frequency to succeed on free-running clocks
wifi: carl9170: do not ping device which has failed to load firmware
mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu().
atm: atmtcp: Free invalid length skb in atmtcp_c_send().
tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen() behavior
tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer
tcp: fix passive TFO socket having invalid NAPI ID
eth: fbnic: avoid double free when failing to DMA-map FW msg
net: lan743x: fix potential out-of-bounds write in lan743x_ptp_io_event_clock_get()
ublk: santizize the arguments from userspace when adding a device
drm/xe: Wire up device shutdown handler
drm/xe/gt: Update handling of xe_force_wake_get return
drm/xe/bmg: Update Wa_16023588340
calipso: Fix null-ptr-deref in calipso_req_{set,del}attr().
mlxbf_gige: return EPROBE_DEFER if PHY IRQ is not available
net: atm: add lec_mutex
net: atm: fix /proc/net/atm/lec handling
EDAC/amd64: Correct number of UMCs for family 19h models 70h-7fh
dt-bindings: i2c: nvidia,tegra20-i2c: Specify the required properties
smb: Log an error when close_all_cached_dirs fails
serial: sh-sci: Clean sci_ports[0] after at earlycon exit
serial: sh-sci: Increment the runtime usage counter for the earlycon device
smb: client: fix first command failure during re-negotiation
smb: client: fix max_sge overflow in smb_extract_folioq_to_rdma()
s390/pci: Fix __pcilg_mio_inuser() inline assembly
perf: Fix sample vs do_exit()
perf: Fix cgroup state vs ERROR
perf/core: Fix WARN in perf_cgroup_switch()
arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth()
scsi: elx: efct: Fix memory leak in efct_hw_parse_filter()
RISC-V: KVM: Fix the size parameter check in SBI SFENCE calls
RISC-V: KVM: Don't treat SBI HFENCE calls as NOPs
gpio: pca953x: fix wrong error probe return value
perf evsel: Missed close() when probing hybrid core PMUs
perf test: Directory file descriptor leak
gpio: mlxbf3: only get IRQ for device instance 0
cifs: Remove duplicate fattr->cf_dtype assignment from wsl_to_fattr() function
bpftool: Fix cgroup command to only show cgroup bpf programs
Linux 6.12.35
Change-Id: Ida57d269272a624bedb979bfad0b3c5e7df7e846
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
GKI (arm64) relevant 105 out of 506 changes, affecting 145 files +1290/-523
623074162b sched: Fix trace_sched_switch(.prev_state) [1 file, +4/-2]
781bbc8252 perf/core: Fix broken throttling when max_samples_per_tick=1 [1 file, +8/-8]
451a18d71b sched/core: Tweak wait_task_inactive() to force dequeue sched_delayed tasks [1 file, +6/-0]
5b814cde62 brd: fix aligned_sector from brd_do_discard() [1 file, +1/-1]
48e11bcee9 brd: fix discard end sector [1 file, +6/-3]
9cfca45aec erofs: fix file handle encoding for 64-bit NIDs [1 file, +36/-8]
65115472f7 erofs: avoid using multiple devices with different type [1 file, +4/-1]
58beaa1aee rcu/cpu_stall_cputime: fix the hardirq count for x86 architecture [3 files, +10/-6]
5ed92ad1b7 crypto: xts - Only add ecb if it is not already there [1 file, +2/-2]
e9ecaeaf41 kunit: Fix wrong parameter to kunit_deactivate_static_stub() [1 file, +1/-1]
9c094deb6b crypto: api - Redo lookup on EEXIST [1 file, +11/-2]
81d72f9241 PM: EM: Fix potential division-by-zero error in em_compute_costs() [1 file, +4/-0]
0426e92970 PM: wakeup: Delete space in the end of string shown by pm_show_wakelocks() [1 file, +3/-0]
77d45ba1be PM: sleep: Print PM debug messages during hibernation [3 files, +11/-1]
45844a9403 ALSA: core: fix up bus match const issues. [4 files, +8/-8]
fa65c89f3f arm64/fpsimd: Avoid RES0 bits in the SME trap handler [2 files, +9/-7]
6103f9ba51 arm64/fpsimd: Discard stale CPU state when handling SME traps [1 file, +2/-0]
945d247d1c arm64/fpsimd: Don't corrupt FPMR when streaming mode changes [1 file, +3/-3]
55d52af498 arm64/fpsimd: Avoid clobbering kernel FPSIMD state with SMSTOP [1 file, +1/-1]
2756dac036 arm64/fpsimd: Reset FPMR upon exec() [1 file, +3/-0]
f5ffc750db arm64/fpsimd: Fix merging of FPSIMD state during signal return [1 file, +1/-1]
0860d48b70 firmware: psci: Fix refcount leak in psci_dt_init [1 file, +3/-1]
64a9ee6e11 arm64/fpsimd: Avoid warning when sve_to_fpsimd() is unused [1 file, +2/-2]
b3cfc1f9f5 arm64/fpsimd: Do not discard modified SVE state [3 files, +47/-17]
e55f46a11b overflow: Fix direct struct member initialization in _DEFINE_FLEX() [1 file, +3/-3]
671dd1fb87 bpf: Check link_create.flags parameter for multi_kprobe [1 file, +3/-0]
3a8e680f7d bpf, sockmap: fix duplicated data transmission [1 file, +9/-5]
3d25fa2d7f bpf, sockmap: Fix panic when calling skb_linearize [1 file, +16/-15]
44a51592ac f2fs: zone: fix to avoid inconsistence in between SIT and SSA [1 file, +3/-0]
4f51fb0d25 page_pool: Track DMA-mapped pages and unmap them when destroying the pool [5 files, +147/-18]
88f65bb66d iommu: Protect against overflow in iommu_pgsize() [1 file, +3/-1]
04daca6012 f2fs: clean up w/ fscrypt_is_bounce_page() [1 file, +1/-1]
4248ba53e4 f2fs: fix to detect gcing page in f2fs_is_cp_guaranteed() [1 file, +1/-1]
c1f418cc27 bpf: Allow XDP dev-bound programs to perform XDP_REDIRECT into maps [1 file, +16/-11]
e53a8dcd36 tracing: Move histogram trigger variables from stack to per CPU structure [1 file, +105/-15]
69a995644a efi/libstub: Describe missing 'out' parameter in efi_load_initrd [1 file, +1/-0]
709412b92a tracing: Fix error handling in event_trigger_parse() [1 file, +2/-2]
c98cdf6795 bpf: Fix WARN() in get_bpf_raw_tp_regs [1 file, +1/-1]
e0657136ae scsi: ufs: mcq: Delete ufshcd_release_scsi_cmd() in ufshcd_mcq_abort() [1 file, +0/-6]
6bfb154f95 kernfs: Relax constraint in draining guard [2 files, +5/-3]
df00f9147e Bluetooth: ISO: Fix not using SID from adv report [5 files, +75/-14]
1d249cc92d bpf: Revert "bpf: remove unnecessary rcu_read_{lock,unlock}() in multi-uprobe attach logic" [1 file, +2/-0]
1750c3f1d9 Bluetooth: MGMT: iterate over mesh commands in mgmt_mesh_foreach() [1 file, +1/-1]
15c0250dae bpf, sockmap: Avoid using sk_socket after free when sending [1 file, +8/-0]
30a9e834c7 net: usb: aqc111: fix error handling of usbnet read calls [1 file, +8/-2]
7893a41dea vsock/virtio: fix `rx_bytes` accounting for stream sockets [2 files, +17/-10]
2bc6dffb4b bpf: Avoid __bpf_prog_ret0_warn when jit fails [1 file, +1/-1]
ddc654e89a net: phy: clear phydev->devlink when the link is deleted [1 file, +3/-1]
f15ed37dd3 net: phy: fix up const issues in to_mdio_device() and to_phy_device() [2 files, +2/-8]
532601e783 f2fs: use d_inode(dentry) cleanup dentry->d_inode [2 files, +6/-6]
0befc3005d f2fs: fix to correct check conditions in f2fs_cross_rename [1 file, +1/-1]
2eeb181e76 dm: don't change md if dm_table_set_restrictions() fails [1 file, +12/-10]
48e0b54be4 dm: free table mempools if not used in __bind [1 file, +4/-4]
17e4b0fcd2 PCI: Print the actual delay time in pci_bridge_wait_for_secondary_bus() [1 file, +1/-1]
0a3e2ec508 PCI: endpoint: Retain fixed-size BAR size as well as aligned size [2 files, +18/-7]
9f40ae8310 USB: gadget: udc: fix const issue in gadget_match_driver() [1 file, +1/-1]
4bd30962f3 USB: typec: fix const issue in typec_match() [1 file, +1/-1]
3091d4c0d0 loop: add file_start_write() and file_end_write() [1 file, +6/-2]
90891eadb8 Fix sock_exceed_buf_limit not being triggered in __sk_mem_raise_allocated [1 file, +4/-4]
e869a85acc page_pool: Fix use-after-free in page_pool_recycle_in_ring [1 file, +14/-13]
c762fc79d7 net: tipc: fix refcount warning in tipc_aead_encrypt [1 file, +5/-1]
b788cebf72 Bluetooth: L2CAP: Fix not responding with L2CAP_CR_LE_ENCRYPTION [1 file, +2/-1]
4399f59a94 net: fix udp gso skb_segment after pull from frag_list [1 file, +5/-0]
0cffc6e40d PM: sleep: Fix power.is_suspended cleanup for direct-complete devices [1 file, +2/-1]
f34dc858e6 netfilter: nf_nat: also check reverse tuple to obtain clashing entry [1 file, +9/-3]
4f0fcdb835 wifi: cfg80211/mac80211: correctly parse S1G beacon optional elements [4 files, +83/-32]
933466fc50 wireguard: device: enable threaded NAPI [1 file, +1/-0]
1be1f3b848 iov_iter: use iov_offset for length calculation in iov_iter_aligned_bvec [1 file, +1/-1]
1d79230719 path_overmount(): avoid false negatives [1 file, +13/-6]
e1d02fe504 fix propagation graph breakage by MOVE_MOUNT_SET_GROUP move_mount(2) [1 file, +1/-1]
9c1ddfeb66 do_change_type(): refuse to operate on unmounted/not ours mounts [1 file, +4/-0]
80f7c5be4f pmdomain: core: Introduce dev_pm_genpd_rpm_always_on() [2 files, +42/-0]
3464a707d1 scsi: core: ufs: Fix a hang in the error handler [1 file, +6/-1]
99e3d69853 Bluetooth: hci_core: fix list_for_each_entry_rcu usage [1 file, +3/-8]
9df3e5e7f7 Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete [3 files, +12/-30]
84ab1283eb Bluetooth: MGMT: Remove unused mgmt_pending_find_data [2 files, +0/-21]
4e83f2dbb2 Bluetooth: MGMT: Protect mgmt_pending list with its own lock [5 files, +80/-59]
d1bc80da75 net_sched: sch_sfq: fix a potential crash on gso_skb handling [1 file, +4/-1]
1e0de7582c net: Fix TOCTOU issue in sk_is_readable() [1 file, +5/-2]
78fa7b723e macsec: MACsec SCI assignment for ES = 0 [1 file, +34/-6]
b02d9d2732 net/mdiobus: Fix potential out-of-bounds read/write access [1 file, +6/-0]
31bf7b2b92 net/mdiobus: Fix potential out-of-bounds clause 45 read/write access [1 file, +6/-0]
842f7c3154 Bluetooth: Fix NULL pointer deference on eir_get_service_data [1 file, +6/-4]
907ef6e12f Bluetooth: hci_sync: Fix broadcast/PA when using an existing instance [1 file, +15/-5]
2af40d795d Bluetooth: eir: Fix possible crashes on eir_create_adv_data [3 files, +8/-6]
7a41744e38 Bluetooth: MGMT: Fix sparse errors [1 file, +2/-2]
e3f6745006 net_sched: prio: fix a race in prio_tune() [1 file, +1/-1]
180b12eafa net_sched: tbf: fix a race in tbf_change() [1 file, +1/-1]
0a2500782f fs/filesystems: Fix potential unsigned integer underflow in fs_name() [1 file, +9/-5]
f351bb3085 perf: Ensure bpf_perf_link path is properly serialized [1 file, +30/-4]
a5c7b61eed block: use q->elevator with ->elevator_lock held in elv_iosched_show() [1 file, +1/-2]
af8c13f9ee io_uring: fix use-after-free of sq->thread in __io_uring_show_fdinfo() [2 files, +14/-7]
0fccb6773b block: don't use submit_bio_noacct_nocheck in blk_zone_wplug_bio_work [1 file, +5/-2]
48f33ec141 io_uring: consistently use rcu semantics with sqpoll thread [4 files, +38/-15]
a9022c8631 bio: Fix bio_first_folio() for SPARSEMEM without VMEMMAP [1 file, +1/-1]
4b1ef15ffd block: Fix bvec_set_folio() for very large folios [1 file, +5/-2]
84e9f0a2c2 ALSA: usb-audio: Add implicit feedback quirk for RODE AI-1 [1 file, +1/-0]
c29d531870 posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() [1 file, +9/-0]
657003ced7 usb: Flush altsetting 0 endpoints before reinitializating them after reset. [1 file, +14/-2]
7bdd712abe usb: typec: tcpm: move tcpm_queue_vdm_unlocked to asynchronous work [1 file, +71/-20]
b8df8cb8f7 ring-buffer: Do not trigger WARN_ON() due to a commit_overrun [1 file, +18/-8]
e09c0600be ring-buffer: Fix buffer locking in ring_buffer_subbuf_order_set() [1 file, +1/-3]
2d6a6cfe96 ring-buffer: Move cpus_read_lock() outside of buffer->mutex [1 file, +6/-5]
5ed1d7a700 net: usb: aqc111: debug info before sanitation [1 file, +4/-4]
ab20b0bdb0 overflow: Introduce __DEFINE_FLEX for having no initializer [1 file, +19/-6]
Changes in 6.12.34
tools/x86/kcpuid: Fix error handling
x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt()
crypto: sun8i-ce-hash - fix error handling in sun8i_ce_hash_run()
sched: Fix trace_sched_switch(.prev_state)
perf/x86/amd/uncore: Remove unused 'struct amd_uncore_ctx::node' member
perf/x86/amd/uncore: Prevent UMC counters from saturating
gfs2: replace sd_aspace with sd_inode
gfs2: gfs2_create_inode error handling fix
perf/core: Fix broken throttling when max_samples_per_tick=1
crypto: sun8i-ce-cipher - fix error handling in sun8i_ce_cipher_prepare()
crypto: sun8i-ss - do not use sg_dma_len before calling DMA functions
powerpc: do not build ppc_save_regs.o always
powerpc/crash: Fix non-smp kexec preparation
sched/core: Tweak wait_task_inactive() to force dequeue sched_delayed tasks
x86/microcode/AMD: Do not return error when microcode update is not necessary
crypto: sun8i-ce - undo runtime PM changes during driver removal
x86/cpu: Sanitize CPUID(0x80000000) output
x86/insn: Fix opcode map (!REX2) superscript tags
brd: fix aligned_sector from brd_do_discard()
brd: fix discard end sector
kselftest: cpufreq: Get rid of double suspend in rtcwake case
crypto: marvell/cesa - Handle zero-length skcipher requests
crypto: marvell/cesa - Avoid empty transfer descriptor
erofs: fix file handle encoding for 64-bit NIDs
erofs: avoid using multiple devices with different type
powerpc/pseries/iommu: Fix kmemleak in TCE table userspace view
btrfs: scrub: update device stats when an error is detected
btrfs: scrub: fix a wrong error type when metadata bytenr mismatches
btrfs: fix invalid data space release when truncating block in NOCOW mode
rcu/cpu_stall_cputime: fix the hardirq count for x86 architecture
crypto: lrw - Only add ecb if it is not already there
crypto: xts - Only add ecb if it is not already there
crypto: sun8i-ce - move fallback ahash_request to the end of the struct
kunit: Fix wrong parameter to kunit_deactivate_static_stub()
crypto: api - Redo lookup on EEXIST
ACPICA: exserial: don't forget to handle FFixedHW opregions for reading
ASoC: tas2764: Enable main IRQs
ASoC: mediatek: mt8195: Set ETDM1/2 IN/OUT to COMP_DUMMY()
EDAC/skx_common: Fix general protection fault
EDAC/{skx_common,i10nm}: Fix the loss of saved RRL for HBM pseudo channel 0
spi: tegra210-quad: Fix X1_X2_X4 encoding and support x4 transfers
spi: tegra210-quad: remove redundant error handling code
spi: tegra210-quad: modify chip select (CS) deactivation
power: reset: at91-reset: Optimize at91_reset()
PM: EM: Fix potential division-by-zero error in em_compute_costs()
ASoC: SOF: ipc4-pcm: Adjust pipeline_list->pipelines allocation type
ASoC: SOF: amd: add missing acp descriptor field
PM: wakeup: Delete space in the end of string shown by pm_show_wakelocks()
ACPI: resource: fix a typo for MECHREVO in irq1_edge_low_force_override[]
x86/mtrr: Check if fixed-range MTRRs exist in mtrr_save_fixed_ranges()
PM: sleep: Print PM debug messages during hibernation
thermal/drivers/mediatek/lvts: Fix debugfs unregister on failure
ACPI: OSI: Stop advertising support for "3.0 _SCP Extensions"
spi: sh-msiof: Fix maximum DMA transfer size
ASoC: apple: mca: Constrain channels according to TDM mask
ALSA: core: fix up bus match const issues.
drm/vmwgfx: Add seqno waiter for sync_files
drm/vmwgfx: Add error path for xa_store in vmw_bo_add_detached_resource
drm/vmwgfx: Fix dumb buffer leak
drm/xe/d3cold: Set power state to D3Cold during s2idle/s3
drm/vc4: tests: Use return instead of assert
drm/amd/pp: Fix potential NULL pointer dereference in atomctrl_initialize_mc_reg_table
media: rkvdec: Fix frame size enumeration
arm64/fpsimd: Avoid RES0 bits in the SME trap handler
arm64/fpsimd: Discard stale CPU state when handling SME traps
arm64/fpsimd: Don't corrupt FPMR when streaming mode changes
arm64/fpsimd: Avoid clobbering kernel FPSIMD state with SMSTOP
arm64/fpsimd: Reset FPMR upon exec()
arm64/fpsimd: Fix merging of FPSIMD state during signal return
drm/panthor: Fix GPU_COHERENCY_ACE[_LITE] definitions
drm/panthor: Update panthor_mmu::irq::mask when needed
perf: arm-ni: Unregister PMUs on probe failure
perf: arm-ni: Fix missing platform_set_drvdata()
drm/panel: samsung-sofef00: Drop s6e3fc2x01 support
drm/bridge: lt9611uxc: Fix an error handling path in lt9611uxc_probe()
fs/ntfs3: handle hdr_first_de() return value
fs/ntfs3: Add missing direct_IO in ntfs_aops_cmpr
kunit/usercopy: Disable u64 test on 32-bit SPARC
watchdog: exar: Shorten identity name to fit correctly
m68k: mac: Fix macintosh_config for Mac II
firmware: psci: Fix refcount leak in psci_dt_init
arm64: Support ARM64_VA_BITS=52 when setting ARCH_MMAP_RND_BITS_MAX
arm64/fpsimd: Avoid warning when sve_to_fpsimd() is unused
selftests/seccomp: fix syscall_restart test for arm compat
drm/msm/dpu: enable SmartDMA on SM8150
drm/msm/dpu: enable SmartDMA on SC8180X
drm: rcar-du: Fix memory leak in rcar_du_vsps_init()
drm/vkms: Adjust vkms_state->active_planes allocation type
drm/tegra: rgb: Fix the unbound reference count
firmware: SDEI: Allow sdei initialization without ACPI_APEI_GHES
arm64/fpsimd: Do not discard modified SVE state
overflow: Fix direct struct member initialization in _DEFINE_FLEX()
scsi: qedf: Use designated initializer for struct qed_fcoe_cb_ops
perf/amlogic: Replace smp_processor_id() with raw_smp_processor_id() in meson_ddr_pmu_create()
selftests/seccomp: fix negative_ENOSYS tracer tests on arm32
drm/msm/a6xx: Disable rgb565_predicator on Adreno 7c3
drm/mediatek: mtk_drm_drv: Fix kobject put for mtk_mutex device ptr
drm/mediatek: Fix kobject put for component sub-drivers
drm/mediatek: mtk_drm_drv: Unbind secondary mmsys components on err
media: verisilicon: Free post processor buffers on error
svcrdma: Reduce the number of rdma_rw contexts per-QP
xen/x86: fix initial memory balloon target
wifi: ath11k: fix node corruption in ar->arvifs list
wifi: ath12k: Fix memory leak during vdev_id mismatch
wifi: ath12k: Fix invalid memory access while forming 802.11 header
IB/cm: use rwlock for MAD agent lock
bpf: Check link_create.flags parameter for multi_kprobe
selftests/bpf: Fix bpf_nf selftest failure
bpf: fix ktls panic with sockmap
bpf, sockmap: fix duplicated data transmission
bpf, sockmap: Fix panic when calling skb_linearize
f2fs: zone: fix to avoid inconsistence in between SIT and SSA
wifi: ath12k: fix cleanup path after mhi init
wifi: ath12k: Fix WMI tag for EHT rate in peer assoc
wifi: ath12k: Fix buffer overflow in debugfs
f2fs: clean up unnecessary indentation
f2fs: prevent the current section from being selected as a victim during GC
f2fs: fix to do sanity check on sbi->total_valid_block_count
page_pool: Move pp_magic check into helper functions
page_pool: Track DMA-mapped pages and unmap them when destroying the pool
net: ncsi: Fix GCPS 64-bit member variables
libbpf: Fix buffer overflow in bpf_object__init_prog
net/mlx5: Avoid using xso.real_dev unnecessarily
xfrm: Use xdo.dev instead of xdo.real_dev
wifi: rtw88: sdio: map mgmt frames to queue TX_DESC_QSEL_MGMT
wifi: rtw88: sdio: call rtw_sdio_indicate_tx_status unconditionally
wifi: rtw88: do not ignore hardware read error during DPK
wifi: ath12k: fix invalid access to memory
wifi: ath12k: Add MSDU length validation for TKIP MIC error
wifi: ath12k: Fix the QoS control field offset to build QoS header
wifi: ath12k: fix node corruption in ar->arvifs list
RDMA/hns: Include hnae3.h in hns_roce_hw_v2.h
scsi: hisi_sas: Call I_T_nexus after soft reset for SATA disk
libbpf: Fix event name too long error
libbpf: Remove sample_period init in perf_buffer
Use thread-safe function pointer in libbpf_print
iommu: Protect against overflow in iommu_pgsize()
bonding: assign random address if device address is same as bond
f2fs: clean up w/ fscrypt_is_bounce_page()
f2fs: fix to detect gcing page in f2fs_is_cp_guaranteed()
scsi: smartpqi: Fix smp_processor_id() call trace for preemptible kernels
libbpf: Use proper errno value in linker
bpf: Allow XDP dev-bound programs to perform XDP_REDIRECT into maps
netfilter: bridge: Move specific fragmented packet to slow_path instead of dropping it
netfilter: nft_quota: match correctly when the quota just depleted
netfilter: nft_set_pipapo: prevent overflow in lookup table allocation
RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction
bpf: Fix uninitialized values in BPF_{CORE,PROBE}_READ
tracing: Move histogram trigger variables from stack to per CPU structure
clk: qcom: camcc-sm6350: Add *_wait_val values for GDSCs
clk: qcom: dispcc-sm6350: Add *_wait_val values for GDSCs
clk: qcom: gcc-sm6350: Add *_wait_val values for GDSCs
clk: qcom: gpucc-sm6350: Add *_wait_val values for GDSCs
bpftool: Fix regression of "bpftool cgroup tree" EINVAL on older kernels
clk: bcm: rpi: Add NULL check in raspberrypi_clk_register()
wifi: iwlfiwi: mvm: Fix the rate reporting
efi/libstub: Describe missing 'out' parameter in efi_load_initrd
selftests/bpf: Fix caps for __xlated/jited_unpriv
tracing: Rename event_trigger_alloc() to trigger_data_alloc()
tracing: Fix error handling in event_trigger_parse()
of: unittest: Unlock on error in unittest_data_add()
ktls, sockmap: Fix missing uncharge operation
libbpf: Use proper errno value in nlattr
pinctrl: at91: Fix possible out-of-boundary access
bpf: Fix WARN() in get_bpf_raw_tp_regs
dt-bindings: soc: fsl,qman-fqd: Fix reserved-memory.yaml reference
clk: qcom: gcc-msm8939: Fix mclk0 & mclk1 for 24 MHz
s390/bpf: Store backchain even for leaf progs
wifi: rtw89: pci: enlarge retry times of RX tag to 1000
wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds
wifi: rtw89: fix firmware scan delay unit for WiFi 6 chips
iommu: remove duplicate selection of DMAR_TABLE
wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event
hisi_acc_vfio_pci: fix XQE dma address error
hisi_acc_vfio_pci: add eq and aeq interruption restore
hisi_acc_vfio_pci: bugfix live migration function without VF device driver
wifi: ath9k_htc: Abort software beacon handling if disabled
scsi: ufs: mcq: Delete ufshcd_release_scsi_cmd() in ufshcd_mcq_abort()
kernfs: Relax constraint in draining guard
Bluetooth: ISO: Fix not using SID from adv report
wifi: mt76: mt7996: Fix null-ptr-deref in mt7996_mmio_wed_init()
wifi: mt76: mt7915: Fix null-ptr-deref in mt7915_mmio_wed_init()
wifi: mt76: mt7925: prevent multiple scan commands
wifi: mt76: mt7925: refine the sniffer commnad
wifi: mt76: mt7925: ensure all MCU commands wait for response
wifi: mt76: mt7996: set EHT max ampdu length capability
wifi: mt76: mt7996: fix RX buffer size of MCU event
bpf: Revert "bpf: remove unnecessary rcu_read_{lock,unlock}() in multi-uprobe attach logic"
netfilter: xtables: support arpt_mark and ipv6 optstrip for iptables-nft only builds
netfilter: nf_tables: nft_fib_ipv6: fix VRF ipv4/ipv6 result discrepancy
vfio/type1: Fix error unwind in migration dirty bitmap allocation
Bluetooth: MGMT: iterate over mesh commands in mgmt_mesh_foreach()
Bluetooth: btintel: Check dsbr size from EFI variable
bpf, sockmap: Avoid using sk_socket after free when sending
netfilter: nf_tables: nft_fib: consistent l3mdev handling
netfilter: nft_tunnel: fix geneve_opt dump
RISC-V: KVM: lock the correct mp_state during reset
net: usb: aqc111: fix error handling of usbnet read calls
vsock/virtio: fix `rx_bytes` accounting for stream sockets
RDMA/cma: Fix hang when cma_netevent_callback fails to queue_work
net: lan966x: Fix 1-step timestamping over ipv4 or ipv6
net: xilinx: axienet: Fix Tx skb circular buffer occupancy check in dmaengine xmit
bpf: Avoid __bpf_prog_ret0_warn when jit fails
net: phy: clear phydev->devlink when the link is deleted
net: phy: fix up const issues in to_mdio_device() and to_phy_device()
net: lan743x: rename lan743x_reset_phy to lan743x_hw_reset_phy
net: lan743x: Fix PHY reset handling during initialization and WOL
net: phy: mscc: Fix memory leak when using one step timestamping
octeontx2-pf: QOS: Perform cache sync on send queue teardown
octeontx2-pf: QOS: Refactor TC_HTB_LEAF_DEL_LAST callback
calipso: Don't call calipso functions for AF_INET sk.
net: openvswitch: Fix the dead loop of MPLS parse
net: phy: mscc: Stop clearing the the UDPv4 checksum for L2 frames
f2fs: use d_inode(dentry) cleanup dentry->d_inode
f2fs: fix to correct check conditions in f2fs_cross_rename
arm64: dts: qcom: x1e80100: Mark usb_2 as dma-coherent
arm64: dts: qcom: sm8650: setup gpu thermal with higher temperatures
arm64: dts: qcom: sm8650: add missing cpu-cfg interconnect path in the mdss node
arm64: dts: qcom: x1e80100-romulus: Keep L12B and L15B always on
arm64: dts: qcom: sdm845-starqltechn: remove wifi
arm64: dts: qcom: sdm845-starqltechn: fix usb regulator mistake
arm64: dts: qcom: sdm845-starqltechn: refactor node order
arm64: dts: qcom: sdm845-starqltechn: remove excess reserved gpios
arm64: dts: qcom: sm8350: Reenable crypto & cryptobam
arm64: dts: qcom: sm8250: Fix CPU7 opp table
arm64: dts: qcom: sc8280xp-x13s: Drop duplicate DMIC supplies
arm64: dts: qcom: ipq9574: Fix USB vdd info
arm64: dts: rockchip: Move SHMEM memory to reserved memory on rk3588
ARM: dts: at91: usb_a9263: fix GPIO for Dataflash chip select
ARM: dts: at91: at91sam9263: fix NAND chip selects
arm64: dts: mediatek: mt8195: Reparent vdec1/2 and venc1 power domains
arm64: dts: qcom: sdm660-xiaomi-lavender: Add missing SD card detect GPIO
arm64: dts: mt8183: Add port node to mt8183.dtsi
arm64: dts: imx8mm-beacon: Fix RTC capacitive load
arm64: dts: imx8mn-beacon: Fix RTC capacitive load
arm64: dts: imx8mp-beacon: Fix RTC capacitive load
arm64: dts: imx8mm-beacon: Set SAI5 MCLK direction to output for HDMI audio
arm64: dts: imx8mn-beacon: Set SAI5 MCLK direction to output for HDMI audio
arm64: dts: mediatek: mt6357: Drop regulator-fixed compatibles
arm64: dts: mt6359: Add missing 'compatible' property to regulators node
arm64: dts: qcom: sdm660-lavender: Add missing USB phy supply
arm64: dts: qcom: sda660-ifc6560: Fix dt-validate warning
arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3566-rock3c
arm64: dts: rockchip: Update eMMC for NanoPi R5 series
arm64: tegra: Drop remaining serial clock-names and reset-names
arm64: tegra: Add uartd serial alias for Jetson TX1 module
arm64: dts: ti: k3-j721e-common-proc-board: Enable OSPI1 on J721E
soc: qcom: smp2p: Fix fallback to qcom,ipc parse
Squashfs: check return result of sb_min_blocksize
ocfs2: fix possible memory leak in ocfs2_finish_quota_recovery
nilfs2: add pointer check for nilfs_direct_propagate()
nilfs2: do not propagate ENOENT error from nilfs_btree_propagate()
bus: fsl-mc: fix double-free on mc_dev
dt-bindings: vendor-prefixes: Add Liontron name
ARM: dts: qcom: apq8064: add missing clocks to the timer node
ARM: dts: qcom: apq8064 merge hw splinlock into corresponding syscon device
ARM: dts: qcom: apq8064: move replicator out of soc node
arm64: defconfig: mediatek: enable PHY drivers
arm64: dts: rockchip: disable unrouted USB controllers and PHY on RK3399 Puma with Haikou
arm64: dts: qcom: qcm2290: fix (some) of QUP interconnects
arm64: dts: renesas: white-hawk-ard-audio: Fix TPU0 groups
arm64: dts: mt6359: Rename RTC node to match binding expectations
ARM: aspeed: Don't select SRAM
soc: aspeed: lpc: Fix impossible judgment condition
soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop()
fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod()
randstruct: gcc-plugin: Remove bogus void member
randstruct: gcc-plugin: Fix attribute addition
perf build: Warn when libdebuginfod devel files are not available
perf ui browser hists: Set actions->thread before calling do_zoom_thread()
dm: don't change md if dm_table_set_restrictions() fails
dm: free table mempools if not used in __bind
backlight: pm8941: Add NULL check in wled_configure()
x86/irq: Ensure initial PIR loads are performed exactly once
mtd: nand: ecc-mxic: Fix use of uninitialized variable ret
hwmon: (asus-ec-sensors) check sensor index in read_string()
perf symbol-minimal: Fix double free in filename__read_build_id
dm: fix dm_blk_report_zones
dm-flakey: error all IOs when num_features is absent
dm-flakey: make corrupting read bios work
perf trace: Fix leaks of 'struct thread' in set_filter_loop_pids()
perf tests: Fix 'perf report' tests installation
perf intel-pt: Fix PEBS-via-PT data_src
perf scripts python: exported-sql-viewer.py: Fix pattern matching with Python 3
remoteproc: qcom_wcnss_iris: Add missing put_device() on error in probe
remoteproc: k3-r5: Drop check performed in k3_r5_rproc_{mbox_callback/kick}
remoteproc: k3-dsp: Drop check performed in k3_dsp_rproc_{mbox_callback/kick}
rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send()
mfd: exynos-lpass: Fix an error handling path in exynos_lpass_probe()
mfd: exynos-lpass: Avoid calling exynos_lpass_disable() twice in exynos_lpass_remove()
mfd: stmpe-spi: Correct the name used in MODULE_DEVICE_TABLE
perf tests switch-tracking: Fix timestamp comparison
mailbox: imx: Fix TXDB_V2 sending
mailbox: mtk-cmdq: Refine GCE_GCTL_VALUE setting
perf symbol: Fix use-after-free in filename__read_build_id
perf record: Fix incorrect --user-regs comments
perf trace: Always print return value for syscalls returning a pid
nfs: clear SB_RDONLY before getting superblock
nfs: ignore SB_RDONLY when remounting nfs
perf trace: Set errpid to false for rseq and set_robust_list
perf callchain: Always populate the addr_location map when adding IP
cifs: Fix validation of SMB1 query reparse point response
rust: alloc: add missing invariant in Vec::set_len()
rtc: sh: assign correct interrupts with DT
phy: rockchip: samsung-hdptx: Fix clock ratio setup
phy: rockchip: samsung-hdptx: Do no set rk_hdptx_phy->rate in case of errors
PCI: Print the actual delay time in pci_bridge_wait_for_secondary_bus()
PCI: rcar-gen4: set ep BAR4 fixed size
PCI: cadence: Fix runtime atomic count underflow
PCI: apple: Use gpiod_set_value_cansleep in probe flow
phy: qcom-qmp-usb: Fix an NULL vs IS_ERR() bug
dmaengine: ti: Add NULL check in udma_probe()
PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root()
PCI/DPC: Initialize aer_err_info before using it
PCI/DPC: Log Error Source ID only when valid
rtc: loongson: Add missing alarm notifications for ACPI RTC events
PCI: endpoint: Retain fixed-size BAR size as well as aligned size
usb: renesas_usbhs: Reorder clock handling and power management in probe
serial: Fix potential null-ptr-deref in mlb_usio_probe()
thunderbolt: Fix a logic error in wake on connect
iio: filter: admv8818: fix band 4, state 15
iio: filter: admv8818: fix integer overflow
iio: filter: admv8818: fix range calculation
iio: filter: admv8818: Support frequencies >= 2^32
iio: adc: ad7124: Fix 3dB filter frequency reading
usb: acpi: Prevent null pointer dereference in usb_acpi_add_usb4_devlink()
MIPS: Loongson64: Add missing '#interrupt-cells' for loongson64c_ls7a
coresight: Fixes device's owner field for registered using coresight_init_driver()
coresight: catu: Introduce refcount and spinlock for enabling/disabling
counter: interrupt-cnt: Protect enable/disable OPs with mutex
fpga: fix potential null pointer deref in fpga_mgr_test_img_load_sgt()
coresight: prevent deactivate active config while enabling the config
vt: remove VT_RESIZE and VT_RESIZEX from vt_compat_ioctl()
mei: vsc: Cast tx_buf to (__be32 *) when passed to cpu_to_be32_array()
iio: adc: PAC1934: fix typo in documentation link
iio: adc: mcp3911: fix device dependent mappings for conversion result registers
USB: gadget: udc: fix const issue in gadget_match_driver()
USB: typec: fix const issue in typec_match()
loop: add file_start_write() and file_end_write()
drm/xe: Make xe_gt_freq part of the Documentation
Fix sock_exceed_buf_limit not being triggered in __sk_mem_raise_allocated
page_pool: Fix use-after-free in page_pool_recycle_in_ring
net: stmmac: platform: guarantee uniqueness of bus_id
gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt
net: tipc: fix refcount warning in tipc_aead_encrypt
driver: net: ethernet: mtk_star_emac: fix suspend/resume issue
net/mlx4_en: Prevent potential integer overflow calculating Hz
net: lan966x: Make sure to insert the vlan tags also in host mode
spi: bcm63xx-spi: fix shared reset
spi: bcm63xx-hsspi: fix shared reset
Bluetooth: L2CAP: Fix not responding with L2CAP_CR_LE_ENCRYPTION
ice: fix Tx scheduler error handling in XDP callback
ice: create new Tx scheduler nodes for new queues only
ice: fix rebuilding the Tx scheduler tree for large queue counts
idpf: fix a race in txq wakeup
idpf: avoid mailbox timeout delays during reset
net: dsa: tag_brcm: legacy: fix pskb_may_pull length
net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping
net: stmmac: make sure that ptp_rate is not 0 before configuring EST
drm/i915/guc: Check if expecting reply before decrementing outstanding_submission_g2h
drm/i915/psr: Fix using wrong mask in REG_FIELD_PREP
drm/i915/guc: Handle race condition where wakeref count drops below 0
net: fix udp gso skb_segment after pull from frag_list
net: wwan: t7xx: Fix napi rx poll issue
vmxnet3: correctly report gso type for UDP tunnels
selftests: net: build net/lib dependency in all target
PM: sleep: Fix power.is_suspended cleanup for direct-complete devices
nvme: fix command limits status code
gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO
drm/panel-simple: fix the warnings for the Evervision VGG644804
netfilter: nf_set_pipapo_avx2: fix initial map fill
netfilter: nf_nat: also check reverse tuple to obtain clashing entry
net: ti: icssg-prueth: Fix swapped TX stats for MII interfaces.
net: dsa: b53: do not enable RGMII delay on bcm63xx
net: dsa: b53: allow RGMII for bcm63xx RGMII ports
net: dsa: b53: do not touch DLL_IQQD on bcm53115
wifi: cfg80211/mac80211: correctly parse S1G beacon optional elements
net: wwan: mhi_wwan_mbim: use correct mux_id for multiplexing
wireguard: device: enable threaded NAPI
seg6: Fix validation of nexthop addresses
riscv: misaligned: fix sleeping function called during misaligned access handling
scsi: ufs: qcom: Prevent calling phy_exit() before phy_init()
ASoC: codecs: hda: Fix RPM usage count underflow
ASoC: Intel: avs: Fix deadlock when the failing IPC is SET_D0IX
ASoC: Intel: avs: Verify content returned by parse_int_array()
ASoC: ti: omap-hdmi: Re-add dai_link->platform to fix card init
iov_iter: use iov_offset for length calculation in iov_iter_aligned_bvec
path_overmount(): avoid false negatives
fix propagation graph breakage by MOVE_MOUNT_SET_GROUP move_mount(2)
do_change_type(): refuse to operate on unmounted/not ours mounts
tools/power turbostat: Fix AMD package-energy reporting
ALSA: hda/realtek: fix micmute LEDs on HP Laptops with ALC3315
ALSA: hda/realtek: fix micmute LEDs on HP Laptops with ALC3247
ALSA: hda/realtek: Add support for various HP Laptops using CS35L41 HDA
ALSA: hda/realtek - Support mute led function for HP platform
ALSA: hda/realtek - Add new HP ZBook laptop with micmute led fixup
ALSA: hda/realtek: Add support for HP Agusta using CS35L41 HDA
Input: synaptics-rmi - fix crash with unsupported versions of F34
pmdomain: core: Introduce dev_pm_genpd_rpm_always_on()
mmc: sdhci-of-dwcmshc: add PD workaround on RK3576
arm64: dts: qcom: x1e80100: Apply consistent critical thermal shutdown
arm64: dts: qcom: x1e80100: Add GPU cooling
pinctrl: samsung: refactor drvdata suspend & resume callbacks
pinctrl: samsung: add dedicated SoC eint suspend/resume callbacks
pinctrl: samsung: add gs101 specific eint suspend/resume callbacks
dt-bindings: pwm: adi,axi-pwmgen: Increase #pwm-cells to 3
dt-bindings: pwm: Correct indentation and style in DTS example
dt-bindings: pwm: adi,axi-pwmgen: Fix clocks
serial: sh-sci: Move runtime PM enable to sci_probe_single()
scsi: core: ufs: Fix a hang in the error handler
Bluetooth: hci_core: fix list_for_each_entry_rcu usage
Bluetooth: btintel_pcie: Fix driver not posting maximum rx buffers
Bluetooth: btintel_pcie: Increase the tx and rx descriptor count
Bluetooth: btintel_pcie: Reduce driver buffer posting to prevent race condition
Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete
Bluetooth: MGMT: Remove unused mgmt_pending_find_data
Bluetooth: MGMT: Protect mgmt_pending list with its own lock
net: dsa: b53: fix untagged traffic sent via cpu tagged with VID 0
ptp: remove ptp->n_vclocks check logic in ptp_vclock_in_use()
ath10k: snoc: fix unbalanced IRQ enable in crash recovery
wifi: ath11k: convert timeouts to secs_to_jiffies()
wifi: ath11k: avoid burning CPU in ath11k_debugfs_fw_stats_request()
wifi: ath11k: don't use static variables in ath11k_debugfs_fw_stats_process()
wifi: ath11k: don't wait when there is no vdev started
wifi: ath11k: move some firmware stats related functions outside of debugfs
wifi: ath11k: validate ath11k_crypto_mode on top of ath11k_core_qmi_firmware_ready
wifi: ath12k: refactor ath12k_hw_regs structure
wifi: ath12k: fix GCC_GCC_PCIE_HOT_RST definition for WCN7850
regulator: max20086: Fix refcount leak in max20086_parse_regulators_dt()
spi: omap2-mcspi: Disable multi mode when CS should be kept asserted after message
spi: omap2-mcspi: Disable multi-mode when the previous message kept CS asserted
pinctrl: qcom: pinctrl-qcm2290: Add missing pins
scsi: iscsi: Fix incorrect error path labels for flashnode operations
net_sched: sch_sfq: fix a potential crash on gso_skb handling
powerpc/powernv/memtrace: Fix out of bounds issue in memtrace mmap
powerpc/vas: Return -EINVAL if the offset is non-zero in mmap()
drm/meson: use unsigned long long / Hz for frequency types
drm/meson: fix debug log statement when setting the HDMI clocks
drm/meson: use vclk_freq instead of pixel_freq in debug print
drm/meson: fix more rounding issues with 59.94Hz modes
i40e: return false from i40e_reset_vf if reset is in progress
i40e: retry VFLR handling if there is ongoing VF reset
ACPI: CPPC: Fix NULL pointer dereference when nosmp is used
net: Fix TOCTOU issue in sk_is_readable()
macsec: MACsec SCI assignment for ES = 0
net/mdiobus: Fix potential out-of-bounds read/write access
net/mdiobus: Fix potential out-of-bounds clause 45 read/write access
Bluetooth: Fix NULL pointer deference on eir_get_service_data
Bluetooth: hci_sync: Fix broadcast/PA when using an existing instance
Bluetooth: eir: Fix possible crashes on eir_create_adv_data
Bluetooth: MGMT: Fix sparse errors
net/mlx5: Ensure fw pages are always allocated on same NUMA
net/mlx5: Fix ECVF vports unload on shutdown flow
net/mlx5: Fix return value when searching for existing flow group
net/mlx5: HWS, fix missing ip_version handling in definer
net/mlx5e: Fix leak of Geneve TLV option object
net_sched: prio: fix a race in prio_tune()
net_sched: red: fix a race in __red_change()
net_sched: tbf: fix a race in tbf_change()
net_sched: ets: fix a race in ets_qdisc_change()
net: drv: netdevsim: don't napi_complete() from netpoll
btrfs: exit after state insertion failure at btrfs_convert_extent_bit()
fs/filesystems: Fix potential unsigned integer underflow in fs_name()
gfs2: pass through holder from the VFS for freeze/thaw
btrfs: exit after state split error at set_extent_bit()
nvmet-fcloop: access fcpreq only when holding reqlock
perf: Ensure bpf_perf_link path is properly serialized
block: use q->elevator with ->elevator_lock held in elv_iosched_show()
io_uring: fix use-after-free of sq->thread in __io_uring_show_fdinfo()
block: don't use submit_bio_noacct_nocheck in blk_zone_wplug_bio_work
io_uring: consistently use rcu semantics with sqpoll thread
bio: Fix bio_first_folio() for SPARSEMEM without VMEMMAP
block: Fix bvec_set_folio() for very large folios
objtool/rust: relax slice condition to cover more `noreturn` Rust functions
tools/resolve_btfids: Fix build when cross compiling kernel with clang.
Revert "wifi: mwifiex: Fix HT40 bandwidth issue."
ALSA: usb-audio: Add implicit feedback quirk for RODE AI-1
HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse()
posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()
nvmem: zynqmp_nvmem: unbreak driver after cleanup
usb: usbtmc: Fix read_stb function and get_stb ioctl
VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify
tty: serial: 8250_omap: fix TX with DMA for am33xx
usb: misc: onboard_usb_dev: Fix usb5744 initialization sequence
usb: cdnsp: Fix issue with detecting command completion event
usb: cdnsp: Fix issue with detecting USB 3.2 speed
usb: Flush altsetting 0 endpoints before reinitializating them after reset.
usb: typec: tcpm/tcpci_maxim: Fix bounds check in process_rx()
usb: typec: tcpm: move tcpm_queue_vdm_unlocked to asynchronous work
9p: Add a migrate_folio method
ring-buffer: Do not trigger WARN_ON() due to a commit_overrun
ring-buffer: Fix buffer locking in ring_buffer_subbuf_order_set()
ring-buffer: Move cpus_read_lock() outside of buffer->mutex
xfs: don't assume perags are initialised when trimming AGs
xen/arm: call uaccess_ttbr0_enable for dm_op hypercall
x86/iopl: Cure TIF_IO_BITMAP inconsistencies
x86/fred/signal: Prevent immediate repeat of single step trap on return from SIGTRAP handler
calipso: unlock rcu before returning -EAFNOSUPPORT
regulator: dt-bindings: mt6357: Drop fixed compatible requirement
usb: misc: onboard_usb_dev: fix build warning for CONFIG_USB_ONBOARD_DEV_USB5744=n
net: usb: aqc111: debug info before sanitation
overflow: Introduce __DEFINE_FLEX for having no initializer
gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add
drm/meson: Use 1000ULL when operating with mode->clock
thermal/drivers/mediatek/lvts: Remove unused lvts_debugfs_exit
Linux 6.12.34
Change-Id: I679f0f1ddcf9bf8a0b86089ccb7b78536f5bc441
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Steps on the way to 6.12.34
Resolves merge conflicts in:
kernel/sched/core.c
net/netfilter/xt_mark.c
Change-Id: I6df5e27c2a5bfa8b077b1f2814ad98b2a3dc0877
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
[ Upstream commit b85e3367a5716ed3662a4fe266525190d2af76df ]
Otherwise, it is possible to hit WARN_ON_ONCE in __kvmalloc_node_noprof()
when resizing hashtable because __GFP_NOWARN is unset.
Similar to:
b541ba7d1f5a ("netfilter: conntrack: clamp maximum hashtable size to INT_MAX")
Reviewed-by: Stefano Brivio <sbrivio@redhat.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 50d9ce9679dd50df2dc51ada717fa875bc248fad ]
The logic added in the blamed commit was supposed to only omit nat source
port allocation if neither the existing nor the new entry are subject to
NAT.
However, its not enough to lookup the conntrack based on the proposed
tuple, we must also check the reverse direction.
Otherwise there are esoteric cases where the collision is in the reverse
direction because that colliding connection has a port rewrite, but the
new entry doesn't. In this case, we only check the new entry and then
erronously conclude that no clash exists anymore.
The existing (udp) tuple is:
a:p -> b:P, with nat translation to s:P, i.e. pure daddr rewrite,
reverse tuple in conntrack table is s:P -> a:p.
When another UDP packet is sent directly to s, i.e. a:p->s:P, this is
correctly detected as a colliding entry: tuple is taken by existing reply
tuple in reverse direction.
But the colliding conntrack is only searched for with unreversed
direction, and we can't find such entry matching a:p->s:P.
The incorrect conclusion is that the clashing entry has timed out and
that no port address translation is required.
Such conntrack will then be discarded at nf_confirm time because the
proposed reverse direction clashes with an existing mapping in the
conntrack table.
Search for the reverse tuple too, this will then check the NAT bits of
the colliding entry and triggers port reallocation.
Followp patch extends nft_nat.sh selftest to cover this scenario.
The IPS_SEQ_ADJUST change is also a bug fix:
Instead of checking for SEQ_ADJ this tested for SEEN_REPLY and ASSURED
by accident -- _BIT is only for use with the test_bit() API.
This bug has little consequence in practice, because the sequence number
adjustments are only useful for TCP which doesn't support clash resolution.
The existing test case (conntrack_reverse_clash.sh) exercise a race
condition path (parallel conntrack creation on different CPUs), so
the colliding entries have neither SEEN_REPLY nor ASSURED set.
Thanks to Yafang Shao and Shaun Brady for an initial investigation
of this bug.
Fixes: d8f84a9bc7 ("netfilter: nf_nat: don't try nat source port reallocation for reverse dir clash")
Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1795
Reported-by: Yafang Shao <laoar.shao@gmail.com>
Reported-by: Shaun Brady <brady.1345@gmail.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Tested-by: Yafang Shao <laoar.shao@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit ea77c397bff8b6d59f6d83dae1425b08f465e8b5 ]
If the first field doesn't cover the entire start map, then we must zero
out the remainder, else we leak those bits into the next match round map.
The early fix was incomplete and did only fix up the generic C
implementation.
A followup patch adds a test case to nft_concat_range.sh.
Fixes: 791a615b7a ("netfilter: nf_set_pipapo: fix initial map fill")
Signed-off-by: Florian Westphal <fw@strlen.de>
Reviewed-by: Stefano Brivio <sbrivio@redhat.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 22a9613de4c29d7d0770bfb8a5a9d73eb8df7dad ]
When dumping a nft_tunnel with more than one geneve_opt configured the
netlink attribute hierarchy should be as follow:
NFTA_TUNNEL_KEY_OPTS
|
|--NFTA_TUNNEL_KEY_OPTS_GENEVE
| |
| |--NFTA_TUNNEL_KEY_GENEVE_CLASS
| |--NFTA_TUNNEL_KEY_GENEVE_TYPE
| |--NFTA_TUNNEL_KEY_GENEVE_DATA
|
|--NFTA_TUNNEL_KEY_OPTS_GENEVE
| |
| |--NFTA_TUNNEL_KEY_GENEVE_CLASS
| |--NFTA_TUNNEL_KEY_GENEVE_TYPE
| |--NFTA_TUNNEL_KEY_GENEVE_DATA
|
|--NFTA_TUNNEL_KEY_OPTS_GENEVE
...
Otherwise, userspace tools won't be able to fetch the geneve options
configured correctly.
Fixes: 925d844696 ("netfilter: nft_tunnel: add support for geneve opts")
Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit c38eb2973c18d34a8081d173a6ad298461f4a37c ]
Its now possible to build a kernel that has no support for the classic
xtables get/setsockopt interfaces and builtin tables.
In this case, we have CONFIG_IP6_NF_MANGLE=n and
CONFIG_IP_NF_ARPTABLES=n.
For optstript, the ipv6 code is so small that we can enable it if
netfilter ipv6 support exists. For mark, check if either classic
arptables or NFT_ARP_COMPAT is set.
Fixes: a9525c7f62 ("netfilter: xtables: allow xtables-nft only builds")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 4c5c6aa9967dbe55bd017bb509885928d0f31206 ]
When calculating the lookup table size, ensure the following
multiplication does not overflow:
- desc->field_len[] maximum value is U8_MAX multiplied by
NFT_PIPAPO_GROUPS_PER_BYTE(f) that can be 2, worst case.
- NFT_PIPAPO_BUCKETS(f->bb) is 2^8, worst case.
- sizeof(unsigned long), from sizeof(*f->lt), lt in
struct nft_pipapo_field.
Then, use check_mul_overflow() to multiply by bucket size and then use
check_add_overflow() to the alignment for avx2 (if needed). Finally, add
lt_size_check_overflow() helper and use it to consolidate this.
While at it, replace leftover allocation using the GFP_KERNEL to
GFP_KERNEL_ACCOUNT for consistency, in pipapo_resize().
Fixes: 3c4287f620 ("nf_tables: Add set type for arbitrary concatenation of ranges")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Reviewed-by: Stefano Brivio <sbrivio@redhat.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit bfe7cfb65c753952735c3eed703eba9a8b96a18d ]
The xt_quota compares skb length with remaining quota, but the nft_quota
compares it with consumed bytes.
The xt_quota can match consumed bytes up to quota at maximum. But the
nft_quota break match when consumed bytes equal to quota.
i.e., nft_quota match consumed bytes in [0, quota - 1], not [0, quota].
Fixes: 795595f68d ("netfilter: nft_quota: dump consumed quota")
Signed-off-by: Zhongqiu Duan <dzq.aishenghu0@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 8b6861390ffee6b8ed78b9395e3776c16fec6579 ]
nf_conntrack_max and nf_conntrack_expect_max sysctls were authorized to
be written any negative value, which would then be stored in the
unsigned int variables nf_conntrack_max and nf_ct_expect_max variables.
While the do_proc_dointvec_conv function is supposed to limit writing
handled by proc_dointvec proc_handler to INT_MAX. Such a negative value
being written in an unsigned int leads to a very high value, exceeding
this limit.
Moreover, the nf_conntrack_expect_max sysctl documentation specifies the
minimum value is 1.
The proc_handlers have thus been updated to proc_dointvec_minmax in
order to specify the following write bounds :
* Bound nf_conntrack_max sysctl writings between SYSCTL_ZERO
and SYSCTL_INT_MAX.
* Bound nf_conntrack_expect_max sysctl writings between SYSCTL_ONE
and SYSCTL_INT_MAX as defined in the sysctl documentation.
With this patch applied, sysctl writes outside the defined in the bound
will thus lead to a write error :
```
sysctl -w net.netfilter.nf_conntrack_expect_max=-1
sysctl: setting key "net.netfilter.nf_conntrack_expect_max": Invalid argument
```
Signed-off-by: Nicolas Bouchinet <nicolas.bouchinet@ssi.gouv.fr>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 8478a729c0462273188263136880480729e9efca ]
Region locking introduced in v5.6-rc4 contained three macros to handle
the region locks: ahash_bucket_start(), ahash_bucket_end() which gave
back the start and end hash bucket values belonging to a given region
lock and ahash_region() which should give back the region lock belonging
to a given hash bucket. The latter was incorrect which can lead to a
race condition between the garbage collector and adding new elements
when a hash type of set is defined with timeouts.
Fixes: f66ee0410b ("netfilter: ipset: Fix "INFO: rcu detected stall in hash_xxx" reports")
Reported-by: Kota Toda <kota.toda@gmo-cybersecurity.com>
Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Steps on the way to 6.12.23
Resolves merge conflicts in:
net/ipv4/udp.c
Change-Id: Ida343c74a69a3f4c3f358486ef6339b55a5e6afe
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Steps on the way to 6.12.20
Resolves merge conflicts in:
mm/userfaultfd.c
Change-Id: I315faea2e1375e21d4c743d33f28f7f2dd56fd14
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
[ Upstream commit e042ed950d4e176379ba4c0722146cd96fb38aa2 ]
Given a set element like:
icmpv6 . dead:beef:00ff::1
The value of 'ff' is irrelevant, any address will be matched
as long as the other octets are the same.
This is because of too-early register clobbering:
ymm7 is reloaded with new packet data (pkt[9]) but it still holds data
of an earlier load that wasn't processed yet.
The existing tests in nft_concat_range.sh selftests do exercise this code
path, but do not trigger incorrect matching due to the network prefix
limitation.
Fixes: 7400b06396 ("nft_set_pipapo: Introduce AVX2-based lookup implementation")
Reported-by: sontu mazumdar <sontu21@gmail.com>
Closes: https://lore.kernel.org/netfilter/CANgxkqwnMH7fXra+VUfODT-8+qFLgskq3set1cAzqqJaV4iEZg@mail.gmail.com/T/#t
Reviewed-by: Stefano Brivio <sbrivio@redhat.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 688c15017d5cd5aac882400782e7213d40dc3556 ]
When nf_tables_updchain encounters an error, hook registration needs to
be rolled back.
This should only be done if the hook has been registered, which won't
happen when the table is flagged as dormant (inactive).
Just move the assignment into the registration block.
Reported-by: syzbot+53ed3a6440173ddbf499@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=53ed3a6440173ddbf499
Fixes: b9703ed44f ("netfilter: nf_tables: support for adding new devices to an existing netdev chain")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 9d74da1177c800eb3d51c13f9821b7b0683845a5 ]
conncount has its own GC handler which determines when to reap stale
elements, this is convenient for dynamic sets. However, this also reaps
non-dynamic sets with static configurations coming from control plane.
Always run connlimit gc handler but honor feedback to reap element if
this set is dynamic.
Fixes: 290180e244 ("netfilter: nf_tables: add connlimit support")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 6edd78af9506bb182518da7f6feebd75655d9a0e ]
There is an incorrect calculation in the offset variable which causes
the nft_skb_copy_to_reg() function to always return -EFAULT. Adding the
start variable is redundant. In the __ip_options_compile() function the
correct offset is specified when finding the function. There is no need
to add the size of the iphdr structure to the offset.
Fixes: dbb5281a1f ("netfilter: nf_tables: add support for matching IPv4 options")
Signed-off-by: Alexey Kashavkin <akashavkin@gmail.com>
Reviewed-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 80b78c39eb86e6b55f56363b709eb817527da5aa ]
The get->num_services variable is an unsigned int which is controlled by
the user. The struct_size() function ensures that the size calculation
does not overflow an unsigned long, however, we are saving the result to
an int so the calculation can overflow.
Both "len" and "get->num_services" come from the user. This check is
just a sanity check to help the user and ensure they are using the API
correctly. An integer overflow here is not a big deal. This has no
security impact.
Save the result from struct_size() type size_t to fix this integer
overflow bug.
Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Acked-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit fb8286562ecfb585e26b033c5e32e6fb85efb0b3 ]
The call to flush_work before tearing down a table from the netlink
notifier was supposed to make sure that all earlier updates (e.g. rule
add) that might reference that table have been processed.
Unfortunately, flush_work() waits for the last queued instance.
This could be an instance that is different from the one that we must
wait for.
This is because transactions are protected with a pernet mutex, but the
work item is global, so holding the transaction mutex doesn't prevent
another netns from queueing more work.
Make the work item pernet so that flush_work() will wait for all
transactions queued from this netns.
A welcome side effect is that we no longer need to wait for transaction
objects from foreign netns.
The gc work queue is still global. This seems to be ok because nft_set
structures are reference counted and each container structure owns a
reference on the net namespace.
The destroy_list is still protected by a global spinlock rather than
pernet one but the hold time is very short anyway.
v2: call cancel_work_sync before reaping the remaining tables (Pablo).
Fixes: 9f6958ba2e ("netfilter: nf_tables: unconditionally flush pending work before notifier")
Reported-by: syzbot+5d8c5789c8cb076b2c25@syzkaller.appspotmail.com
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit df08c94baafb001de6cf44bb7098bb557f36c335 ]
nf_conncount is supposed to skip garbage collection if it has already
run garbage collection in the same jiffy. Unfortunately, this is broken
when jiffies wrap around which this patch fixes.
The problem is that last_gc in the nf_conncount_list struct is an u32,
but jiffies is an unsigned long which is 8 bytes on my systems. When
those two are compared it only works until last_gc wraps around.
See bug report: https://bugzilla.netfilter.org/show_bug.cgi?id=1778
for more details.
Fixes: d265929930 ("netfilter: nf_conncount: reduce unnecessary GC")
Signed-off-by: Nicklas Bo Jensen <njensen@akamai.com>
Reviewed-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 5cfe5612ca9590db69b9be29dc83041dbf001108 ]
nft_ct_pcpu_template is a per-CPU variable and relies on disabled BH for its
locking. The refcounter is read and if its value is set to one then the
refcounter is incremented and variable is used - otherwise it is already
in use and left untouched.
Without per-CPU locking in local_bh_disable() on PREEMPT_RT the
read-then-increment operation is not atomic and therefore racy.
This can be avoided by using unconditionally __refcount_inc() which will
increment counter and return the old value as an atomic operation.
In case the returned counter is not one, the variable is in use and we
need to decrement counter. Otherwise we can use it.
Use __refcount_inc() instead of read and a conditional increment.
Fixes: edee4f1e92 ("netfilter: nft_ct: add zone id set support")
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Reviewed-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
GKI (arm64) relevant 102 out of 584 changes, affecting 165 files +1491/-594
4338831b83 coredump: Do not lock during 'comm' reporting [1 file, +2/-2]
784908004f fs: fix proc_handler for sysctl_nr_open [1 file, +1/-1]
f83f330fc4 block: retry call probe after request_module in blk_request_module [1 file, +17/-5]
e278c7ff75 block: check BLK_FEAT_POLL under q_usage_count [2 files, +22/-12]
d313ff5308 block: don't update BLK_FEAT_POLL in __blk_mq_update_nr_hw_queues [4 files, +22/-26]
4621771de1 nvme: Add error check for xa_store in nvme_get_effects_log [1 file, +6/-2]
e8c390a9a5 nvme: Add error path for xa_store in nvme_init_effects [1 file, +22/-4]
68303b5d38 select: Fix unbalanced user_access_end() [1 file, +2/-2]
1e8c151fb2 nvme: fix bogus kzalloc() return check in nvme_init_effects_log() [1 file, +1/-1]
e4b64d34a4 sched/fair: Untangle NEXT_BUDDY and pick_next_task() [2 files, +11/-2]
5bb4039f77 sched/fair: Fix value reported by hot tasks pulled in /proc/schedstat [2 files, +14/-4]
fd2818c5e0 sched: Split out __schedule() deactivate task logic into a helper [1 file, +40/-27]
3f1215588b sched: psi: pass enqueue/dequeue flags to psi callbacks directly [3 files, +53/-44]
10a7d3e734 psi: Fix race when task wakes up before psi_sched_switch() adjusts flags [2 files, +7/-3]
ebaeca33d3 HID: core: Fix assumption that Resolution Multipliers must be in Logical Collections [1 file, +2/-0]
7d68c20638 OPP: add index check to assert to avoid buffer overflow in _read_freq() [1 file, +27/-15]
ff2def2518 OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized [1 file, +13/-2]
82bd38bd54 net_sched: sch_sfq: handle bigger packets [1 file, +13/-26]
7d8947f215 net_sched: sch_sfq: don't allow 1 packet limit [1 file, +4/-0]
e561d1a2ba clk: fix an OF node reference leak in of_clk_get_parent_name() [1 file, +3/-1]
bd1bb30b9f HID: multitouch: fix support for Goodix PID 0x01e9 [1 file, +1/-1]
d474a73856 inetpeer: remove create argument of inet_getpeer_v[46]() [7 files, +11/-12]
dc4fd82dad inetpeer: remove create argument of inet_getpeer() [2 files, +5/-13]
4622e45097 inetpeer: update inetpeer timestamp in inet_getpeer() [1 file, +4/-8]
9345b588f8 inetpeer: do not get a refcount in inet_getpeer() [7 files, +32/-29]
4f8344fce9 udp: Deal with race between UDP socket address change and rehash [2 files, +106/-0]
a7175e363a dt-bindings: clock: imx93: Drop IMX93_CLK_END macro definition [1 file, +0/-1]
036f2f5109 dt-bindings: clock: imx93: Add SPDIF IPG clk [1 file, +1/-0]
5078123528 regulator: of: Implement the unwind path of of_regulator_match() [1 file, +13/-1]
8937f5e38a ax25: rcu protect dev->ax25_ptr [7 files, +35/-20]
3d62a5037f OPP: OF: Fix an OF node leak in _opp_add_static_v2() [1 file, +3/-1]
a3bdd14936 HID: fix generic desktop D-Pad controls [2 files, +18/-20]
a8251d3a4c mfd: syscon: Fix race in device_node_get_regmap() [1 file, +10/-9]
984e7d2aa0 wifi: mac80211: Fix common size calculation for ML element [1 file, +3/-8]
df2f2d9199 Bluetooth: btbcm: Fix NULL deref in btbcm_get_board_name() [1 file, +3/-0]
f98ccd7d77 dev: Acquire netdev_rename_lock before restoring dev->name in dev_change_name(). [1 file, +2/-0]
33e2168788 net: let net.core.dev_weight always be non-zero [1 file, +4/-1]
b382ab9b88 net: avoid race between device unregistration and ethnl ops [1 file, +1/-1]
73c7e1d689 net: sched: Disallow replacing of child qdisc from one parent to another [1 file, +4/-0]
d7fe7e1bbe netfilter: nf_tables: fix set size with rbtree backend [3 files, +96/-2]
5213efec90 net: sched: refine software bypass handling in tc_run [8 files, +55/-45]
a0753466f0 tcp_cubic: fix incorrect HyStart round start detection [1 file, +5/-3]
b7de862bda crypto: api - Fix boot-up self-test race [1 file, +2/-2]
b002750000 bpf: bpf_local_storage: Always use bpf_mem_alloc in PREEMPT_RT [1 file, +6/-2]
eb2e58484b rhashtable: Fix potential deadlock by moving schedule_work outside lock [1 file, +6/-4]
8e7d29b698 bpf: Use refcount_t instead of atomic_t for mmap_count [1 file, +4/-4]
b777b14c2a bpf: Reject struct_ops registration that uses module ptr and the module btf_id is missing [3 files, +26/-5]
78b9778349 bpf: Send signals asynchronously if !preemptible [1 file, +1/-1]
0e272fe6a0 bpf: tcp: Mark bpf_load_hdr_opt() arg2 as read-write [1 file, +1/-1]
f939008a52 rhashtable: Fix rhashtable_try_insert test [1 file, +7/-5]
33e47d9573 bpf: Cancel the running bpf_timer through kworker for PREEMPT_RT [1 file, +16/-2]
6cffdf4838 of: property: Avoiding using uninitialized variable @imaplen in parse_interrupt_map() [1 file, +1/-1]
92ed1efb6a of: reserved-memory: Do not make kmemleak ignore freed address [1 file, +2/-1]
9a0fe62f93 of: reserved_mem: Restructure how the reserved memory regions are processed [3 files, +122/-54]
e61977c714 of/fdt: Restore possibility to use both ACPI and FDT from bootloader [1 file, +1/-9]
45e1246e5c PCI: endpoint: Destroy the EPC device in devm_pci_epc_destroy() [1 file, +1/-1]
58465dfc42 media: uvcvideo: Propagate buf->error to userspace [1 file, +2/-1]
a2c80a1881 PCI: qcom: Update ICC and OPP values after Link Up event [1 file, +2/-0]
a665fab63d PCI: dwc: Always stop link in the dw_pcie_suspend_noirq [1 file, +1/-0]
0e0ac81d51 scsi: ufs: bsg: Delete bsg_dev when setting up bsg fails [1 file, +1/-0]
4896402780 erofs: fix potential return value overflow of z_erofs_shrink_scan() [1 file, +1/-2]
565611d101 module: Extend the preempt disabled section in dereference_symbol_descriptor(). [1 file, +1/-1]
fd41b2e9aa module: Don't fail module loading when setting ro_after_init section RO failed [1 file, +4/-3]
1614e75d1a driver core: class: Fix wild pointer dereferences in API class_dev_iter_next() [1 file, +8/-1]
b35a3edc7c serial: 8250: Adjust the timeout for FIFO mode [1 file, +26/-6]
87fdd4c447 xfrm: replay: Fix the update of replay_esn->oseq_hi for GSO [1 file, +6/-4]
2a64cff2aa xfrm: Add support for per cpu xfrm state handling. [6 files, +112/-22]
aa48a18fdb xfrm: Cache used outbound xfrm states at the policy. [3 files, +71/-0]
5e4334dc39 xfrm: Add an inbound percpu state cache. [6 files, +70/-7]
a16871c783 xfrm: state: fix out-of-bounds read during lookup [1 file, +70/-19]
6945701ca1 xfrm: delete intermediate secpath entry in packet offload mode [1 file, +13/-3]
24ac5b7524 regulator: core: Add missing newline character [1 file, +1/-1]
a099834a51 ipmr: do not call mr_mfc_uses_dev() for unres entries [1 file, +0/-3]
3b732c60a0 PM: hibernate: Add error handling for syscore_suspend() [1 file, +6/-1]
e468aace40 xfrm: Don't disable preemption while looking up cache state. [1 file, +1/-3]
3e44707da8 ptp: Properly handle compat ioctls [1 file, +4/-0]
a68d7a9fb8 ethtool: Fix set RXNFC command with symmetric RSS hash [1 file, +1/-1]
a06bb37d65 vsock: Allow retrying on connect() failure [1 file, +5/-0]
1dd823a46e tcp: correct handling of extreme memory squeeze [1 file, +6/-3]
557707906d net: xdp: Disallow attaching device-bound programs in generic mode [1 file, +4/-0]
a23834b782 genksyms: fix memory leak when the same symbol is added from source [2 files, +15/-2]
52f0a28e17 genksyms: fix memory leak when the same symbol is read from *.symref file [3 files, +9/-5]
206d8e0242 io_uring/uring_cmd: use cached cmd_op in io_uring_cmd_sock() [1 file, +1/-1]
6e26ca1818 kconfig: fix file name in warnings when loading KCONFIG_DEFCONFIG_LIST [1 file, +4/-2]
e4e8ed67e0 kconfig: fix memory leak in sym_warn_unmet_dep() [1 file, +1/-0]
00d1943fe4 f2fs: Introduce linear search for dentries [3 files, +45/-19]
e0216c39b4 ALSA: usb-audio: Add delay quirk for iBasso DC07 Pro [1 file, +2/-0]
f395b7efce net: usb: rtl8150: enable basic endpoint checking [1 file, +22/-0]
ae069cd2ba usb: xhci: Fix NULL pointer dereference on certain command aborts [1 file, +2/-1]
ebba1bebf0 usb: dwc3: core: Defer the probe until USB power supply ready [1 file, +21/-9]
01c74aeac2 usb: dwc3: Skip resume if pm_runtime_set_active() fails [1 file, +4/-1]
ce5c91a1b2 usb: typec: tcpm: set SRC_SEND_CAPABILITIES timeout to PD_T_SENDER_RESPONSE [1 file, +1/-1]
15b50cbc6f usb: typec: tcpci: Prevent Sink disconnection before vPpsShutdown in SPR PPS [3 files, +16/-8]
f2013d19b7 remoteproc: core: Fix ida_free call while not allocated [1 file, +7/-7]
d1f8e69eec media: uvcvideo: Fix double free in error path [1 file, +1/-0]
8de4e5a922 of: reserved-memory: Warn for missing static reserved memory regions [1 file, +5/-0]
698943070e dma-mapping: save base/size instead of pointer to shared DMA pool [1 file, +8/-6]
78b366aa0e xfrm: Add error handling when nla_put_u32() returns an error [1 file, +4/-1]
364d7e7f30 xfrm: Fix acquire state insertion. [1 file, +1/-0]
1cf2177959 ethtool: Fix access to uninitialized fields in set RXNFC command [1 file, +2/-1]
c3a3741db8 memcg: fix soft lockup in the OOM process [2 files, +13/-2]
333f128224 ethtool: ntuple: fix rss + ring_cookie check [1 file, +1/-1]
Changes in 6.12.13
coredump: Do not lock during 'comm' reporting
powerpc/book3s64/hugetlb: Fix disabling hugetlb when fadump is active
dlm: fix removal of rsb struct that is master and dir record
dlm: fix srcu_read_lock() return type to int
afs: Fix EEXIST error returned from afs_rmdir() to be ENOTEMPTY
afs: Fix directory format encoding struct
afs: Fix cleanup of immediately failed async calls
fs: fix proc_handler for sysctl_nr_open
block: copy back bounce buffer to user-space correctly in case of split
block: retry call probe after request_module in blk_request_module
ps3disk: Do not use dev->bounce_size before it is set
nbd: don't allow reconnect after disconnect
pstore/blk: trivial typo fixes
block: check BLK_FEAT_POLL under q_usage_count
block: don't update BLK_FEAT_POLL in __blk_mq_update_nr_hw_queues
nvme-tcp: Fix I/O queue cpu spreading for multiple controllers
nvme: Add error check for xa_store in nvme_get_effects_log
powerpc/pseries/iommu: IOMMU incorrectly marks MMIO range in DDW
selftests/powerpc: Fix argument order to timer_sub()
nvme: Add error path for xa_store in nvme_init_effects
btrfs: improve the warning and error message for btrfs_remove_qgroup()
partitions: ldm: remove the initial kernel-doc notation
btrfs: subpage: fix the bitmap dump of the locked flags
select: Fix unbalanced user_access_end()
nvme: fix bogus kzalloc() return check in nvme_init_effects_log()
afs: Fix the fallback handling for the YFS.RemoveFile2 RPC call
perf/core: Save raw sample data conditionally based on sample type
sched/fair: Untangle NEXT_BUDDY and pick_next_task()
sched/fair: Fix value reported by hot tasks pulled in /proc/schedstat
sched: Fix race between yield_to() and try_to_wake_up()
x86/cpu: Enable SD_ASYM_PACKING for PKG domain on AMD
x86/topology: Use x86_sched_itmt_flags for PKG domain unconditionally
sched: Split out __schedule() deactivate task logic into a helper
sched: psi: pass enqueue/dequeue flags to psi callbacks directly
psi: Fix race when task wakes up before psi_sched_switch() adjusts flags
drm/v3d: Fix performance counter source settings on V3D 7.x
drm/rockchip: vop2: fix rk3588 dp+dsi maxclk verification
drm/msm/dp: set safe_to_exit_level before printing it
drm/msm/hdmi: simplify code in pll_get_integloop_gain
drm/etnaviv: Fix page property being used for non writecombine buffers
HID: core: Fix assumption that Resolution Multipliers must be in Logical Collections
drm/amd/pm: Fix an error handling path in vega10_enable_se_edc_force_stall_config()
drm/amdgpu: Fix potential NULL pointer dereference in atomctrl_get_smc_sclk_range_table
drm/rockchip: vop2: Fix cluster windows alpha ctrl regsiters offset
drm/rockchip: vop2: Fix the mixer alpha setup for layer 0
drm/panthor: Preserve the result returned by panthor_fw_resume()
drm/rockchip: vop2: Fix the windows switch between different layers
printk: Defer legacy printing when holding printk_cpu_sync
drm/connector: Allow clearing HDMI infoframes
drm/rockchip: vop2: Set AXI id for rk3588
drm/rockchip: vop2: Setup delay cycle for Esmart2/3
drm/rockchip: vop2: Check linear format for Cluster windows on rk3566/8
drm/rockchip: vop2: Add check for 32 bpp format for rk3588
drm/rockchip: vop2: include rockchip_drm_drv.h
drm/amdgpu/vcn: reset fw_shared under SRIOV
OPP: add index check to assert to avoid buffer overflow in _read_freq()
OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized
drm/msm/dpu: provide DSPP and correct LM config for SDM670
drm/msm/dpu: link DSPP_2/_3 blocks on SM8150
drm/msm/dpu: link DSPP_2/_3 blocks on SC8180X
drm/msm/dpu: link DSPP_2/_3 blocks on SM8250
drm/msm/dpu: link DSPP_2/_3 blocks on SM8350
drm/msm/dpu: link DSPP_2/_3 blocks on SM8550
drm/msm/dpu: link DSPP_2/_3 blocks on SM8650
drm/msm/dpu: link DSPP_2/_3 blocks on X1E80100
drm/msm: Check return value of of_dma_configure()
drm/msm: don't clean up priv->kms prematurely
drm/msm/mdp4: correct LCDC regulator name
drm/bridge: it6505: Change definition of AUX_FIFO_MAX_SIZE
drm/amdgpu: tear down ttm range manager for doorbell in amdgpu_ttm_fini()
Revert "drm/amdgpu/gfx9: put queue resets behind a debug option"
drm/amdgpu: fix gpu recovery disable with per queue reset
genirq: Make handle_enforce_irqctx() unconditionally available
ipmi: ipmb: Add check devm_kasprintf() returned value
wifi: ath11k: Fix unexpected return buffer manager error for WCN6750/WCN6855
wifi: rtlwifi: rtl8821ae: phy: restore removed code to fix infinite loop
wifi: rtlwifi: do not complete firmware loading needlessly
wifi: rtlwifi: rtl8192se: rise completion of firmware loading as last step
wifi: rtlwifi: wait for firmware loading before releasing memory
wifi: rtlwifi: fix init_sw_vars leak when probe fails
wifi: rtlwifi: usb: fix workqueue leak when probe fails
wifi: wcn36xx: fix channel survey memory allocation size
clk: renesas: cpg-mssr: Fix 'soc' node handling in cpg_mssr_reserved_init()
wifi: cfg80211: tests: Fix potential NULL dereference in test_cfg80211_parse_colocated_ap()
selftests/bpf: Actuate tx_metadata_len in xdp_hw_metadata
net_sched: sch_sfq: handle bigger packets
net_sched: sch_sfq: don't allow 1 packet limit
spi: zynq-qspi: Add check for clk_enable()
rxrpc: Fix handling of received connection abort
dt-bindings: mmc: controller: clarify the address-cells description
clk: fix an OF node reference leak in of_clk_get_parent_name()
dt-bindings: leds: class-multicolor: Fix path to color definitions
wifi: rtlwifi: remove unused check_buddy_priv
wifi: rtlwifi: destroy workqueue at rtl_deinit_core
wifi: rtlwifi: fix memory leaks and invalid access at probe error path
wifi: rtlwifi: pci: wait for firmware loading before releasing memory
HID: multitouch: fix support for Goodix PID 0x01e9
regulator: dt-bindings: mt6315: Drop regulator-compatible property
wifi: brcmfmac: add missing header include for brcmf_dbg
module: Convert default symbol namespace to string literal
hwmon: (nct6775): Actually make use of the HWMON_NCT6775 symbol namespace
ACPI: fan: cleanup resources in the error path of .probe()
cpupower: fix TSC MHz calculation
dt-bindings: mfd: bd71815: Fix rsense and typos
leds: netxbig: Fix an OF node reference leak in netxbig_leds_get_of_pdata()
inetpeer: remove create argument of inet_getpeer_v[46]()
inetpeer: remove create argument of inet_getpeer()
inetpeer: update inetpeer timestamp in inet_getpeer()
inetpeer: do not get a refcount in inet_getpeer()
pwm: stm32-lp: Add check for clk_enable()
cpufreq: schedutil: Fix superfluous updates caused by need_freq_update
selftests: ktap_helpers: Fix uninitialized variable
ptr_ring: do not block hard interrupts in ptr_ring_resize_multiple()
net: airoha: Fix error path in airoha_probe()
gpio: pca953x: log an error when failing to get the reset GPIO
cpufreq: qcom: Fix qcom_cpufreq_hw_recalc_rate() to query LUT if LMh IRQ is not available
cpufreq: qcom: Implement clk_ops::determine_rate() for qcom_cpufreq* clocks
udp: Deal with race between UDP socket address change and rehash
clk: imx8mp: Fix clkout1/2 support
dt-bindings: clock: imx93: Drop IMX93_CLK_END macro definition
dt-bindings: clock: Add i.MX91 clock support
dt-bindings: clock: imx93: Add SPDIF IPG clk
clk: imx93: Move IMX93_CLK_END macro to clk driver
clk: imx: add i.MX91 clk
clk: imx93: Add IMX93_CLK_SPDIF_IPG clock
arm64: dts: imx93: Use IMX93_CLK_SPDIF_IPG as SPDIF IPG clock
clk: imx: Apply some clks only for i.MX93
clk: qcom: camcc-x1e80100: Set titan_top_gdsc as the parent GDSC of subordinate GDSCs
team: prevent adding a device which is already a team device lower
dt-bindings: clock: sunxi: Export PLL_VIDEO_2X and PLL_MIPI
clk: sunxi-ng: a64: drop redundant CLK_PLL_VIDEO0_2X and CLK_PLL_MIPI
clk: sunxi-ng: a64: stop force-selecting PLL-MIPI as TCON0 parent
regulator: of: Implement the unwind path of of_regulator_match()
ax25: rcu protect dev->ax25_ptr
net/mlx5: HWS, fix definer's HWS_SET32 macro for negative offset
OPP: OF: Fix an OF node leak in _opp_add_static_v2()
ipmi: ssif_bmc: Fix new request loss when bmc ready for a response
wifi: ath12k: fix tx power, max reg power update to firmware
clk: qcom: gcc-sdm845: Do not use shared clk_ops for QUPs
HID: hid-thrustmaster: Fix warning in thrustmaster_probe by adding endpoint check
HID: fix generic desktop D-Pad controls
leds: cht-wcove: Use devm_led_classdev_register() to avoid memory leak
mfd: syscon: Fix race in device_node_get_regmap()
samples/landlock: Fix possible NULL dereference in parse_path()
wifi: mt76: mt7996: fix invalid interface combinations
wifi: wlcore: fix unbalanced pm_runtime calls
wifi: rtw89: handle entity active flag per PHY
wifi: rtw89: chan: manage active interfaces
wifi: rtw89: tweak setting of channel and TX power for MLO
wifi: rtw89: fix proceeding MCC with wrong scanning state after sequence changes
wifi: rtw89: chan: fix soft lockup in rtw89_entity_recalc_mgnt_roles()
wifi: rtw89: avoid to init mgnt_entry list twice when WoWLAN failed
wifi: rtw89: mcc: consider time limits not divisible by 1024
wifi: rtw89: fix race between cancel_hw_scan and hw_scan completion
hwmon: Fix help text for aspeed-g6-pwm-tach
wifi: mt76: mt7925: fix off by one in mt7925_load_clc()
wifi: mt76: mt7915: Fix mesh scan on MT7916 DBDC
wifi: iwlwifi: fw: read STEP table from correct UEFI var
wifi: iwlwifi: mvm: avoid NULL pointer dereference
wifi: iwlwifi: mvm: don't count mgmt frames as MPDU
wifi: mac80211: prohibit deactivating all links
wifi: cfg80211: Move cfg80211_scan_req_add_chan() n_channels increment earlier
wifi: mac80211: fix tid removal during mesh forwarding
wifi: mac80211: Fix common size calculation for ML element
wifi: mac80211: don't flush non-uploaded STAs
clk: ralink: mtmips: remove duplicated 'xtal' clock for Ralink SoC RT3883
clk: thead: Fix clk gate registration to pass flags
clk: thead: Add CLK_IGNORE_UNUSED to fix TH1520 boot
clk: thead: Fix cpu2vp_clk for TH1520 AP_SUBSYS clocks
net/smc: fix data error when recvmsg with MSG_PEEK flag
landlock: Handle weird files
wifi: mt76: mt76u_vendor_request: Do not print error messages when -EPROTO
wifi: mt76: mt7921: fix using incorrect group cipher after disconnection.
wifi: mt76: mt7915: Fix an error handling path in mt7915_add_interface()
wifi: mt76: mt7925: fix NULL deref check in mt7925_change_vif_links
wifi: mt76: mt7925: fix wrong band_idx setting when enable sniffer mode
wifi: mt76: mt7925: fix get wrong chip cap from incorrect pointer
wifi: mt76: mt7925: fix the invalid ip address for arp offload
wifi: mt76: mt7996: fix overflows seen when writing limit attributes
wifi: mt76: mt7915: fix overflows seen when writing limit attributes
wifi: mt76: connac: Extend mt76_connac_mcu_uni_add_dev for MLO
wifi: mt76: mt7925: Fix incorrect MLD address in bss_mld_tlv for MLO support
wifi: mt76: mt7925: Fix incorrect WCID assignment for MLO
wifi: mt76: mt7925: Fix incorrect WCID phy_idx assignment
wifi: mt76: mt7925: fix wrong parameter for related cmd of chan info
wifi: mt76: mt7925: Fix CNM Timeout with Single Active Link in MLO
wifi: mt76: mt7925: Enhance mt7925_mac_link_bss_add to support MLO
wifi: mt76: Enhance mt7925_mac_link_sta_add to support MLO
wifi: mt76: mt7925: Update mt7925_mcu_sta_update for BC in ASSOC state
wifi: mt76: mt7925: Update mt792x_rx_get_wcid for per-link STA
wifi: mt76: mt7925: Update mt7925_unassign_vif_chanctx for per-link BSS
wifi: mt76: mt7925: Update secondary link PS flow
wifi: mt76: mt7925: Init secondary link PM state
wifi: mt76: mt7925: Update mt7925_mcu_uni_[tx,rx]_ba for MLO
wifi: mt76: mt7925: Cleanup MLO settings post-disconnection
wifi: mt76: mt7925: Properly handle responses for commands with events
wifi: mt76: mt7996: fix rx filter setting for bfee functionality
wifi: mt76: only enable tx worker after setting the channel
wifi: mt76: mt7915: firmware restart on devices with a second pcie link
wifi: mt76: mt7915: fix omac index assignment after hardware reset
wifi: mt76: mt7915: fix register mapping
wifi: mt76: mt7996: fix register mapping
wifi: mt76: mt7996: add max mpdu len capability
wifi: mt76: mt7996: fix the capability of reception of EHT MU PPDU
wifi: mt76: mt7996: fix HE Phy capability
wifi: mt76: mt7996: fix incorrect indexing of MIB FW event
wifi: mt76: mt7996: fix definition of tx descriptor
wifi: mt76: mt7996: fix ldpc setting
i2c: designware: Actually make use of the I2C_DW_COMMON and I2C_DW symbol namespaces
cpufreq: ACPI: Fix max-frequency computation
selftests: timers: clocksource-switch: Adapt progress to kselftest framework
selftests: harness: fix printing of mismatch values in __EXPECT()
wifi: cfg80211: adjust allocation of colocated AP data
Bluetooth: btbcm: Fix NULL deref in btbcm_get_board_name()
Bluetooth: btrtl: check for NULL in btrtl_setup_realtek()
inet: ipmr: fix data-races
clk: analogbits: Fix incorrect calculation of vco rate delta
dev: Acquire netdev_rename_lock before restoring dev->name in dev_change_name().
pwm: stm32: Add check for clk_enable()
selftests/landlock: Fix build with non-default pthread linking
selftests/landlock: Fix error message
net: let net.core.dev_weight always be non-zero
net/mlxfw: Drop hard coded max FW flash image size
octeon_ep: remove firmware stats fetch in ndo_get_stats64
octeon_ep_vf: remove firmware stats fetch in ndo_get_stats64
net: avoid race between device unregistration and ethnl ops
net: sched: Disallow replacing of child qdisc from one parent to another
netfilter: nf_tables: fix set size with rbtree backend
netfilter: nft_flow_offload: update tcp state flags under lock
net: sched: refine software bypass handling in tc_run
net: ethernet: ti: am65-cpsw: fix freeing IRQ in am65_cpsw_nuss_remove_tx_chns()
tcp_cubic: fix incorrect HyStart round start detection
net/rose: prevent integer overflows in rose_setsockopt()
platform/mellanox: mlxbf-pmc: incorrect type in assignment
platform/x86: x86-android-tablets: make platform data be static
pinctrl: samsung: Fix irq handling if an error occurs in exynos_irq_demux_eint16_31()
libbpf: don't adjust USDT semaphore address if .stapsdt.base addr is missing
ASoC: cs40l50: Use *-y for Makefile
ASoC: mediatek: mt8365: Use *-y for Makefile
ASoC: wcd937x: Use *-y for Makefile
tools/testing/selftests/bpf/test_tc_tunnel.sh: Fix wait for server bind
libbpf: Fix segfault due to libelf functions not setting errno
ASoC: Intel: sof_sdw: correct mach_params->dmic_num
ASoC: sun4i-spdif: Add clock multiplier settings
selftests/bpf: Fix fill_link_info selftest on powerpc
iommu/arm-smmuv3: Update comments about ATS and bypass
crypto: tegra - do not transfer req when tegra init fails
crypto: api - Fix boot-up self-test race
crypto: caam - use JobR's space to access page 0 regs
perf header: Fix one memory leakage in process_bpf_btf()
perf header: Fix one memory leakage in process_bpf_prog_info()
perf bpf: Fix two memory leakages when calling perf_env__insert_bpf_prog_info()
ASoC: renesas: rz-ssi: Use only the proper amount of dividers
perf expr: Initialize is_test value in expr__ctx_new()
pinctrl: nomadik: Add check for clk_enable()
ktest.pl: Remove unused declarations in run_bisect_test function
bpf: bpf_local_storage: Always use bpf_mem_alloc in PREEMPT_RT
rhashtable: Fix potential deadlock by moving schedule_work outside lock
crypto: hisilicon/sec2 - fix for aead icv error
crypto: hisilicon/sec2 - fix for aead invalid authsize
crypto: ixp4xx - fix OF node reference leaks in init_ixp_crypto()
crypto: iaa - Fix IAA disabling that occurs when sync_mode is set to 'async'
bpf: Use refcount_t instead of atomic_t for mmap_count
ALSA: seq: Make dependency on UMP clearer
bpf: Reject struct_ops registration that uses module ptr and the module btf_id is missing
padata: fix sysfs store callback check
selftests/bpf: Avoid generating untracked files when running bpf selftests
perf top: Don't complain about lack of vmlinux when not resolving some kernel samples
perf maps: Fix display of kernel symbols
perf machine: Don't ignore _etext when not a text symbol
perf namespaces: Introduce nsinfo__set_in_pidns()
perf namespaces: Fixup the nsinfo__in_pidns() return type, its bool
ASoC: Intel: avs: Do not readq() u32 registers
ASoC: Intel: avs: Fix the minimum firmware version numbers
ASoC: Intel: avs: Fix theoretical infinite loop
ASoC: Intel: avs: Fix init-config parsing
perf MANIFEST: Add arch/*/include/uapi/asm/bpf_perf_event.h to the perf tarball
ALSA: hda: Fix compilation of snd_hdac_adsp_xxx() helpers
perf report: Fix misleading help message about --demangle
pinctrl: stm32: Add check for clk_enable()
pinctrl: amd: Take suspend type into consideration which pins are non-wake
perf inject: Fix use without initialization of local variables
ASoC: Intel: sof_sdw: Fix DMI match for Lenovo 83LC
ASoC: Intel: sof_sdw: Fix DMI match for Lenovo 83JX, 83MC and 83NM
bpf: Send signals asynchronously if !preemptible
selftests/bpf: Fix btf leak on new btf alloc failure in btf_distill test
libbpf: Fix return zero when elf_begin failed
libbpf: Fix incorrect traversal end type ID when marking BTF_IS_EMBEDDED
bpf: tcp: Mark bpf_load_hdr_opt() arg2 as read-write
iommu/amd: Remove unused amd_iommu_domain_update()
ALSA: hda/realtek - Fixed headphone distorted sound on Acer Aspire A115-31 laptop
tools: Sync if_xdp.h uapi tooling header
perf lock: Fix parse_lock_type which only retrieve one lock flag
padata: fix UAF in padata_reorder
padata: add pd get/put refcnt helper
padata: avoid UAF for reorder_work
rhashtable: Fix rhashtable_try_insert test
smb: client: fix oops due to unset link speed
cifs: Use cifs_autodisable_serverino() for disabling CIFS_MOUNT_SERVER_INUM in readdir.c
bpf: Cancel the running bpf_timer through kworker for PREEMPT_RT
soc: atmel: fix device_node release in atmel_soc_device_init()
ARM: at91: pm: change BU Power Switch to automatic mode
ARM: dts: imx7-tqma7: add missing vs-supply for LM75A (rev. 01xxx)
arm64: dts: mediatek: mt8186: Move wakeup to MTU3 to get working suspend
arm64: dts: mt8183: set DMIC one-wire mode on Damu
arm64: dts: mediatek: mt8516: fix GICv2 range
arm64: dts: mediatek: mt8516: fix wdt irq type
arm64: dts: mediatek: mt8516: add i2c clock-div property
arm64: dts: mediatek: mt8516: reserve 192 KiB for TF-A
ARM: dts: stm32: Increase CPU core voltage on STM32MP13xx DHCOR SoM
ARM: dts: stm32: Fix IPCC EXTI declaration on stm32mp151
RDMA/mlx4: Avoid false error about access to uninitialized gids array
arm64: dts: renesas: rzg3s-smarc: Fix the debug serial alias
rdma/cxgb4: Prevent potential integer overflow on 32bit
arm64: dts: mediatek: mt8173-evb: Drop regulator-compatible property
arm64: dts: mediatek: mt8173-elm: Drop regulator-compatible property
arm64: dts: mediatek: mt8192-asurada: Drop regulator-compatible property
arm64: dts: mediatek: mt8195-cherry: Drop regulator-compatible property
arm64: dts: mediatek: mt8195-demo: Drop regulator-compatible property
arm64: dts: medaitek: mt8395-nio-12l: Drop regulator-compatible property
arm64: dts: mediatek: mt8395-genio-1200-evk: Drop regulator-compatible property
arm64: dts: mediatek: mt8173-elm: Fix MT6397 PMIC sub-node names
arm64: dts: mediatek: mt8173-evb: Fix MT6397 PMIC sub-node names
ARM: dts: aspeed: yosemite4: correct the compatible string of adm1272
ARM: dts: aspeed: yosemite4: Add required properties for IOE on fan boards
ARM: dts: aspeed: yosemite4: correct the compatible string for max31790
arm: dts: socfpga: use reset-name "stmmaceth-ocp" instead of "ahb"
RDMA/rxe: Fix mismatched max_msg_sz
arm64: dts: mediatek: mt8183: kenzo: Support second source touchscreen
arm64: dts: mediatek: mt8183: willow: Support second source touchscreen
RDMA/srp: Fix error handling in srp_add_port
arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie1
ARM: dts: stm32: Deduplicate serial aliases and chosen node for STM32MP15xx DHCOM SoM
ARM: dts: stm32: Swap USART3 and UART8 alias on STM32MP15xx DHCOM SoM
memory: tegra20-emc: fix an OF node reference bug in tegra_emc_find_node_by_ram_code()
arm64: dts: mediatek: mt8183-kukui-jacuzzi: Drop pp3300_panel voltage settings
arm64: dts: qcom: msm8996-xiaomi-gemini: Fix LP5562 LED1 reg property
arm64: dts: qcom: sa8775p: Update sleep_clk frequency
arm64: defconfig: remove obsolete CONFIG_SM_DISPCC_8650
arm64: dts: qcom: msm8996: Fix up USB3 interrupts
arm64: dts: qcom: msm8994: Describe USB interrupts
arm64: dts: qcom: sm7225-fairphone-fp4: Drop extra qcom,msm-id value
arm64: dts: qcom: msm8916: correct sleep clock frequency
arm64: dts: qcom: msm8939: correct sleep clock frequency
arm64: dts: qcom: msm8994: correct sleep clock frequency
arm64: dts: qcom: qcs404: correct sleep clock frequency
arm64: dts: qcom: q[dr]u1000: correct sleep clock frequency
arm64: dts: qcom: qrb4210-rb2: correct sleep clock frequency
arm64: dts: qcom: sc7280: correct sleep clock frequency
arm64: dts: qcom: sdx75: correct sleep clock frequency
arm64: dts: qcom: sm4450: correct sleep clock frequency
arm64: dts: qcom: sm6125: correct sleep clock frequency
arm64: dts: qcom: sm6375: correct sleep clock frequency
arm64: dts: qcom: sm8250: correct sleep clock frequency
arm64: dts: qcom: sm8350: correct sleep clock frequency
arm64: dts: qcom: sm8450: correct sleep clock frequency
arm64: dts: qcom: sm8550: correct sleep clock frequency
arm64: dts: qcom: sm8650: correct sleep clock frequency
arm64: dts: qcom: x1e80100: correct sleep clock frequency
arm64: dts: qcom: sm8650: Fix CDSP context banks unit addresses
ARM: dts: microchip: sama5d29_curiosity: Add no-1-8-v property to sdmmc0 node
ARM: dts: microchip: sama5d27_wlsom1_ek: Add no-1-8-v property to sdmmc0 node
arm64: dts: ti: k3-am62: Remove duplicate GICR reg
arm64: dts: ti: k3-am62a: Remove duplicate GICR reg
arm64: dts: rockchip: Fix sdmmc access on rk3308-rock-s0 v1.1 boards
arm64: dts: allwinner: a64: explicitly assign clock parent for TCON0
RDMA/bnxt_re: Fix to drop reference to the mmap entry in case of error
RDMA/rtrs: Add missing deinit() call
RDMA/hns: Clean up the legacy CONFIG_INFINIBAND_HNS
ARM: omap1: Fix up the Retu IRQ on Nokia 770
arm64: dts: qcom: qcm6490-shift-otter: remove invalid orientation-switch
arm64: dts: qcom: sdm845-db845c-navigation-mezzanine: Convert mezzanine riser to dtso
arm64: dts: qcom: sdm845-db845c-navigation-mezzanine: remove disabled ov7251 camera
arm64: dts: qcom: sc7180-trogdor-quackingstick: add missing avee-supply
arm64: dts: qcom: sc7180-trogdor-pompom: rename 5v-choke thermal zone
arm64: dts: qcom: sc7180: change labels to lower-case
arm64: dts: qcom: sc7180: fix psci power domain node names
arm64: dts: qcom: sm8150-microsoft-surface-duo: fix typos in da7280 properties
arm64: dts: qcom: sc8280xp: Fix up remoteproc register space sizes
firmware: qcom: scm: Cleanup global '__scm' on probe failures
arm64: dts: mediatek: mt7988: Add missing clock-div property for i2c
dts: arm64: mediatek: mt8195: Remove MT8183 compatible for OVL
arm64: dts: mediatek: add per-SoC compatibles for keypad nodes
arm64: dts: qcom: sc8280xp: Fix interrupt type of camss interrupts
arm64: dts: qcom: sdm845: Fix interrupt types of camss interrupts
arm64: dts: qcom: sm8250: Fix interrupt types of camss interrupts
arm64: dts: marvell: cn9131-cf-solidwan: fix cp1 comphy links
ARM: dts: mediatek: mt7623: fix IR nodename
arm64: dts: rockchip: fix num-channels property of wolfvision pf5 mic
arm64: dts: ti: k3-am642-hummingboard-t: Convert overlay to board dts
fbdev: omapfb: Fix an OF node leak in dss_of_port_get_parent_device()
arm64: tegra: Fix DMA ID for SPI2
arm64: dts: qcom: x1e80100-romulus: Update firmware nodes
i3c: dw: Fix use-after-free in dw_i3c_master driver due to race condition
RDMA/mlx5: Fix indirect mkey ODP page count
of: property: Avoiding using uninitialized variable @imaplen in parse_interrupt_map()
of: reserved-memory: Do not make kmemleak ignore freed address
efi: sysfb_efi: fix W=1 warnings when EFI is not set
RDMA/cxgb4: Notify rdma stack for IB_EVENT_QP_LAST_WQE_REACHED event
RDMA/rxe: Fix the warning "__rxe_cleanup+0x12c/0x170 [rdma_rxe]"
iommu: iommufd: fix WARNING in iommufd_device_unbind
iommufd/iova_bitmap: Fix shift-out-of-bounds in iova_bitmap_offset_to_index()
spi: omap2-mcspi: Correctly handle devm_clk_get_optional() errors
of: reserved_mem: Restructure how the reserved memory regions are processed
of/fdt: Restore possibility to use both ACPI and FDT from bootloader
media: rc: iguanair: handle timeouts
media: lmedm04: Handle errors for lme2510_int_read
PCI: endpoint: Destroy the EPC device in devm_pci_epc_destroy()
remoteproc: mtk_scp: Only populate devices for SCP cores
media: marvell: Add check for clk_enable()
media: i2c: imx290: Register 0x3011 varies between imx327 and imx290
media: i2c: imx412: Add missing newline to prints
media: i2c: ov9282: Correct the exposure offset
media: mipi-csis: Add check for clk_enable()
media: camif-core: Add check for clk_enable()
media: uvcvideo: Propagate buf->error to userspace
mtd: rawnand: brcmnand: fix status read of brcmnand_waitfunc
mtd: hyperbus: hbmc-am654: fix an OF node reference leak
media: nxp: imx8-isi: fix v4l2-compliance test errors
watchdog: rti_wdt: Fix an OF node leak in rti_wdt_probe()
staging: media: imx: fix OF node leak in imx_media_add_of_subdevs()
media: dvb-usb-v2: af9035: fix ISO C90 compilation error on af9035_i2c_master_xfer
PCI: rcar-ep: Fix incorrect variable used when calling devm_request_mem_region()
PCI: imx6: Configure PHY based on Root Complex or Endpoint mode
PCI: imx6: Skip controller_id generation logic for i.MX7D
PCI: imx6: Deassert apps_reset in imx_pcie_deassert_core_reset()
PCI: imx6: Add missing reference clock disable logic
PCI: qcom: Update ICC and OPP values after Link Up event
PCI: dwc: Always stop link in the dw_pcie_suspend_noirq
PCI: endpoint: pci-epf-test: Set dma_chan_rx pointer to NULL on error
PCI: endpoint: pci-epf-test: Fix check for DMA MEMCPY test
PCI: microchip: Add support for using either Root Port 1 or 2
PCI: microchip: Set inbound address translation for coherent or non-coherent mode
scsi: mpt3sas: Set ioc->manu_pg11.EEDPTagMode directly to 1
scsi: ufs: bsg: Delete bsg_dev when setting up bsg fails
scsi: mpi3mr: Fix possible crash when setting up bsg fails
firewire: test: Fix potential null dereference in firewire kunit test
erofs: get rid of erofs_{find,insert}_workgroup
erofs: move erofs_workgroup operations into zdata.c
erofs: sunset `struct erofs_workgroup`
erofs: fix potential return value overflow of z_erofs_shrink_scan()
ocfs2: mark dquot as inactive if failed to start trans while releasing dquot
nilfs2: do not force clear folio if buffer is referenced
nilfs2: protect access to buffers with no active references
nilfs2: handle errors that nilfs_prepare_chunk() may return
module: Extend the preempt disabled section in dereference_symbol_descriptor().
module: Don't fail module loading when setting ro_after_init section RO failed
driver core: class: Fix wild pointer dereferences in API class_dev_iter_next()
tty: mips_ejtag_fdc: fix one more u8 warning
serial: 8250: Adjust the timeout for FIFO mode
nfs: fix incorrect error handling in LOCALIO
NFSv4.2: fix COPY_NOTIFY xdr buf size calculation
NFSv4.2: mark OFFLOAD_CANCEL MOVEABLE
LoongArch: Fix warnings during S3 suspend
tools/bootconfig: Fix the wrong format specifier
xfrm: replay: Fix the update of replay_esn->oseq_hi for GSO
xfrm: Add support for per cpu xfrm state handling.
xfrm: Cache used outbound xfrm states at the policy.
xfrm: Add an inbound percpu state cache.
xfrm: state: fix out-of-bounds read during lookup
dmaengine: ti: edma: fix OF node reference leaks in edma_driver
xfrm: delete intermediate secpath entry in packet offload mode
rtc: tps6594: Fix integer overflow on 32bit systems
rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read
rtc: loongson: clear TOY_MATCH0_REG in loongson_rtc_isr()
ubifs: skip dumping tnc tree when zroot is null
regulator: core: Add missing newline character
net: airoha: Fix wrong GDM4 register definition
net: hns3: fix oops when unload drivers paralleling
gpio: mxc: remove dead code after switch to DT-only
net: phy: marvell-88q2xxx: Fix temperature measurement with reset-gpios
net: fec: implement TSO descriptor cleanup
ipmr: do not call mr_mfc_uses_dev() for unres entries
PM: hibernate: Add error handling for syscore_suspend()
perf trace: Fix BPF loading failure (-E2BIG)
xfrm: Don't disable preemption while looking up cache state.
idpf: add read memory barrier when checking descriptor done bit
idpf: fix transaction timeouts on reset
idpf: Acquire the lock before accessing the xn->salt
idpf: convert workqueues to unbound
ice: fix ice_parser_rt::bst_key array size
ice: rework of dump serdes equalizer values feature
ice: extend dump serdes equalizer values feature
ice: remove invalid parameter of equalizer
iavf: allow changing VLAN state without calling PF
s390/mm: Allow large pages for KASAN shadow mapping
net/ncsi: use dev_set_mac_address() for Get MC MAC Address handling
net: rose: fix timer races against user threads
net: netdevsim: try to close UDP port harness races
tools: ynl: c: correct reverse decode of empty attrs
selftests: mptcp: extend CFLAGS to keep options from environment
selftests: net/{lib,openvswitch}: extend CFLAGS to keep options from environment
rxrpc, afs: Fix peer hash locking vs RCU callback
vxlan: Fix uninit-value in vxlan_vnifilter_dump()
net: davicom: fix UAF in dm9000_drv_remove
ptp: Properly handle compat ioctls
net: ethtool: only allow set_rxnfc with rss + ring_cookie if driver opts in
ethtool: Fix set RXNFC command with symmetric RSS hash
net: stmmac: Limit the number of MTL queues to hardware capability
net: stmmac: Limit FIFO size by hardware capability
s390/sclp: Initialize sclp subsystem via arch_cpu_finalize_init()
perf trace: Fix runtime error of index out of bounds
perf test: Skip syscall enum test if no landlock syscall
Bluetooth: btusb: mediatek: Add locks for usb_driver_claim_interface()
Bluetooth: btnxpuart: Fix glitches seen in dual A2DP streaming
vsock: Allow retrying on connect() failure
bgmac: reduce max frame size to support just MTU 1500
tcp: correct handling of extreme memory squeeze
net: xdp: Disallow attaching device-bound programs in generic mode
net: ravb: Fix missing rtnl lock in suspend/resume path
net: sh_eth: Fix missing rtnl lock in suspend/resume path
net: hsr: fix fill_frame_info() regression vs VLAN packets
genksyms: fix memory leak when the same symbol is added from source
genksyms: fix memory leak when the same symbol is read from *.symref file
hostfs: fix string handling in __dentry_name()
tools/power turbostat: Allow using cpu device in perf counters on hybrid platforms
tools/power turbostat: Fix PMT mmaped file size rounding
RISC-V: Mark riscv_v_init() as __init
ASoC: rockchip: i2s_tdm: Re-add the set_sysclk callback
io_uring/uring_cmd: use cached cmd_op in io_uring_cmd_sock()
ASoC: amd: acp: Fix possible deadlock
tools/power turbostat: Fix forked child affinity regression
cifs: Validate EAs for WSL reparse points
cifs: Fix getting and setting SACLs over SMB1
kconfig: fix file name in warnings when loading KCONFIG_DEFCONFIG_LIST
kconfig: fix memory leak in sym_warn_unmet_dep()
hexagon: fix using plain integer as NULL pointer warning in cmpxchg
hexagon: Fix unbalanced spinlock in die()
f2fs: Introduce linear search for dentries
md/md-bitmap: factor behind write counters out from bitmap_{start/end}write()
md/md-bitmap: remove the last parameter for bimtap_ops->endwrite()
md: add a new callback pers->bitmap_sector()
md/raid5: implement pers->bitmap_sector()
md/md-bitmap: move bitmap_{start, end}write to md upper layer
Revert "SUNRPC: Reduce thread wake-up rate when receiving large RPC messages"
kbuild: switch from lz4c to lz4 for compression
netfilter: nf_tables: reject mismatching sum of field_len with set key length
drm/amd/display: Reduce accessing remote DPCD overhead
selftests/rseq: Fix handling of glibc without rseq support
selftests/ftrace: Fix to use remount when testing mount GID option
ktest.pl: Check kernelrelease return in get_version
xfs: check for dead buffers in xfs_buf_find_insert
xfs: don't shut down the filesystem for media failures beyond end of log
ALSA: usb-audio: Add delay quirk for iBasso DC07 Pro
net: usb: rtl8150: enable basic endpoint checking
usb: xhci: Fix NULL pointer dereference on certain command aborts
drivers/card_reader/rtsx_usb: Restore interrupt based detection
usb: gadget: f_tcm: Fix Get/SetInterface return value
usb: dwc3-am62: Fix an OF node leak in phy_syscon_pll_refclk()
usb: dwc3: core: Defer the probe until USB power supply ready
usb: dwc3: Skip resume if pm_runtime_set_active() fails
usb: typec: tcpm: set SRC_SEND_CAPABILITIES timeout to PD_T_SENDER_RESPONSE
usb: typec: tcpci: Prevent Sink disconnection before vPpsShutdown in SPR PPS
clk: qcom: gcc-x1e80100: Do not turn off usb_2 controller GDSC
mptcp: consolidate suboption status
mptcp: pm: only set fullmesh for subflow endp
mptcp: handle fastopen disconnect correctly
mptcp: blackhole only if 1st SYN retrans w/o MPC is accepted
RDMA/mlx5: Fix implicit ODP use after free
remoteproc: core: Fix ida_free call while not allocated
media: uvcvideo: Fix double free in error path
pps: Fix a use-after-free
usb: gadget: f_tcm: Don't free command immediately
staging: media: max96712: fix kernel oops when removing module
media: imx-jpeg: Fix potential error pointer dereference in detach_pm()
powerpc/pseries/iommu: Don't unset window if it was never set
md/md-bitmap: Synchronize bitmap_get_stats() with bitmap lifetime
btrfs: output the reason for open_ctree() failure
of: reserved-memory: Warn for missing static reserved memory regions
dma-mapping: save base/size instead of pointer to shared DMA pool
xfrm: Add error handling when nla_put_u32() returns an error
xfrm: Fix acquire state insertion.
ethtool: Fix access to uninitialized fields in set RXNFC command
Revert "s390/mm: Allow large pages for KASAN shadow mapping"
selftests/bpf: Add test to verify tailcall and freplace restrictions
ASoC: da7213: Initialize the mutex
s390: Add '-std=gnu11' to decompressor and purgatory CFLAGS
drm/amd/display: Add hubp cache reset when powergating
KVM: x86: Plumb in the vCPU to kvm_x86_ops.hwapic_isr_update()
memcg: fix soft lockup in the OOM process
LoongArch: Change 8 to 14 for LOONGARCH_MAX_{BRP,WRP}
btrfs: do proper folio cleanup when run_delalloc_nocow() failed
ethtool: ntuple: fix rss + ring_cookie check
Linux 6.12.13
Change-Id: I0b4278d2911ea7c72e068418ed56d1514b393980
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
commit 1b9335a8000fb70742f7db10af314104b6ace220 upstream.
The field length description provides the length of each separated key
field in the concatenation, each field gets rounded up to 32-bits to
calculate the pipapo rule width from pipapo_init(). The set key length
provides the total size of the key aligned to 32-bits.
Register-based arithmetics still allows for combining mismatching set
key length and field length description, eg. set key length 10 and field
description [ 5, 4 ] leading to pipapo width of 12.
Cc: stable@vger.kernel.org
Fixes: 3ce67e3793 ("netfilter: nf_tables: do not allow mismatch field size and set key length")
Reported-by: Noam Rathaus <noamr@ssd-disclosure.com>
Reviewed-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ Upstream commit 7a4b61406395291ffb7220a10e8951a9a8684819 ]
The conntrack entry is already public, there is a small chance that another
CPU is handling a packet in reply direction and racing with the tcp state
update.
Move this under ct spinlock.
This is done once, when ct is about to be offloaded, so this should
not result in a noticeable performance hit.
Fixes: 8437a6209f ("netfilter: nft_flow_offload: set liberal tracking mode for tcp")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 8d738c1869f611955d91d8d0fd0012d9ef207201 ]
The existing rbtree implementation uses singleton elements to represent
ranges, however, userspace provides a set size according to the number
of ranges in the set.
Adjust provided userspace set size to the number of singleton elements
in the kernel by multiplying the range by two.
Check if the no-match all-zero element is already in the set, in such
case release one slot in the set size.
Fixes: 0ed6389c48 ("netfilter: nf_tables: rename set implementations")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
GKI (arm64) relevant 50 out of 186 changes, affecting 60 files +397/-205
56c4353ce4 jbd2: increase IO priority for writing revoke records [1 file, +1/-1]
a5bc868610 jbd2: flush filesystem device before updating tail sequence [1 file, +2/-2]
7adf7df4bb iomap: pass byte granular end position to iomap_add_to_ioend [1 file, +12/-9]
82c59a86a2 iomap: fix zero padding data issue in concurrent append writes [2 files, +46/-1]
88ecdfea1b netfs: Fix enomem handling in buffered reads [1 file, +16/-12]
2c3348864a netfs: Fix missing barriers by using clear_and_wake_up_bit() [2 files, +4/-8]
43b8d3249b netfs: Fix ceph copy to cache on write-begin [1 file, +4/-2]
ba37bdfe59 netfs: Fix the (non-)cancellation of copy when cache is temporarily disabled [1 file, +4/-0]
6f153055ba netfs: Fix is-caching check in read-retry [2 files, +1/-2]
d9ea94f5cd exfat: fix the infinite loop in exfat_readdir() [1 file, +2/-1]
942c6f91ab exfat: fix the new buffer was not zeroed before writing [1 file, +6/-0]
0bebeb6672 exfat: fix the infinite loop in __exfat_free_cluster() [1 file, +10/-0]
c0f613f214 fuse: respect FOPEN_KEEP_CACHE on opendir [1 file, +2/-0]
668d8dea2c ovl: pass realinode to ovl_encode_real_fh() instead of realdentry [4 files, +12/-10]
3c7c90274a ovl: support encoding fid from inode with no alias [1 file, +25/-21]
a3a9630d4d net: 802: LLC+SNAP OID:PID lookup on start of skb data [1 file, +2/-2]
e4a92f0d51 tcp/dccp: allow a connection when sk_max_ack_backlog is zero [1 file, +1/-1]
6fde663f73 net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute [1 file, +2/-1]
61b437faf2 net: don't dump Tx and uninitialized NAPIs [1 file, +3/-2]
52a24538d5 ipvlan: Fix use-after-free in ipvlan_get_iflink(). [1 file, +7/-3]
ccc1ef1884 Bluetooth: hci_sync: Fix not setting Random Address when required [1 file, +6/-5]
1f88b53135 Bluetooth: MGMT: Fix Add Device to responding before completing [1 file, +36/-2]
8b800ea3f3 tcp: Annotate data-race around sk->sk_mark in tcp_v4_send_reset [1 file, +1/-1]
f559357d03 netfilter: conntrack: clamp maximum hashtable size to INT_MAX [1 file, +4/-1]
9f3a265836 netfs: Fix kernel async DIO [1 file, +6/-1]
3f545392e9 netfs: Fix read-retry for fs with no ->prepare_read() [1 file, +2/-1]
adcde2872f fs: relax assertions on failure to encode file handles [2 files, +3/-6]
8790d511d4 fs: fix is_mnt_ns_file() [1 file, +8/-2]
fc89438866 dm-verity FEC: Fix RS FEC repair for roots unaligned to block size (take 2) [1 file, +26/-14]
dc63fd2e47 cgroup/cpuset: Prevent leakage of isolated CPUs into sched domains [2 files, +28/-15]
5b80f2fe8a thermal: of: fix OF node leak in of_thermal_zone_find() [1 file, +1/-0]
11cb1d643a cgroup/cpuset: remove kernfs active break [1 file, +0/-25]
2b30bffd9a io_uring/timeout: fix multishot updates [1 file, +3/-1]
aa7496d668 io_uring/sqpoll: zero sqd->thread on tctx errors [1 file, +5/-1]
360596e7fe topology: Keep the cpumask unchanged when printing cpumap [1 file, +20/-4]
07f09383b1 tty: serial: 8250: Fix another runtime PM usage counter underflow [1 file, +3/-0]
8e122d780a usb: gadget: u_serial: Disable ep before setting port to null to fix the crash caused by port being null [1 file, +4/-4]
e982fcb440 USB: core: Disable LPM only for non-suspended ports [1 file, +4/-3]
4fb62dea06 usb: fix reference leak in usb_new_device() [1 file, +4/-2]
8586d6ea62 usb: typec: tcpci: fix NULL pointer issue on shared irq case [1 file, +15/-10]
4bb6450bfd usb: gadget: f_uac2: Fix incorrect setting of bNumEndpoints [1 file, +1/-0]
a8b6a18b9b usb: gadget: f_fs: Remove WARN_ON in functionfs_bind [1 file, +1/-1]
62aa896683 usb: gadget: configfs: Ignore trailing LF for user strings to cdev [1 file, +5/-1]
a25f1e6f60 usb: host: xhci-plat: set skip_phy_initialization if software node has XHCI_SKIP_PHY_INIT property [1 file, +2/-1]
b44c99621d iio: inkern: call iio_device_put() only on mapped devices [1 file, +1/-1]
a7085c3ae4 io_uring/eventfd: ensure io_eventfd_signal() defers another RCU period [1 file, +1/-1]
bc2aeb35ff block, bfq: fix waker_bfqq UAF after bfq_split_bfqq() [1 file, +10/-2]
810aad1d7f firewall: remove misplaced semicolon from stm32_firewall_get_firewall [1 file, +1/-1]
476e4c4a1a io_uring: don't touch sqd->thread off tw add [1 file, +1/-4]
b683ba0df1 netdev: prevent accessing NAPI instances from another namespace [3 files, +33/-17]
Changes in 6.12.10
jbd2: increase IO priority for writing revoke records
jbd2: flush filesystem device before updating tail sequence
fs/writeback: convert wbc_account_cgroup_owner to take a folio
iomap: pass byte granular end position to iomap_add_to_ioend
iomap: fix zero padding data issue in concurrent append writes
dm array: fix releasing a faulty array block twice in dm_array_cursor_end
dm array: fix unreleased btree blocks on closing a faulty array cursor
dm array: fix cursor index when skipping across block boundaries
netfs: Fix enomem handling in buffered reads
nfs: Fix oops in nfs_netfs_init_request() when copying to cache
netfs: Fix missing barriers by using clear_and_wake_up_bit()
netfs: Fix ceph copy to cache on write-begin
netfs: Fix the (non-)cancellation of copy when cache is temporarily disabled
netfs: Fix is-caching check in read-retry
exfat: fix the infinite loop in exfat_readdir()
exfat: fix the new buffer was not zeroed before writing
exfat: fix the infinite loop in __exfat_free_cluster()
fuse: respect FOPEN_KEEP_CACHE on opendir
ovl: pass realinode to ovl_encode_real_fh() instead of realdentry
ovl: support encoding fid from inode with no alias
ASoC: rt722: add delay time to wait for the calibration procedure
ASoC: mediatek: disable buffer pre-allocation
selftests/alsa: Fix circular dependency involving global-timer
ieee802154: ca8210: Add missing check for kfifo_alloc() in ca8210_probe()
net: 802: LLC+SNAP OID:PID lookup on start of skb data
tcp/dccp: allow a connection when sk_max_ack_backlog is zero
net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute
net: libwx: fix firmware mailbox abnormal return
btrfs: avoid NULL pointer dereference if no valid extent tree
pds_core: limit loop over fw name list
bnxt_en: Fix possible memory leak when hwrm_req_replace fails
bnxt_en: Fix DIM shutdown
cxgb4: Avoid removal of uninserted tid
net: don't dump Tx and uninitialized NAPIs
ice: fix max values for dpll pin phase adjust
ice: fix incorrect PHY settings for 100 GB/s
igc: return early when failing to read EECD register
tls: Fix tls_sw_sendmsg error handling
ipvlan: Fix use-after-free in ipvlan_get_iflink().
eth: gve: use appropriate helper to set xdp_features
Bluetooth: hci_sync: Fix not setting Random Address when required
Bluetooth: MGMT: Fix Add Device to responding before completing
Bluetooth: btnxpuart: Fix driver sending truncated data
Bluetooth: btmtk: Fix failed to send func ctrl for MediaTek devices.
tcp: Annotate data-race around sk->sk_mark in tcp_v4_send_reset
net: hns3: fixed reset failure issues caused by the incorrect reset type
net: hns3: fix missing features due to dev->features configuration too early
net: hns3: Resolved the issue that the debugfs query result is inconsistent.
net: hns3: don't auto enable misc vector
net: hns3: initialize reset_timer before hclgevf_misc_irq_init()
net: hns3: fixed hclge_fetch_pf_reg accesses bar space out of bounds issue
net: hns3: fix kernel crash when 1588 is sent on HIP08 devices
mctp i3c: fix MCTP I3C driver multi-thread issue
netfilter: nf_tables: imbalance in flowtable binding
netfilter: conntrack: clamp maximum hashtable size to INT_MAX
sched: sch_cake: add bounds checks to host bulk flow fairness counts
net: stmmac: dwmac-tegra: Read iommu stream id from device tree
rtase: Fix a check for error in rtase_alloc_msix()
net/mlx5: Fix variable not being completed when function returns
drm/mediatek: Set private->all_drm_private[i]->drm to NULL if mtk_drm_bind returns err
drm/mediatek: Move mtk_crtc_finish_page_flip() to ddp_cmdq_cb()
drm/mediatek: Add support for 180-degree rotation in the display driver
drm/mediatek: stop selecting foreign drivers
drm/mediatek: Fix YCbCr422 color format issue for DP
drm/mediatek: Fix mode valid issue for dp
drm/mediatek: mtk_dsi: Add registers to pdata to fix MT8186/MT8188
gpio: virtuser: fix missing lookup table cleanups
gpio: virtuser: fix handling of multiple conn_ids in lookup table
drm/mediatek: Add return value check when reading DPCD
ksmbd: fix a missing return value check bug
afs: Fix the maximum cell name length
platform/x86/amd/pmc: Only disable IRQ1 wakeup where i8042 actually enabled it
platform/x86: intel/pmc: Fix ioremap() of bad address
ksmbd: fix unexpectedly changed path in ksmbd_vfs_kern_path_locked
riscv: module: remove relocation_head rel_entry member allocation
cpuidle: riscv-sbi: fix device node release in early exit of for_each_possible_cpu
riscv: mm: Fix the out of bound issue of vmemmap address
riscv: stacktrace: fix backtracing through exceptions
riscv: use local label names instead of global ones in assembly
drm/xe: Fix tlb invalidation when wedging
netfs: Fix kernel async DIO
netfs: Fix read-retry for fs with no ->prepare_read()
drivers/perf: riscv: Fix Platform firmware event data
drivers/perf: riscv: Return error for default case
dm thin: make get_first_thin use rcu-safe list first function
scsi: ufs: qcom: Power off the PHY if it was already powered on in ufs_qcom_power_up_sequence()
vfio/pci: Fallback huge faults for unaligned pfn
fs: relax assertions on failure to encode file handles
fs: fix is_mnt_ns_file()
dm-ebs: don't set the flag DM_TARGET_PASSES_INTEGRITY
dm-verity FEC: Fix RS FEC repair for roots unaligned to block size (take 2)
mptcp: sysctl: avail sched: remove write access
mptcp: sysctl: sched: avoid using current->nsproxy
mptcp: sysctl: blackhole timeout: avoid using current->nsproxy
sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy
sctp: sysctl: rto_min/max: avoid using current->nsproxy
sctp: sysctl: auth_enable: avoid using current->nsproxy
sctp: sysctl: udp_port: avoid using current->nsproxy
sctp: sysctl: plpmtud_probe_interval: avoid using current->nsproxy
rds: sysctl: rds_tcp_{rcv,snd}buf: avoid using current->nsproxy
ksmbd: Implement new SMB3 POSIX type
btrfs: zlib: fix avail_in bytes for s390 zlib HW compression path
Revert "drm/mediatek: dsi: Correct calculation formula of PHY Timing"
drm/amd/display: Remove unnecessary amdgpu_irq_get/put
drm/amd/display: Add check for granularity in dml ceil/floor helpers
cgroup/cpuset: Prevent leakage of isolated CPUs into sched domains
thermal: of: fix OF node leak in of_thermal_zone_find()
sched_ext: Replace rq_lock() to raw_spin_rq_lock() in scx_ops_bypass()
sched_ext: switch class when preempted by higher priority scheduler
cgroup/cpuset: remove kernfs active break
sched_ext: idle: Refresh idle masks during idle-to-idle transitions
arm64: dts: qcom: x1e80100: Fix up BAR space size for PCIe6a
arm64: dts: qcom: sa8775p: Fix the size of 'addr_space' regions
smb: client: sync the root session and superblock context passwords before automounting
fs: kill MNT_ONRB
riscv: Fix sleeping in invalid context in die()
riscv: kprobes: Fix incorrect address calculation
gpio: loongson: Fix Loongson-2K2000 ACPI GPIO register offset
ACPI: resource: Add TongFang GM5HG0A to irq1_edge_low_force_override[]
ACPI: resource: Add Asus Vivobook X1504VAP to irq1_level_low_skip_override[]
drm/amdgpu: Add a lock when accessing the buddy trim function
drm/amd/pm: fix BUG: scheduling while atomic
drm/amdkfd: fixed page fault when enable MES shader debugger
drm/amdkfd: wq_release signals dma_fence only when available
drm/amd/display: fix divide error in DM plane scale calcs
drm/amd/display: fix page fault due to max surface definition mismatch
drm/amd/display: increase MAX_SURFACES to the value supported by hw
io_uring/timeout: fix multishot updates
io_uring/sqpoll: zero sqd->thread on tctx errors
USB: serial: option: add MeiG Smart SRM815
USB: serial: option: add Neoway N723-EA support
staging: iio: ad9834: Correct phase range check
staging: iio: ad9832: Correct phase range check
usb-storage: Add max sectors quirk for Nokia 208
USB: serial: cp210x: add Phoenix Contact UPS Device
usb: dwc3: gadget: fix writing NYET threshold
topology: Keep the cpumask unchanged when printing cpumap
misc: microchip: pci1xxxx: Resolve kernel panic during GPIO IRQ handling
misc: microchip: pci1xxxx: Resolve return code mismatch during GPIO set config
tty: serial: 8250: Fix another runtime PM usage counter underflow
serial: stm32: use port lock wrappers for break control
usb: gadget: u_serial: Disable ep before setting port to null to fix the crash caused by port being null
x86/fpu: Ensure shadow stack is active before "getting" registers
usb: dwc3-am62: Disable autosuspend during remove
USB: usblp: return error when setting unsupported protocol
USB: core: Disable LPM only for non-suspended ports
usb: fix reference leak in usb_new_device()
usb: gadget: midi2: Reverse-select at the right place
usb: chipidea: ci_hdrc_imx: decrement device's refcount in .remove() and in the error path of .probe()
usb: typec: tcpci: fix NULL pointer issue on shared irq case
usb: gadget: f_uac2: Fix incorrect setting of bNumEndpoints
usb: typec: tcpm/tcpci_maxim: fix error code in max_contaminant_read_resistance_kohm()
usb: gadget: f_fs: Remove WARN_ON in functionfs_bind
usb: gadget: configfs: Ignore trailing LF for user strings to cdev
usb: host: xhci-plat: set skip_phy_initialization if software node has XHCI_SKIP_PHY_INIT property
usb: typec: fix pm usage counter imbalance in ucsi_ccg_sync_control()
iio: pressure: zpa2326: fix information leak in triggered buffer
iio: dummy: iio_simply_dummy_buffer: fix information leak in triggered buffer
iio: light: vcnl4035: fix information leak in triggered buffer
iio: light: bh1745: fix information leak in triggered buffer
iio: imu: kmx61: fix information leak in triggered buffer
iio: adc: rockchip_saradc: fix information leak in triggered buffer
iio: adc: ti-ads8688: fix information leak in triggered buffer
iio: adc: ti-ads1119: fix information leak in triggered buffer
iio: adc: ti-ads1119: fix sample size in scan struct for triggered buffer
iio: gyro: fxas21002c: Fix missing data update in trigger handler
iio: adc: ti-ads1298: Add NULL check in ads1298_init
iio: imu: inv_icm42600: fix timestamps after suspend if sensor is on
iio: adc: ti-ads124s08: Use gpiod_set_value_cansleep()
iio: adc: at91: call input_free_device() on allocated iio_dev
iio: inkern: call iio_device_put() only on mapped devices
iio: adc: ad7173: fix using shared static info struct
iio: adc: ad7124: Disable all channels at probe time
io_uring/eventfd: ensure io_eventfd_signal() defers another RCU period
arm64: dts: imx95: correct the address length of netcmix_blk_ctrl
ARM: dts: imxrt1050: Fix clocks for mmc
arm64: dts: qcom: sa8775p: fix the secure device bootup issue
hwmon: (drivetemp) Fix driver producing garbage data when SCSI errors occur
block, bfq: fix waker_bfqq UAF after bfq_split_bfqq()
arm64: dts: rockchip: add hevc power domain clock to rk3328
firewall: remove misplaced semicolon from stm32_firewall_get_firewall
drm/mediatek: Only touch DISP_REG_OVL_PITCH_MSB if AFBC is supported
io_uring: don't touch sqd->thread off tw add
iio: imu: inv_icm42600: fix spi burst write not supported
netdev: prevent accessing NAPI instances from another namespace
Linux 6.12.10
Change-Id: Ie2f94fe090d61be2389c21427b56a19ec5f88bd6
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
[ Upstream commit b541ba7d1f5a5b7b3e2e22dc9e40e18a7d6dbc13 ]
Use INT_MAX as maximum size for the conntrack hashtable. Otherwise, it
is possible to hit WARN_ON_ONCE in __kvmalloc_node_noprof() when
resizing hashtable because __GFP_NOWARN is unset. See:
0708a0afe2 ("mm: Consider __GFP_NOWARN flag for oversized kvmalloc() calls")
Note: hashtable resize is only possible from init_netns.
Fixes: 9cc1c73ad6 ("netfilter: conntrack: avoid integer overflow when resizing")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 13210fc63f353fe78584048079343413a3cdf819 ]
All these cases cause imbalance between BIND and UNBIND calls:
- Delete an interface from a flowtable with multiple interfaces
- Add a (device to a) flowtable with --check flag
- Delete a netns containing a flowtable
- In an interactive nft session, create a table with owner flag and
flowtable inside, then quit.
Fix it by calling FLOW_BLOCK_UNBIND when unregistering hooks, then
remove late FLOW_BLOCK_UNBIND call when destroying flowtable.
Fixes: ff4bf2f42a ("netfilter: nf_tables: add nft_unregister_flowtable_hook()")
Reported-by: Phil Sutter <phil@nwl.cc>
Tested-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
GKI (arm64) relevant 43 out of 161 changes, affecting 62 files +519/-460
5dbe6816c4 sched/fair: Fix NEXT_BUDDY [1 file, +2/-5]
0ee98301f1 sched/fair: Fix sched_can_stop_tick() for fair tasks [1 file, +1/-1]
0653fa6ee0 erofs: fix PSI memstall accounting [1 file, +2/-2]
bdd68033d1 sched/dlserver: Fix dlserver double enqueue [3 files, +18/-2]
baedaacee1 sched/dlserver: Fix dlserver time accounting [1 file, +9/-6]
910798ecd3 erofs: add erofs_sb_free() helper [1 file, +19/-17]
3e0d81efcb erofs: use `struct erofs_device_info` for the primary device [4 files, +22/-31]
f067d3f69d erofs: reference `struct erofs_device_info` for erofs_map_dev [4 files, +15/-23]
3042448109 erofs: use buffered I/O for file-backed mounts by default [3 files, +21/-10]
d924c8afe6 netdev: fix repeated netlink messages in queue dump [1 file, +4/-7]
b38e858ab0 netdev: fix repeated netlink messages in queue stats [1 file, +2/-2]
57ed6505ba netdev-genl: avoid empty messages in queue dump [1 file, +2/-2]
aa9e573145 net: mdiobus: fix an OF node reference leak [1 file, +10/-3]
20bf32f482 irqchip/gic-v3: Work around insecure GIC integrations [1 file, +16/-1]
ea78f77f78 KVM: arm64: Do not allow ID_AA64MMFR0_EL1.ASIDbits to be overridden [1 file, +2/-1]
4f393ea1e2 net: tun: fix tun_napi_alloc_frags() [1 file, +1/-1]
97701315e3 block: Revert "block: Fix potential deadlock while freezing queue and acquiring sysfs_lock" [3 files, +23/-26]
7ccad1ee83 xhci: Turn NEC specific quirk for handling Stop Endpoint errors generic [1 file, +0/-2]
47c8b6cf1d drm/modes: Avoid divide by zero harder in drm_mode_vrefresh() [1 file, +7/-4]
c8395bfcd0 dma-buf: Fix __dma_buf_debugfs_list_del argument for !CONFIG_DEBUG_FS [1 file, +1/-1]
b5792c162d block: avoid to reuse `hctx` not removed from cpuhp callback list [1 file, +10/-1]
1828714c09 trace/ring-buffer: Do not use TP_printk() formatting for boot mapped buffers [1 file, +9/-0]
6d91e90cfc zram: refuse to use zero sized block device as backing device [1 file, +6/-0]
6fb92e9a52 zram: fix uninitialized ZRAM not releasing backing device [1 file, +4/-5]
ad7c9f1f43 vmalloc: fix accounting with i915 [1 file, +4/-2]
4234ca9884 mm/page_alloc: don't call pfn_to_page() on possibly non-existent PFN in split_large_buddy() [1 file, +4/-2]
ec12f30fe5 ring-buffer: Fix overflow in __rb_map_vma [1 file, +5/-1]
9667c91464 alloc_tag: fix set_codetag_empty() when !CONFIG_MEM_ALLOC_PROFILING_DEBUG [1 file, +6/-1]
3985cd3047 tracing: Fix test_event_printk() to process entire print argument [1 file, +53/-29]
71a613ceac tracing: Add missing helper functions in event pointer dereference check [1 file, +19/-2]
683eccacc0 tracing: Add "%s" check in test_event_printk() [1 file, +89/-15]
d3e73fe7ca tracing: Check "%s" dereference via the field and not the TP_printk format [5 files, +88/-217]
06eb089489 io_uring: Fix registered ring file refcount leak [2 files, +2/-3]
4f95a2186b io_uring: check if iowq is killed before queuing [1 file, +5/-1]
2976661ed4 of/irq: Fix interrupt-map cell length check in of_irq_parse_imap_parent() [1 file, +1/-0]
e30e72844c of/irq: Fix using uninitialized variable @addr_len in API of_irq_parse_one() [1 file, +1/-0]
e0d9c581ac of: property: fw_devlink: Do not use interrupt-parent directly [1 file, +0/-2]
501d686391 of: address: Preserve the flags portion on 1:1 dma-ranges mapping [1 file, +2/-1]
c62318587c of: Fix error path in of_parse_phandle_with_args_map() [1 file, +10/-5]
adc4b70fb6 of: Fix refcount leakage for OF node returned by __of_get_dma_parent() [1 file, +1/-1]
a095090b70 mm: shmem: fix ShmemHugePages at swapout [1 file, +12/-10]
a086c8d7f2 mm: convert partially_mapped set/clear operations to be atomic [2 files, +6/-14]
2d129beb8d epoll: Add synchronous wakeup support for ep_poll_callback [2 files, +5/-1]
Changes in 6.12.7
net: sched: fix ordering of qlen adjustment
net: stmmac: fix TSO DMA API usage causing oops
firmware: arm_scmi: Fix i.MX build dependency
firmware: arm_ffa: Fix the race around setting ffa_dev->properties
RISC-V: KVM: Fix csr_write -> csr_set for HVIEN PMU overflow bit
sched/fair: Fix NEXT_BUDDY
sched/fair: Fix sched_can_stop_tick() for fair tasks
sched/eevdf: More PELT vs DELAYED_DEQUEUE
p2sb: Factor out p2sb_read_from_cache()
p2sb: Introduce the global flag p2sb_hidden_by_bios
p2sb: Move P2SB hide and unhide code to p2sb_scan_and_cache()
p2sb: Do not scan and remove the P2SB device when it is unhidden
i2c: pnx: Fix timeout in wait functions
s390/ipl: Fix never less than zero warning
erofs: fix PSI memstall accounting
sched/dlserver: Fix dlserver double enqueue
sched/dlserver: Fix dlserver time accounting
s390/mm: Consider KMSAN modules metadata for paging levels
erofs: add erofs_sb_free() helper
erofs: use `struct erofs_device_info` for the primary device
erofs: reference `struct erofs_device_info` for erofs_map_dev
erofs: use buffered I/O for file-backed mounts by default
xfs: sb_spino_align is not verified
xfs: fix sparse inode limits on runt AG
xfs: fix off-by-one error in fsmap's end_daddr usage
xfs: fix sb_spino_align checks for large fsblock sizes
xfs: fix zero byte checking in the superblock scrubber
tools: hv: change permissions of NetworkManager configuration file
cxl/pci: Fix potential bogus return value upon successful probing
cxl/region: Fix region creation for greater than x2 switches
net/smc: protect link down work from execute after lgr freed
net/smc: check sndbuf_space again after NOSPACE flag is set in smc_poll
net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg
net/smc: check v2_ext_offset/eid_cnt/ism_gid_cnt when receiving proposal msg
net/smc: check smcd_v2_ext_offset when receiving proposal msg
net/smc: check return value of sock_recvmsg when draining clc data
net: mscc: ocelot: fix incorrect IFH SRC_PORT field in ocelot_ifh_set_basic()
netdevsim: prevent bad user input in nsim_dev_health_break_write()
tools/net/ynl: fix sub-message key lookup for nested attributes
ionic: Fix netdev notifier unregister on failure
ionic: no double destroy workqueue
ionic: use ee->offset when returning sprom data
net: renesas: rswitch: rework ts tags management
ksmbd: count all requests in req_running counter
ksmbd: fix broken transfers when exceeding max simultaneous operations
netdev: fix repeated netlink messages in queue dump
netdev: fix repeated netlink messages in queue stats
team: Fix feature exposure when no ports are present
net: hinic: Fix cleanup in create_rxqs/txqs()
net: ethernet: oa_tc6: fix infinite loop error when tx credits becomes 0
net: ethernet: oa_tc6: fix tx skb race condition between reference pointers
net: ethernet: bgmac-platform: fix an OF node reference leak
net: netdevsim: fix nsim_pp_hold_write()
can: m_can: set init flag earlier in probe
can: m_can: fix missed interrupts with m_can_pci
ipvs: Fix clamp() of ip_vs_conn_tab on small memory systems
netfilter: ipset: Fix for recursive locking warning
selftests: openvswitch: fix tcpdump execution
net: dsa: restore dsa_software_vlan_untag() ability to operate on VLAN-untagged traffic
netdev-genl: avoid empty messages in queue dump
psample: adjust size if rate_as_probability is set
net: mdiobus: fix an OF node reference leak
mmc: sdhci-tegra: Remove SDHCI_QUIRK_BROKEN_ADMA_ZEROLEN_DESC quirk
mmc: mtk-sd: disable wakeup in .remove() and in the error path of .probe()
irqchip/gic-v3: Work around insecure GIC integrations
EDAC/amd64: Simplify ECC check on unified memory controllers
KVM: arm64: Do not allow ID_AA64MMFR0_EL1.ASIDbits to be overridden
KVM: x86: Cache CPUID.0xD XSTATE offsets+sizes during module init
net: tun: fix tun_napi_alloc_frags()
chelsio/chtls: prevent potential integer overflow on 32bit
net: mctp: handle skb cleanup on sock_queue failures
block: Revert "block: Fix potential deadlock while freezing queue and acquiring sysfs_lock"
i2c: riic: Always round-up when calculating bus period
efivarfs: Fix error on non-existent file
hexagon: Disable constant extender optimization for LLVM prior to 19.1.0
USB: serial: option: add TCL IK512 MBIM & ECM
USB: serial: option: add MeiG Smart SLM770A
USB: serial: option: add Netprisma LCUK54 modules for WWAN Ready
USB: serial: option: add MediaTek T7XX compositions
USB: serial: option: add Telit FE910C04 rmnet compositions
xhci: Turn NEC specific quirk for handling Stop Endpoint errors generic
thunderbolt: Add support for Intel Panther Lake-M/P
thunderbolt: Improve redrive mode handling
thunderbolt: Don't display nvm_version unless upgrade supported
drm/display: use ERR_PTR on DP tunnel manager creation fail
drm/amd: Update strapping for NBIO 2.5.0
drm/modes: Avoid divide by zero harder in drm_mode_vrefresh()
drm/amdgpu: fix amdgpu_coredump
drm/amdgpu: Handle NULL bo->tbo.resource (again) in amdgpu_vm_bo_update
udmabuf: udmabuf_create pin folio codestyle cleanup
udmabuf: fix memory leak on last export_udmabuf() error path
dma-buf: Fix __dma_buf_debugfs_list_del argument for !CONFIG_DEBUG_FS
drm/panel: himax-hx83102: Add a check to prevent NULL pointer dereference
drm/panel: novatek-nt35950: fix return value check in nt35950_probe()
drm/panel: st7701: Add prepare_prev_first flag to drm_panel
drm/panel: synaptics-r63353: Fix regulator unbalance
i915/guc: Reset engine utilization buffer before registration
i915/guc: Ensure busyness counter increases motonically
i915/guc: Accumulate active runtime on gt reset
drm/amdgpu: don't access invalid sched
hwmon: (tmp513) Fix interpretation of values of Shunt Voltage and Limit Registers
hwmon: (tmp513) Fix Current Register value interpretation
hwmon: (tmp513) Fix interpretation of values of Temperature Result and Limit Registers
block: avoid to reuse `hctx` not removed from cpuhp callback list
trace/ring-buffer: Do not use TP_printk() formatting for boot mapped buffers
drm/amdgpu/nbio7.11: fix IP version check
drm/amdgpu/nbio7.7: fix IP version check
drm/amdgpu/smu14.0.2: fix IP version check
zram: refuse to use zero sized block device as backing device
zram: fix uninitialized ZRAM not releasing backing device
vmalloc: fix accounting with i915
mm/page_alloc: don't call pfn_to_page() on possibly non-existent PFN in split_large_buddy()
ring-buffer: Fix overflow in __rb_map_vma
alloc_tag: fix set_codetag_empty() when !CONFIG_MEM_ALLOC_PROFILING_DEBUG
btrfs: split bios to the fs sector size boundary
btrfs: fix improper generation check in snapshot delete
btrfs: tree-checker: reject inline extent items with 0 ref count
s390/mm: Fix DirectMap accounting
drm/amdgpu/nbio7.0: fix IP version check
drm/amdgpu/gfx12: fix IP version check
drm/amdgpu/mmhub4.1: fix IP version check
fgraph: Still initialize idle shadow stacks when starting
Drivers: hv: util: Avoid accessing a ringbuffer not initialized yet
tools: hv: Fix a complier warning in the fcopy uio daemon
x86/hyperv: Fix hv tsc page based sched_clock for hibernation
KVM: x86: Play nice with protected guests in complete_hypercall_exit()
smb: client: fix TCP timers deadlock after rmmod
accel/ivpu: Fix general protection fault in ivpu_bo_list()
accel/ivpu: Fix WARN in ivpu_ipc_send_receive_internal()
tracing: Fix test_event_printk() to process entire print argument
tracing: Add missing helper functions in event pointer dereference check
tracing: Add "%s" check in test_event_printk()
tracing: Check "%s" dereference via the field and not the TP_printk format
selftests/memfd: run sysctl tests when PID namespace support is enabled
selftests/bpf: Use asm constraint "m" for LoongArch
io_uring: Fix registered ring file refcount leak
io_uring: check if iowq is killed before queuing
NFS/pnfs: Fix a live lock between recalled layouts and layoutget
KVM: SVM: Allow guest writes to set MSR_AMD64_DE_CFG bits
of/irq: Fix interrupt-map cell length check in of_irq_parse_imap_parent()
of/irq: Fix using uninitialized variable @addr_len in API of_irq_parse_one()
ocfs2: fix the space leak in LA when releasing LA
nilfs2: fix buffer head leaks in calls to truncate_inode_pages()
nilfs2: prevent use of deleted inode
udmabuf: fix racy memfd sealing check
udmabuf: also check for F_SEAL_FUTURE_WRITE
of: property: fw_devlink: Do not use interrupt-parent directly
of: address: Preserve the flags portion on 1:1 dma-ranges mapping
of: Fix error path in of_parse_phandle_with_args_map()
of: Fix refcount leakage for OF node returned by __of_get_dma_parent()
ceph: give up on paths longer than PATH_MAX
ceph: validate snapdirname option length when mounting
ceph: improve error handling and short/overflow-read logic in __ceph_sync_read()
ceph: fix memory leaks in __ceph_sync_read()
ceph: fix memory leak in ceph_direct_read_write()
mm: use aligned address in clear_gigantic_page()
mm: use aligned address in copy_user_gigantic_page()
mm: shmem: fix ShmemHugePages at swapout
mm: convert partially_mapped set/clear operations to be atomic
epoll: Add synchronous wakeup support for ep_poll_callback
Linux 6.12.7
Change-Id: I139753dbdf8a7e4c9a1d0381d0f14830965acd1a
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
GKI (arm64) relevant 39 out of 174 changes, affecting 58 files +843/-596
9b53d2c2a3 bpf: Fix UAF via mismatching bpf_prog/attachment RCU flavors [1 file, +7/-0]
26702b3439 splice: do not checksum AF_UNIX sockets [1 file, +1/-0]
8aa9d1ff5b tcp: check space before adding MPTCP SYN options [1 file, +4/-2]
29d1e06560 blk-cgroup: Fix UAF in blkcg_unpin_online() [1 file, +5/-1]
cbd06d9808 block: Switch to using refcount_t for zone write plugs [1 file, +10/-10]
eea49fcea5 block: Use a zone write plug BIO work for REQ_NOWAIT BIOs [1 file, +42/-20]
a4b656ea1b dm: Fix dm-zoned-reclaim zone write pointer alignment [3 files, +124/-26]
7fa80134cf block: Prevent potential deadlocks in zone write plug error recovery [2 files, +61/-249]
825bccd943 memcg: slub: fix SUnreclaim for post charged objects [1 file, +18/-3]
3be6628c47 ALSA: usb-audio: Add implicit feedback quirk for Yamaha THR5 [1 file, +2/-0]
0eae680d03 block: Ignore REQ_NOWAIT for zone reset and zone finish operations [1 file, +9/-0]
2588c29afd usb: core: hcd: only check primary hcd skip_phy_initialization [1 file, +7/-1]
5de70cdf42 bpf: Revert "bpf: Mark raw_tp arguments with PTR_MAYBE_NULL" [4 files, +9/-87]
cab34b0c9d scsi: ufs: core: Update compl_time_stamp_local_clock after completing a cqe [1 file, +1/-0]
dd6b0ca602 usb: gadget: u_serial: Fix the issue that gs_start_io crashed due to accessing null pointer [1 file, +6/-3]
d32babf3fe usb: typec: ucsi: Fix completion notifications [1 file, +4/-2]
2c3ca17a07 bpf: Check size for BTF-based ctx access of pointer members [3 files, +10/-4]
e6d1dec142 bpf: Fix theoretical prog_array UAF in __uprobe_perf_func() [2 files, +10/-9]
dfb15ddf3b bpf,perf: Fix invalid prog_array access in perf_event_detach_bpf_prog [1 file, +4/-0]
bf2318e288 bpf, sockmap: Fix race between element replace and close() [1 file, +2/-3]
2bd517bafc bpf, sockmap: Fix update element with same [1 file, +1/-0]
b2fc4b17fc bpf: Augment raw_tp arguments with PTR_MAYBE_NULL [1 file, +138/-0]
a852c82eda tipc: fix NULL deref in cleanup_bearer() [1 file, +6/-1]
6610c7f8a8 net: defer final 'struct net' free in netns dismantle [2 files, +20/-1]
e7b02a0feb block: get wp_offset by bdev_offset_from_zone_start [1 file, +1/-1]
13ba06e260 Bluetooth: Improve setsockopt() handling of malformed user input [6 files, +33/-40]
45fe76573a netfilter: IDLETIMER: Fix for possible ABBA deadlock [1 file, +28/-24]
7cf0bd232b netfilter: nf_tables: do not defer rule destruction via call_rcu [2 files, +15/-21]
356078a5c5 net/sched: netem: account for backlog updates from child qdisc [1 file, +16/-6]
f9ecc90b5d Bluetooth: hci_event: Fix using rcu_read_(un)lock while iterating [1 file, +11/-22]
4ca50db1c5 Bluetooth: iso: Always release hdev at the end of iso_listen_bis [1 file, +1/-2]
827f30b1df Bluetooth: iso: Fix recursive locking warning [1 file, +6/-2]
d0f4a51246 Bluetooth: SCO: Add support for 16 bits transparent voice setting [2 files, +16/-14]
c541d7b5e1 Bluetooth: iso: Fix circular lock in iso_listen_bis [1 file, +12/-2]
cbe640d6ca Bluetooth: iso: Fix circular lock in iso_conn_big_sync [1 file, +27/-7]
c1291ea131 blk-mq: move cpuhp callback registering out of q->sysfs_lock [1 file, +92/-6]
f1a494df83 block: Fix potential deadlock while freezing queue and acquiring sysfs_lock [3 files, +26/-23]
1e04ca11a4 KVM: arm64: Disable MPAM visibility by default and ignore VMM writes [1 file, +52/-3]
5013bd1e23 x86/static-call: fix 32-bit build [1 file, +6/-1]
Changes in 6.12.6
usb: misc: onboard_usb_dev: skip suspend/resume sequence for USB5744 SMBus support
serial: sh-sci: Check if TX data was written to device in .tx_empty()
bpf: Fix UAF via mismatching bpf_prog/attachment RCU flavors
sched/deadline: Fix replenish_dl_new_period dl_server condition
perf/x86/intel/ds: Unconditionally drain PEBS DS when changing PEBS_DATA_CFG
clk: en7523: Fix wrong BUS clock for EN7581
ksmbd: fix racy issue from session lookup and expire
splice: do not checksum AF_UNIX sockets
tcp: check space before adding MPTCP SYN options
perf ftrace: Fix undefined behavior in cmp_profile_data()
virtio_net: correct netdev_tx_reset_queue() invocation point
virtio_ring: add a func argument 'recycle_done' to virtqueue_resize()
virtio_net: ensure netdev_tx_reset_queue is called on tx ring resize
riscv: mm: Do not call pmd dtor on vmemmap page table teardown
riscv: Fix wrong usage of __pa() on a fixmap address
blk-cgroup: Fix UAF in blkcg_unpin_online()
block: Switch to using refcount_t for zone write plugs
block: Use a zone write plug BIO work for REQ_NOWAIT BIOs
dm: Fix dm-zoned-reclaim zone write pointer alignment
block: Prevent potential deadlocks in zone write plug error recovery
gpio: graniterapids: Fix GPIO Ack functionality
memcg: slub: fix SUnreclaim for post charged objects
spi: rockchip: Fix PM runtime count on no-op cs
gpio: ljca: Initialize num before accessing item in ljca_gpio_config
ALSA: usb-audio: Add implicit feedback quirk for Yamaha THR5
ALSA: hda/realtek: Fix headset mic on Acer Nitro 5
riscv: Fix IPIs usage in kfence_protect_page()
crypto: hisilicon/debugfs - fix the struct pointer incorrectly offset problem
drm/panic: remove spurious empty line to clean warning
usb: host: max3421-hcd: Correctly abort a USB request.
block: Ignore REQ_NOWAIT for zone reset and zone finish operations
gpio: graniterapids: Fix vGPIO driver crash
gpio: graniterapids: Fix incorrect BAR assignment
gpio: graniterapids: Fix invalid GPI_IS register offset
gpio: graniterapids: Fix invalid RXEVCFG register bitmask
gpio: graniterapids: Determine if GPIO pad can be used by driver
gpio: graniterapids: Check if GPIO line can be used for IRQs
usb: core: hcd: only check primary hcd skip_phy_initialization
bpf: Revert "bpf: Mark raw_tp arguments with PTR_MAYBE_NULL"
ata: sata_highbank: fix OF node reference leak in highbank_initialize_phys()
usb: dwc2: Fix HCD resume
usb: dwc2: hcd: Fix GetPortStatus & SetPortFeature
usb: dwc2: Fix HCD port connection race
scsi: ufs: core: Update compl_time_stamp_local_clock after completing a cqe
usb: gadget: midi2: Fix interpretation of is_midi1 bits
usb: ehci-hcd: fix call balance of clocks handling routines
usb: typec: anx7411: fix fwnode_handle reference leak
usb: dwc3: imx8mp: fix software node kernel dump
usb: typec: anx7411: fix OF node reference leaks in anx7411_typec_switch_probe()
usb: gadget: u_serial: Fix the issue that gs_start_io crashed due to accessing null pointer
usb: typec: ucsi: Fix completion notifications
usb: dwc3: xilinx: make sure pipe clock is deselected in usb2 only mode
iommu/tegra241-cmdqv: do not use smp_processor_id in preemptible context
iommu/vt-d: Remove cache tags before disabling ATS
iommu/vt-d: Fix qi_batch NULL pointer with nested parent domain
drm/xe: Call invalidation_fence_fini for PT inval fences in error state
drm/amdkfd: pause autosuspend when creating pdd
drm/i915: Fix memory leak by correcting cache object name in error handler
drm/i915/color: Stop using non-posted DSB writes for legacy LUT
drm/i915: Fix NULL pointer dereference in capture_engine
drm/amdgpu: fix UVD contiguous CS mapping problem
drm/amd/pm: Set SMU v13.0.7 default workload type
drm/amdgpu: fix when the cleaner shader is emitted
drm/amdkfd: Dereference null return value
drm/amdkfd: hard-code cacheline size for gfx11
drm/amdkfd: hard-code MALL cacheline size for gfx11, gfx12
xfs: set XFS_SICK_INO_SYMLINK_ZAPPED explicitly when zapping a symlink
xfs: update btree keys correctly when _insrec splits an inode root block
xfs: don't drop errno values when we fail to ficlone the entire range
xfs: return a 64-bit block count from xfs_btree_count_blocks
xfs: fix null bno_hint handling in xfs_rtallocate_rtg
xfs: return from xfs_symlink_verify early on V4 filesystems
xfs: fix scrub tracepoints when inode-rooted btrees are involved
xfs: only run precommits once per transaction object
xfs: unlock inodes when erroring out of xfs_trans_alloc_dir
bpf: Check size for BTF-based ctx access of pointer members
bpf: Fix theoretical prog_array UAF in __uprobe_perf_func()
bpf,perf: Fix invalid prog_array access in perf_event_detach_bpf_prog
bpf, sockmap: Fix race between element replace and close()
bpf, sockmap: Fix update element with same
bpf: Augment raw_tp arguments with PTR_MAYBE_NULL
perf tools: Fix build-id event recording
wifi: nl80211: fix NL80211_ATTR_MLO_LINK_ID off-by-one
wifi: mac80211: init cnt before accessing elem in ieee80211_copy_mbssid_beacon
wifi: mac80211: fix a queue stall in certain cases of CSA
wifi: mac80211: fix station NSS capability initialization order
perf machine: Initialize machine->env to address a segfault
acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl
amdgpu/uvd: get ring reference from rq scheduler
batman-adv: Do not send uninitialized TT changes
batman-adv: Remove uninitialized data in full table TT response
batman-adv: Do not let TT changes list grows indefinitely
tipc: fix NULL deref in cleanup_bearer()
net/mlx5: DR, prevent potential error pointer dereference
wifi: cfg80211: sme: init n_channels before channels[] access
selftests: mlxsw: sharedbuffer: Remove h1 ingress test case
selftests: mlxsw: sharedbuffer: Remove duplicate test cases
selftests: mlxsw: sharedbuffer: Ensure no extra packets are counted
ptp: kvm: x86: Return EOPNOTSUPP instead of ENODEV from kvm_arch_ptp_init()
bnxt_en: Fix GSO type for HW GRO packets on 5750X chips
net: lapb: increase LAPB_HEADER_LEN
net: defer final 'struct net' free in netns dismantle
net: mscc: ocelot: fix memory leak on ocelot_port_add_txtstamp_skb()
net: mscc: ocelot: improve handling of TX timestamp for unknown skb
net: mscc: ocelot: ocelot->ts_id_lock and ocelot_port->tx_skbs.lock are IRQ-safe
net: mscc: ocelot: be resilient to loss of PTP packets during transmission
net: mscc: ocelot: perform error cleanup in ocelot_hwstamp_set()
regulator: axp20x: AXP717: set ramp_delay
spi: aspeed: Fix an error handling path in aspeed_spi_[read|write]_user()
net: sparx5: fix FDMA performance issue
net: sparx5: fix the maximum frame length register
ACPI: resource: Fix memory resource type union access
cxgb4: use port number to set mac addr
qca_spi: Fix clock speed for multiple QCA7000
qca_spi: Make driver probing reliable
ALSA: control: Avoid WARN() for symlink errors
ASoC: amd: yc: Fix the wrong return value
Documentation: PM: Clarify pm_runtime_resume_and_get() return value
block: get wp_offset by bdev_offset_from_zone_start
bnxt_en: Fix aggregation ID mask to prevent oops on 5760X chips
Documentation: networking: Add a caveat to nexthop_compat_mode sysctl
cifs: Fix rmdir failure due to ongoing I/O on deleted file
net: renesas: rswitch: fix possible early skb release
net: renesas: rswitch: fix race window between tx start and complete
net: renesas: rswitch: fix leaked pointer on error path
net: renesas: rswitch: avoid use-after-put for a device tree node
net: renesas: rswitch: handle stop vs interrupt race
ASoC: tas2781: Fix calibration issue in stress test
Bluetooth: Improve setsockopt() handling of malformed user input
libperf: evlist: Fix --cpu argument on hybrid platform
ASoC: fsl_xcvr: change IFACE_PCM to IFACE_MIXER
ASoC: fsl_spdif: change IFACE_PCM to IFACE_MIXER
selftests: netfilter: Stabilize rpath.sh
netfilter: IDLETIMER: Fix for possible ABBA deadlock
netfilter: nf_tables: do not defer rule destruction via call_rcu
net: mana: Fix memory leak in mana_gd_setup_irqs
net: mana: Fix irq_contexts memory leak in mana_gd_setup_irqs
net: dsa: felix: fix stuck CPU-injected packets with short taprio windows
net/sched: netem: account for backlog updates from child qdisc
net, team, bonding: Add netdev_base_features helper
bonding: Fix initial {vlan,mpls}_feature set in bond_compute_features
bonding: Fix feature propagation of NETIF_F_GSO_ENCAP_ALL
team: Fix initial vlan_feature set in __team_compute_features
team: Fix feature propagation of NETIF_F_GSO_ENCAP_ALL
ASoC: Intel: sof_sdw: Add space for a terminator into DAIs array
ACPICA: events/evxfregn: don't release the ContextMutex that was never acquired
Bluetooth: hci_event: Fix using rcu_read_(un)lock while iterating
Bluetooth: iso: Always release hdev at the end of iso_listen_bis
Bluetooth: iso: Fix recursive locking warning
Bluetooth: SCO: Add support for 16 bits transparent voice setting
Bluetooth: iso: Fix circular lock in iso_listen_bis
Bluetooth: iso: Fix circular lock in iso_conn_big_sync
Bluetooth: btmtk: avoid UAF in btmtk_process_coredump
net: renesas: rswitch: fix initial MPIC register setting
net: dsa: microchip: KSZ9896 register regmap alignment to 32 bit boundaries
net: dsa: tag_ocelot_8021q: fix broken reception
drm/xe: fix the ERR_PTR() returned on failure to allocate tiny pt
drm/xe/reg_sr: Remove register pool
blk-iocost: Avoid using clamp() on inuse in __propagate_weights()
kselftest/arm64: abi: fix SVCR detection
blk-mq: move cpuhp callback registering out of q->sysfs_lock
block: Fix potential deadlock while freezing queue and acquiring sysfs_lock
rust: kbuild: set `bindgen`'s Rust target version
KVM: arm64: Disable MPAM visibility by default and ignore VMM writes
xen/netfront: fix crash when removing device
x86: make get_cpu_vendor() accessible from Xen code
objtool/x86: allow syscall instruction
x86/static-call: provide a way to do very early static-call updates
x86/xen: don't do PV iret hypercall through hypercall page
x86/xen: add central hypercall functions
x86/xen: use new hypercall functions instead of hypercall page
x86/xen: remove hypercall page
x86/static-call: fix 32-bit build
Linux 6.12.6
Change-Id: I656537654d0b73440e5b76deee63abd58ea68b56
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
[ Upstream commit 70b6f46a4ed8bd56c85ffff22df91e20e8c85e33 ]
With CONFIG_PROVE_LOCKING, when creating a set of type bitmap:ip, adding
it to a set of type list:set and populating it from iptables SET target
triggers a kernel warning:
| WARNING: possible recursive locking detected
| 6.12.0-rc7-01692-g5e9a28f41134-dirty #594 Not tainted
| --------------------------------------------
| ping/4018 is trying to acquire lock:
| ffff8881094a6848 (&set->lock){+.-.}-{2:2}, at: ip_set_add+0x28c/0x360 [ip_set]
|
| but task is already holding lock:
| ffff88811034c048 (&set->lock){+.-.}-{2:2}, at: ip_set_add+0x28c/0x360 [ip_set]
This is a false alarm: ipset does not allow nested list:set type, so the
loop in list_set_kadd() can never encounter the outer set itself. No
other set type supports embedded sets, so this is the only case to
consider.
To avoid the false report, create a distinct lock class for list:set
type ipset locks.
Fixes: f830837f0e ("netfilter: ipset: list:set set type support")
Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit cf2c97423a4f89c8b798294d3f34ecfe7e7035c3 ]
The 'max_avail' value is calculated from the system memory
size using order_base_2().
order_base_2(x) is defined as '(x) ? fn(x) : 0'.
The compiler generates two copies of the code that follows
and then expands clamp(max, min, PAGE_SHIFT - 12) (11 on 32bit).
This triggers a compile-time assert since min is 5.
In reality a system would have to have less than 512MB memory
for the bounds passed to clamp to be reversed.
Swap the order of the arguments to clamp() to avoid the warning.
Replace the clamp_val() on the line below with clamp().
clamp_val() is just 'an accident waiting to happen' and not needed here.
Detected by compile time checks added to clamp(), specifically:
minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp()
Reported-by: Linux Kernel Functional Testing <lkft@linaro.org>
Closes: https://lore.kernel.org/all/CA+G9fYsT34UkGFKxus63H6UVpYi5GRZkezT9MRLfAbM3f6ke0g@mail.gmail.com/
Fixes: 4f325e2627 ("ipvs: dynamically limit the connection hash table")
Tested-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Signed-off-by: David Laight <david.laight@aculab.com>
Acked-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit b04df3da1b5c6f6dc7cdccc37941740c078c4043 ]
nf_tables_chain_destroy can sleep, it can't be used from call_rcu
callbacks.
Moreover, nf_tables_rule_release() is only safe for error unwinding,
while transaction mutex is held and the to-be-desroyed rule was not
exposed to either dataplane or dumps, as it deactives+frees without
the required synchronize_rcu() in-between.
nft_rule_expr_deactivate() callbacks will change ->use counters
of other chains/sets, see e.g. nft_lookup .deactivate callback, these
must be serialized via transaction mutex.
Also add a few lockdep asserts to make this more explicit.
Calling synchronize_rcu() isn't ideal, but fixing this without is hard
and way more intrusive. As-is, we can get:
WARNING: .. net/netfilter/nf_tables_api.c:5515 nft_set_destroy+0x..
Workqueue: events nf_tables_trans_destroy_work
RIP: 0010:nft_set_destroy+0x3fe/0x5c0
Call Trace:
<TASK>
nf_tables_trans_destroy_work+0x6b7/0xad0
process_one_work+0x64a/0xce0
worker_thread+0x613/0x10d0
In case the synchronize_rcu becomes an issue, we can explore alternatives.
One way would be to allocate nft_trans_rule objects + one nft_trans_chain
object, deactivate the rules + the chain and then defer the freeing to the
nft destroy workqueue. We'd still need to keep the synchronize_rcu path as
a fallback to handle -ENOMEM corner cases though.
Reported-by: syzbot+b26935466701e56cfdc2@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/67478d92.050a0220.253251.0062.GAE@google.com/T/
Fixes: c03d278fdf ("netfilter: nf_tables: wait for rcu grace period on net_device removal")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit f36b01994d68ffc253c8296e2228dfe6e6431c03 ]
Deletion of the last rule referencing a given idletimer may happen at
the same time as a read of its file in sysfs:
| ======================================================
| WARNING: possible circular locking dependency detected
| 6.12.0-rc7-01692-g5e9a28f41134-dirty #594 Not tainted
| ------------------------------------------------------
| iptables/3303 is trying to acquire lock:
| ffff8881057e04b8 (kn->active#48){++++}-{0:0}, at: __kernfs_remove+0x20
|
| but task is already holding lock:
| ffffffffa0249068 (list_mutex){+.+.}-{3:3}, at: idletimer_tg_destroy_v]
|
| which lock already depends on the new lock.
A simple reproducer is:
| #!/bin/bash
|
| while true; do
| iptables -A INPUT -i foo -j IDLETIMER --timeout 10 --label "testme"
| iptables -D INPUT -i foo -j IDLETIMER --timeout 10 --label "testme"
| done &
| while true; do
| cat /sys/class/xt_idletimer/timers/testme >/dev/null
| done
Avoid this by freeing list_mutex right after deleting the element from
the list, then continuing with the teardown.
Fixes: 0902b469bd ("netfilter: xtables: idletimer target implementation")
Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
GKI (arm64) relevant 129 out of 468 changes, affecting 180 files +1843/-980
e0964a5778 ptp: Add error handling for adjfine callback in ptp_clock_adjtime [1 file, +2/-1]
a007f8895f net/sched: tbf: correct backlog statistic for GSO packets [1 file, +12/-6]
9545011e7b net: Fix icmp host relookup triggering ip_rt_bug [1 file, +3/-0]
01f95357e4 ipv6: avoid possible NULL deref in modify_prefix_route() [1 file, +7/-6]
8b591bd522 net/ipv6: release expired exception dst cached in socket [1 file, +3/-3]
e48b211c4c tipc: Fix use-after-free of kernel socket in cleanup_bearer(). [1 file, +1/-1]
da5cc778e7 netfilter: nft_inner: incorrect percpu area handling under softirq [2 files, +46/-12]
a36a6d7037 Revert "udp: avoid calling sock_def_readable() if possible" [1 file, +3/-11]
22074dc1d4 ethtool: Fix wrong mod state in case of verbose and no_mask bitset [1 file, +44/-4]
316183d583 net: avoid potential UAF in default_operstate() [1 file, +6/-1]
c00372e41b mmc: sd: SDUC Support Recognition [7 files, +27/-15]
19e22f1e68 mmc: core: Adjust ACMD22 to SDUC [1 file, +18/-6]
42311846d3 mmc: core: Use GFP_NOIO in ACMD22 [1 file, +4/-0]
4e51552bc5 zram: do not mark idle slots that cannot be idle [1 file, +18/-7]
0ab037634b zram: clear IDLE flag in mark_idle() [1 file, +2/-0]
405b6d5f90 ntp: Remove invalid cast in time offset math [1 file, +1/-1]
6358df316d f2fs: clean up w/ F2FS_{BLK_TO_BYTES,BTYES_TO_BLK} [1 file, +29/-39]
e6a91ed4b9 f2fs: fix to adjust appropriate length for fiemap [2 files, +4/-3]
8e9fec7f79 f2fs: fix to requery extent which cross boundary of inquiry [1 file, +15/-5]
815d8f0e52 i3c: master: Replace hard code 2 with macro I3C_ADDR_SLOT_STATUS_BITS [2 files, +5/-3]
c3806cf647 i3c: master: Extend address status bit to 4 and add I3C_ADDR_SLOT_EXT_DESIRED [2 files, +59/-13]
1117462773 i3c: master: Fix dynamic address leak when 'assigned-address' is present [1 file, +5/-10]
7d4e5e33ea scsi: ufs: core: Always initialize the UIC done completion [1 file, +4/-7]
3ad69f2f08 scsi: ufs: core: Add ufshcd_send_bsg_uic_cmd() for UFS BSG [3 files, +38/-1]
47f4ad956b bpf, vsock: Fix poll() missing a queue [1 file, +3/-0]
a222e48fea bpf, vsock: Invoke proto::close on close() [1 file, +40/-27]
dabaf26846 xsk: always clear DMA mapping information when unmapping the pool [1 file, +2/-3]
5c9e3bb43a tcp_bpf: Fix the sk_mem_uncharge logic in tcp_bpf_sendmsg [1 file, +4/-7]
7bc37dd9ea ALSA: usb-audio: Notify xrun for low-latency mode [1 file, +11/-3]
a78af11806 pmdomain: core: Add missing put_device() [1 file, +1/-0]
913a3f1c06 pmdomain: core: Fix error path in pm_genpd_init() when ida alloc fails [1 file, +19/-17]
5548887987 nvme: don't apply NVME_QUIRK_DEALLOCATE_ZEROES when DSM is not supported [1 file, +2/-1]
bdbf87486d bpf: Ensure reg is PTR_TO_STACK in process_iter_arg [2 files, +7/-2]
2459a0b149 drivers/virt: pkvm: Don't fail ioremap() call if MMIO_GUARD fails [1 file, +1/-5]
0da7d4b7ca bpf: Don't mark STACK_INVALID as STACK_MISC in mark_stack_slot_misc [1 file, +6/-3]
f9f2a2739e bpf: Fix narrow scalar spill onto 64-bit spilled scalar slots [1 file, +1/-0]
845cc4ee8e nvme-fabrics: handle zero MAXCMD without closing the connection [1 file, +3/-2]
c2277e2859 scatterlist: fix incorrect func name in kernel-doc [1 file, +1/-1]
81ec3c6ceb bpf: Handle BPF_EXIST and BPF_NOEXIST for LPM trie [1 file, +20/-3]
6dc076a257 bpf: Remove unnecessary kfree(im_node) in lpm_trie_update_elem [1 file, +1/-3]
7218e441ad bpf: Handle in-place update for full LPM trie correctly [1 file, +21/-23]
412bf01fd5 bpf: Fix exact match conditions in trie_get_next_key() [1 file, +2/-2]
e689bc6697 HID: wacom: fix when get product name maybe null pointer [1 file, +2/-1]
3b0c5bb437 can: dev: can_set_termination(): allow sleeping GPIOs [1 file, +1/-1]
ba0ee489cd tracing: Fix cmp_entries_dup() to respect sort() comparison rules [1 file, +1/-5]
ec643064ab arm64: mm: Fix zone_dma_limit calculation [1 file, +8/-9]
34b6197867 arm64: Ensure bits ASID[15:8] are masked out when the kernel uses 8-bit ASIDs [1 file, +2/-2]
abd614bbfc arm64: ptrace: fix partial SETREGSET for NT_ARM_TAGGED_ADDR_CTRL [1 file, +5/-1]
8ab73c34e3 arm64: ptrace: fix partial SETREGSET for NT_ARM_FPMR [1 file, +2/-0]
4105dd76bc arm64: ptrace: fix partial SETREGSET for NT_ARM_POE [1 file, +2/-0]
7f1292f8d4 ALSA: usb-audio: Fix a DMA to stack memory bug [1 file, +27/-15]
39c5d89b56 ALSA: usb-audio: Add extra PID for RME Digiface USB [3 files, +176/-168]
9c191055c7 scsi: ufs: core: sysfs: Prevent div by zero [1 file, +6/-0]
2e7a3bb033 scsi: ufs: core: Cancel RTC work during ufshcd_remove() [1 file, +1/-0]
5a717f43c2 scsi: ufs: core: Add missing post notify for power mode change [2 files, +10/-7]
793e560a6b io_uring: Change res2 parameter type in io_uring_cmd_done [2 files, +3/-3]
85351e4941 Revert "readahead: properly shorten readahead when falling back to do_page_cache_ra()" [1 file, +2/-3]
95e197354e cacheinfo: Allocate memory during CPU hotplug if not done from the primary CPU [1 file, +8/-6]
bc031095d1 modpost: Add .irqentry.text to OTHER_SECTIONS [1 file, +1/-1]
178e31df1f bpf: fix OOB devmap writes when deleting elements [1 file, +3/-3]
3dcc20418e dma-buf: fix dma_fence_array_signaled v4 [1 file, +27/-1]
f3dbb097d6 dma-fence: Fix reference leak on fence merge failure path [1 file, +2/-0]
4715555964 dma-fence: Use kernel's sort for merging fences [1 file, +61/-67]
d486b5741d xsk: fix OOB map writes when deleting elements [1 file, +1/-1]
14258211d6 regmap: detach regmap from dev on regmap_exit [1 file, +12/-0]
d562b457e1 mmc: core: Further prevent card detect during shutdown [2 files, +5/-0]
9bfeeeff2c stackdepot: fix stack_depot_save_flags() in NMI context [2 files, +12/-4]
a71ddd5b87 sched/numa: fix memory leak due to the overwritten vma->numab_state [1 file, +9/-3]
835ca042df kasan: make report_lock a raw spinlock [1 file, +3/-3]
69d319450d mm/gup: handle NULL pages in unpin_user_pages() [1 file, +10/-1]
1dde3fde62 mm: open-code PageTail in folio_flags() and const_folio_flags() [1 file, +2/-2]
bd4d2333a3 mm: open-code page_folio() in dump_page() [1 file, +5/-2]
536ffb4014 mm: fix vrealloc()'s KASAN poisoning logic [1 file, +2/-1]
fe1a34e92a mm: respect mmap hint address when aligning for THP [1 file, +1/-0]
5c63e24b1b scsi: ufs: pltfrm: Drop PM runtime reference count after ufshcd_remove() [6 files, +2/-5]
2cec2d916a memblock: allow zero threshold in validate_numa_converage() [1 file, +2/-2]
d222934627 epoll: annotate racy check [2 files, +5/-3]
493326c4f1 block: RCU protect disk->conv_zones_bitmap [2 files, +32/-13]
b6ce2dbe98 ext4: partial zero eof block on unaligned inode size extension [2 files, +42/-16]
ff599ad2d2 cleanup: Adjust scoped_guard() macros to avoid potential warning [1 file, +42/-10]
3946e07552 gpio: free irqs that are still requested when the chip is being removed [1 file, +41/-0]
ea74e9675b HID: add per device quirk to force bind to hid-generic [3 files, +8/-2]
17db6ed5a3 media: uvcvideo: RealSense D421 Depth module metadata [1 file, +9/-0]
0c20fadfd0 media: uvcvideo: Add a quirk for the Kaiweets KTI-W02 infrared camera [1 file, +11/-0]
3cc5228d5b media: uvcvideo: Force UVC version to 1.0a for 0408:4033 [1 file, +11/-0]
4150f22342 drm: panel-orientation-quirks: Add quirk for AYA NEO 2 model [1 file, +6/-0]
5d7f35ed5f drm: panel-orientation-quirks: Add quirk for AYA NEO Founder edition [1 file, +6/-0]
187d5ff497 drm: panel-orientation-quirks: Add quirk for AYA NEO GEEK [1 file, +6/-0]
fd09880b16 af_packet: avoid erroring out after sock_init_data() in packet_create() [1 file, +6/-6]
61686abc2f Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create() [1 file, +1/-0]
32df687e12 Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc() [1 file, +5/-5]
8df832e6b9 net: af_can: do not leave a dangling sk pointer in can_create() [1 file, +1/-0]
03caa9bfb9 net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() [1 file, +7/-5]
691d6d816f net: inet: do not leave a dangling sk pointer in inet_create() [1 file, +10/-12]
f44fceb71d net: inet6: do not leave a dangling sk pointer in inet6_create() [1 file, +10/-12]
987aa730ba bpf: Prevent tailcall infinite loop caused by freplace [5 files, +81/-17]
051f49d517 net/tcp: Add missing lockdep annotations for TCP-AO hlist traversals [4 files, +29/-23]
920159e1bf ALSA: usb-audio: Make mic volume workarounds globally applicable [3 files, +45/-48]
a50b4aa300 bpf: Call free_htab_elem() after htab_unlock_bucket() [1 file, +39/-17]
da561d5fb6 Bluetooth: hci_conn: Reduce hci_conn_drop() calls in two functions [1 file, +3/-10]
c55a4c5a04 Bluetooth: hci_conn: Use disable_delayed_work_sync [1 file, +3/-3]
93a6160dc1 Bluetooth: hci_core: Fix not checking skb length on hci_acldata_packet [1 file, +9/-4]
b04b4fb91d Bluetooth: Add new quirks for ATS2851 [2 files, +20/-4]
359fc41e3c Bluetooth: Support new quirks for ATS2851 [2 files, +15/-1]
166cf43070 net/neighbor: clear error in case strict check is not set [1 file, +1/-0]
f63a1caae9 tracing/ftrace: disable preemption in syscall probe [2 files, +44/-4]
d1133dd57e tracing: Use atomic64_inc_return() in trace_clock_counter() [1 file, +1/-1]
09c083fbea ring-buffer: Limit time with disabled interrupts in rb_check_pages() [1 file, +72/-26]
c11e2ec9a7 pinmux: Use sequential access to access desc->pinmux data [3 files, +100/-77]
b865d4e569 scsi: ufs: core: Make DMA mask configuration more flexible [3 files, +13/-9]
2fcb921c27 bpf: put bpf_link's program when link is safe to be deallocated [1 file, +17/-5]
bb4a6236a4 leds: class: Protect brightness_show() with led_cdev->led_access mutex [2 files, +12/-4]
7214d3a64e tracing: Fix function name for trampoline [3 files, +36/-8]
9e28513fd2 f2fs: fix f2fs_bug_on when uninstalling filesystem call f2fs_evict_inode. [1 file, +3/-1]
b51aa6a07e PCI: qcom: Add support for IPQ9574 [1 file, +1/-0]
617bd1e6c3 PCI: Add ACS quirk for Wangxun FF5xxx NICs [1 file, +9/-6]
1f51ae217d i3c: Use i3cdev->desc->info instead of calling i3c_device_get_info() to avoid deadlock [1 file, +2/-1]
6d41a2d5c1 f2fs: print message if fscorrupted was found in f2fs_new_node_page() [1 file, +6/-1]
924f7dd1e8 f2fs: fix to shrink read extent node in batches [1 file, +41/-28]
1648c7000f serial: 8250_dw: Add Sophgo SG2044 quirk [1 file, +3/-2]
950210c9c7 Revert "nvme: make keep-alive synchronous operation" [1 file, +10/-7]
d5b2ddf1f9 io_uring/tctx: work around xa_store() allocation error issue [1 file, +12/-1]
cd188519d2 scsi: ufs: pltfrm: Dellocate HBA during ufshcd_pltfrm_remove() [1 file, +1/-0]
a39ad4f507 sched/core: Remove the unnecessary need_resched() check in nohz_csd_func() [1 file, +1/-1]
f9e144a544 sched/fair: Check idle_cpu() before need_resched() to detect ilb CPU turning busy [1 file, +1/-1]
b4ec68868c sched/core: Prevent wakeup of ksoftirqd during idle load balance [1 file, +1/-1]
364dc8070b tracing/eprobe: Fix to release eprobe when failed to add dyn_event [1 file, +5/-0]
1a678f6829 clocksource: Make negative motion detection more robust [4 files, +20/-7]
6aeef0214d softirq: Allow raising SCHED_SOFTIRQ from SMP-call-function on RT kernel [1 file, +11/-4]
Changes in 6.12.5
iTCO_wdt: mask NMI_NOW bit for update_no_reboot_bit() call
watchdog: xilinx_wwdt: Calculate max_hw_heartbeat_ms using clock frequency
watchdog: apple: Actually flush writes after requesting watchdog restart
watchdog: mediatek: Make sure system reset gets asserted in mtk_wdt_restart()
can: gs_usb: add usb endpoint address detection at driver probe step
can: c_can: c_can_handle_bus_err(): update statistics if skb allocation fails
can: sun4i_can: sun4i_can_err(): call can_change_state() even if cf is NULL
can: hi311x: hi3110_can_ist(): fix potential use-after-free
can: m_can: m_can_handle_lec_err(): fix {rx,tx}_errors statistics
can: ifi_canfd: ifi_canfd_handle_lec_err(): fix {rx,tx}_errors statistics
can: hi311x: hi3110_can_ist(): fix {rx,tx}_errors statistics
can: sja1000: sja1000_err(): fix {rx,tx}_errors statistics
can: sun4i_can: sun4i_can_err(): fix {rx,tx}_errors statistics
can: ems_usb: ems_usb_rx_err(): fix {rx,tx}_errors statistics
can: f81604: f81604_handle_can_bus_errors(): fix {rx,tx}_errors statistics
ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init()
netfilter: x_tables: fix LED ID check in led_tg_check()
netfilter: nft_socket: remove WARN_ON_ONCE on maximum cgroup level
selftests: hid: fix typo and exit code
net: enetc: Do not configure preemptible TCs if SIs do not support
ptp: Add error handling for adjfine callback in ptp_clock_adjtime
net/sched: tbf: correct backlog statistic for GSO packets
net: hsr: avoid potential out-of-bound access in fill_frame_info()
bnxt_en: ethtool: Supply ntuple rss context action
net: Fix icmp host relookup triggering ip_rt_bug
ipv6: avoid possible NULL deref in modify_prefix_route()
can: j1939: j1939_session_new(): fix skb reference counting
platform/x86: asus-wmi: Ignore return value when writing thermal policy
net: phy: microchip: Reset LAN88xx PHY to ensure clean link state on LAN7800/7850
net/ipv6: release expired exception dst cached in socket
dccp: Fix memory leak in dccp_feat_change_recv
tipc: Fix use-after-free of kernel socket in cleanup_bearer().
net/smc: initialize close_work early to avoid warning
net/smc: fix LGR and link use-after-free issue
net/qed: allow old cards not supporting "num_images" to work
net: hsr: must allocate more bytes for RedBox support
ice: fix PHY Clock Recovery availability check
ice: fix PHY timestamp extraction for ETH56G
ice: Fix VLAN pruning in switchdev mode
idpf: set completion tag for "empty" bufs associated with a packet
ixgbevf: stop attempting IPSEC offload on Mailbox API 1.5
ixgbe: downgrade logging of unsupported VF API version to debug
ixgbe: Correct BASE-BX10 compliance code
igb: Fix potential invalid memory access in igb_init_module()
netfilter: nft_inner: incorrect percpu area handling under softirq
Revert "udp: avoid calling sock_def_readable() if possible"
net: sched: fix erspan_opt settings in cls_flower
netfilter: ipset: Hold module reference while requesting a module
netfilter: nft_set_hash: skip duplicated elements pending gc run
ethtool: Fix wrong mod state in case of verbose and no_mask bitset
mlxsw: spectrum_acl_flex_keys: Constify struct mlxsw_afk_element_inst
mlxsw: spectrum_acl_flex_keys: Use correct key block on Spectrum-4
geneve: do not assume mac header is set in geneve_xmit_skb()
net/mlx5: HWS: Fix memory leak in mlx5hws_definer_calc_layout
net/mlx5: HWS: Properly set bwc queue locks lock classes
net/mlx5e: SD, Use correct mdev to build channel param
net/mlx5e: Remove workaround to avoid syndrome for internal port
vsock/test: fix failures due to wrong SO_RCVLOWAT parameter
vsock/test: fix parameter types in SO_VM_SOCKETS_* calls
net: avoid potential UAF in default_operstate()
gpio: grgpio: use a helper variable to store the address of ofdev->dev
gpio: grgpio: Add NULL check in grgpio_probe
mmc: mtk-sd: use devm_mmc_alloc_host
mmc: mtk-sd: Fix error handle of probe function
mmc: mtk-sd: fix devm_clk_get_optional usage
mmc: mtk-sd: Fix MMC_CAP2_CRYPTO flag setting
mmc: sd: SDUC Support Recognition
mmc: core: Adjust ACMD22 to SDUC
mmc: core: Use GFP_NOIO in ACMD22
zram: do not mark idle slots that cannot be idle
zram: clear IDLE flag in mark_idle()
ntp: Remove invalid cast in time offset math
f2fs: clean up w/ F2FS_{BLK_TO_BYTES,BTYES_TO_BLK}
f2fs: fix to adjust appropriate length for fiemap
f2fs: fix to requery extent which cross boundary of inquiry
i3c: master: Replace hard code 2 with macro I3C_ADDR_SLOT_STATUS_BITS
i3c: master: Extend address status bit to 4 and add I3C_ADDR_SLOT_EXT_DESIRED
i3c: master: Fix dynamic address leak when 'assigned-address' is present
drm/amd/display: calculate final viewport before TAP optimization
drm/amd/display: Ignore scalar validation failure if pipe is phantom
scsi: ufs: core: Always initialize the UIC done completion
scsi: ufs: core: Add ufshcd_send_bsg_uic_cmd() for UFS BSG
bpf, vsock: Fix poll() missing a queue
bpf, vsock: Invoke proto::close on close()
xsk: always clear DMA mapping information when unmapping the pool
bpftool: fix potential NULL pointer dereferencing in prog_dump()
drm/sti: Add __iomem for mixer_dbg_mxn's parameter
tcp_bpf: Fix the sk_mem_uncharge logic in tcp_bpf_sendmsg
ALSA: seq: ump: Fix seq port updates per FB info notify
ALSA: usb-audio: Notify xrun for low-latency mode
tools: Override makefile ARCH variable if defined, but empty
spi: mpc52xx: Add cancel_work_sync before module remove
ASoC: SOF: ipc3-topology: Convert the topology pin index to ALH dai index
ASoC: SOF: ipc3-topology: fix resource leaks in sof_ipc3_widget_setup_comp_dai()
pmdomain: core: Add missing put_device()
pmdomain: core: Fix error path in pm_genpd_init() when ida alloc fails
nvme: don't apply NVME_QUIRK_DEALLOCATE_ZEROES when DSM is not supported
x86/pkeys: Change caller of update_pkru_in_sigframe()
x86/pkeys: Ensure updated PKRU value is XRSTOR'd
bpf: Ensure reg is PTR_TO_STACK in process_iter_arg
irqchip/stm32mp-exti: CONFIG_STM32MP_EXTI should not default to y when compile-testing
drivers/virt: pkvm: Don't fail ioremap() call if MMIO_GUARD fails
bpf: Don't mark STACK_INVALID as STACK_MISC in mark_stack_slot_misc
bpf: Fix narrow scalar spill onto 64-bit spilled scalar slots
nvme-fabrics: handle zero MAXCMD without closing the connection
nvme-tcp: fix the memleak while create new ctrl failed
nvme-rdma: unquiesce admin_q before destroy it
scsi: sg: Fix slab-use-after-free read in sg_release()
scsi: scsi_debug: Fix hrtimer support for ndelay
ASoC: mediatek: mt8188-mt6359: Remove hardcoded dmic codec
drm/v3d: Enable Performance Counters before clearing them
ocfs2: free inode when ocfs2_get_init_inode() fails
scatterlist: fix incorrect func name in kernel-doc
iio: magnetometer: yas530: use signed integer type for clamp limits
smb: client: fix potential race in cifs_put_tcon()
bpf: Handle BPF_EXIST and BPF_NOEXIST for LPM trie
bpf: Remove unnecessary kfree(im_node) in lpm_trie_update_elem
bpf: Handle in-place update for full LPM trie correctly
bpf: Fix exact match conditions in trie_get_next_key()
x86/CPU/AMD: WARN when setting EFER.AUTOIBRS if and only if the WRMSR fails
rust: allow `clippy::needless_lifetimes`
HID: i2c-hid: Revert to using power commands to wake on resume
HID: wacom: fix when get product name maybe null pointer
LoongArch: Add architecture specific huge_pte_clear()
LoongArch: KVM: Protect kvm_check_requests() with SRCU
ksmbd: fix Out-of-Bounds Read in ksmbd_vfs_stream_read
ksmbd: fix Out-of-Bounds Write in ksmbd_vfs_stream_write
watchdog: rti: of: honor timeout-sec property
can: dev: can_set_termination(): allow sleeping GPIOs
can: mcp251xfd: mcp251xfd_get_tef_len(): work around erratum DS80000789E 6.
tracing: Fix cmp_entries_dup() to respect sort() comparison rules
net :mana :Request a V2 response version for MANA_QUERY_GF_STAT
iommufd: Fix out_fput in iommufd_fault_alloc()
arm64: mm: Fix zone_dma_limit calculation
arm64: Ensure bits ASID[15:8] are masked out when the kernel uses 8-bit ASIDs
arm64: ptrace: fix partial SETREGSET for NT_ARM_TAGGED_ADDR_CTRL
arm64: ptrace: fix partial SETREGSET for NT_ARM_FPMR
arm64: ptrace: fix partial SETREGSET for NT_ARM_POE
ALSA: usb-audio: Fix a DMA to stack memory bug
ALSA: usb-audio: Add extra PID for RME Digiface USB
ALSA: hda/realtek: fix micmute LEDs don't work on HP Laptops
ALSA: usb-audio: add mixer mapping for Corsair HS80
ALSA: hda/realtek: Enable mute and micmute LED on HP ProBook 430 G8
ALSA: hda/realtek: Add support for Samsung Galaxy Book3 360 (NP730QFG)
scsi: qla2xxx: Fix abort in bsg timeout
scsi: qla2xxx: Fix NVMe and NPIV connect issue
scsi: qla2xxx: Supported speed displayed incorrectly for VPorts
scsi: qla2xxx: Fix use after free on unload
scsi: qla2xxx: Remove check req_sg_cnt should be equal to rsp_sg_cnt
scsi: ufs: core: sysfs: Prevent div by zero
scsi: ufs: core: Cancel RTC work during ufshcd_remove()
scsi: ufs: qcom: Only free platform MSIs when ESI is enabled
scsi: ufs: pltfrm: Disable runtime PM during removal of glue drivers
scsi: ufs: core: Add missing post notify for power mode change
nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry()
fs/smb/client: avoid querying SMB2_OP_QUERY_WSL_EA for SMB3 POSIX
fs/smb/client: Implement new SMB3 POSIX type
fs/smb/client: cifs_prime_dcache() for SMB3 POSIX reparse points
smb3.1.1: fix posix mounts to older servers
io_uring: Change res2 parameter type in io_uring_cmd_done
bcache: revert replacing IS_ERR_OR_NULL with IS_ERR again
Revert "readahead: properly shorten readahead when falling back to do_page_cache_ra()"
pmdomain: imx: gpcv2: Adjust delay after power up handshake
selftests/damon: add _damon_sysfs.py to TEST_FILES
selftest: hugetlb_dio: fix test naming
cacheinfo: Allocate memory during CPU hotplug if not done from the primary CPU
x86/cacheinfo: Delete global num_cache_leaves
drm/amdkfd: hard-code cacheline for gc943,gc944
drm/dp_mst: Fix MST sideband message body length check
drm/amdkfd: add MEC version that supports no PCIe atomics for GFX12
drm/amd/pm: fix and simplify workload handling
drm/dp_mst: Verify request type in the corresponding down message reply
drm/dp_mst: Fix resetting msg rx state after topology removal
drm/amd/display: Correct prefetch calculation
drm/amd/display: Limit VTotal range to max hw cap minus fp
drm/amd/display: Add a left edge pixel if in YCbCr422 or YCbCr420 and odm
drm/amdgpu/hdp6.0: do a posting read when flushing HDP
drm/amdgpu/hdp4.0: do a posting read when flushing HDP
drm/amdgpu/hdp5.0: do a posting read when flushing HDP
drm/amdgpu/hdp7.0: do a posting read when flushing HDP
drm/amdgpu/hdp5.2: do a posting read when flushing HDP
modpost: Add .irqentry.text to OTHER_SECTIONS
x86/kexec: Restore GDT on return from ::preserve_context kexec
bpf: fix OOB devmap writes when deleting elements
dma-buf: fix dma_fence_array_signaled v4
dma-fence: Fix reference leak on fence merge failure path
dma-fence: Use kernel's sort for merging fences
xsk: fix OOB map writes when deleting elements
regmap: detach regmap from dev on regmap_exit
arch_numa: Restore nid checks before registering a memblock with a node
mmc: sdhci-pci: Add DMI quirk for missing CD GPIO on Vexia Edu Atla 10 tablet
mmc: core: Further prevent card detect during shutdown
x86/cpu: Add Lunar Lake to list of CPUs with a broken MONITOR implementation
ocfs2: update seq_file index in ocfs2_dlm_seq_next
stackdepot: fix stack_depot_save_flags() in NMI context
lib: stackinit: hide never-taken branch from compiler
sched/numa: fix memory leak due to the overwritten vma->numab_state
kasan: make report_lock a raw spinlock
mm/gup: handle NULL pages in unpin_user_pages()
mm/mempolicy: fix migrate_to_node() assuming there is at least one VMA in a MM
x86/cpu/topology: Remove limit of CPUs due to disabled IO/APIC
x86/mm: Add _PAGE_NOPTISHADOW bit to avoid updating userspace page tables
mm/damon: fix order of arguments in damos_before_apply tracepoint
mm: memcg: declare do_memsw_account inline
mm: open-code PageTail in folio_flags() and const_folio_flags()
mm: open-code page_folio() in dump_page()
mm: fix vrealloc()'s KASAN poisoning logic
mm: respect mmap hint address when aligning for THP
scsi: ufs: pltfrm: Drop PM runtime reference count after ufshcd_remove()
memblock: allow zero threshold in validate_numa_converage()
rust: enable arbitrary_self_types and remove `Receiver`
s390/pci: Sort PCI functions prior to creating virtual busses
s390/pci: Use topology ID for multi-function devices
s390/pci: Ignore RID for isolated VFs
epoll: annotate racy check
kselftest/arm64: Log fp-stress child startup errors to stdout
s390/cpum_sf: Handle CPU hotplug remove during sampling
block: RCU protect disk->conv_zones_bitmap
btrfs: don't take dev_replace rwsem on task already holding it
btrfs: avoid unnecessary device path update for the same device
btrfs: canonicalize the device path before adding it
btrfs: do not clear read-only when adding sprout device
kselftest/arm64: Don't leak pipe fds in pac.exec_sign_all()
ext4: partial zero eof block on unaligned inode size extension
crypto: ecdsa - Avoid signed integer overflow on signature decoding
kcsan: Turn report_filterlist_lock into a raw_spinlock
hwmon: (nct6775) Add 665-ACE/600M-CL to ASUS WMI monitoring list
ACPI: x86: Make UART skip quirks work on PCI UARTs without an UID
ACPI: x86: Add adev NULL check to acpi_quirk_skip_serdev_enumeration()
ACPI: video: force native for Apple MacbookPro11,2 and Air7,2
perf/x86/amd: Warn only on new bits set
cleanup: Adjust scoped_guard() macros to avoid potential warning
iio: magnetometer: fix if () scoped_guard() formatting
timekeeping: Always check for negative motion
gpio: free irqs that are still requested when the chip is being removed
spi: spi-fsl-lpspi: Adjust type of scldiv
soc: qcom: llcc: Use designated initializers for LLC settings
HID: add per device quirk to force bind to hid-generic
firmware: qcom: scm: Allow QSEECOM on Lenovo Yoga Slim 7x
soc: qcom: pd-mapper: Add QCM6490 PD maps
media: uvcvideo: RealSense D421 Depth module metadata
media: uvcvideo: Add a quirk for the Kaiweets KTI-W02 infrared camera
media: uvcvideo: Force UVC version to 1.0a for 0408:4033
media: cx231xx: Add support for Dexatek USB Video Grabber 1d19:6108
mmc: core: Add SD card quirk for broken poweroff notification
mmc: sdhci-esdhc-imx: enable quirks SDHCI_QUIRK_NO_LED
firmware: qcom: scm: Allow QSEECOM on Dell XPS 13 9345
soc: imx8m: Probe the SoC driver as platform driver
regmap: maple: Provide lockdep (sub)class for maple tree's internal lock
selftests/resctrl: Protect against array overflow when reading strings
sched_ext: add a missing rcu_read_lock/unlock pair at scx_select_cpu_dfl()
HID: magicmouse: Apple Magic Trackpad 2 USB-C driver support
drm/xe/pciids: separate RPL-U and RPL-P PCI IDs
drm/xe/pciids: separate ARL and MTL PCI IDs
drm/vc4: hdmi: Avoid log spam for audio start failure
drm/vc4: hvs: Set AXI panic modes for the HVS
drm/xe/pciids: Add PVC's PCI device ID macros
wifi: rtw88: use ieee80211_purge_tx_queue() to purge TX skb
drm/xe/pciid: Add new PCI id for ARL
drm: panel-orientation-quirks: Add quirk for AYA NEO 2 model
drm: panel-orientation-quirks: Add quirk for AYA NEO Founder edition
drm: panel-orientation-quirks: Add quirk for AYA NEO GEEK
drm/bridge: it6505: Enable module autoloading
drm/mcde: Enable module autoloading
wifi: rtw89: check return value of ieee80211_probereq_get() for RNR
drm/amd/display: Fix out-of-bounds access in 'dcn21_link_encoder_create'
drm/radeon/r600_cs: Fix possible int overflow in r600_packet3_check()
ASoC: Intel: sof_rt5682: Add HDMI-In capture with rt5682 support for MTL.
dlm: fix possible lkb_resource null dereference
drm/amd/display: skip disable CRTC in seemless bootup case
drm/amd/display: Fix garbage or black screen when resetting otg
drm/amd/display: disable SG displays on cyan skillfish
drm/xe/ptl: L3bank mask is not available on the media GT
drm/xe/xe3: Add initial set of workarounds
drm/display: Fix building with GCC 15
ALSA: hda: Use own quirk lookup helper
ALSA: hda/conexant: Use the new codec SSID matching
ALSA: hda/realtek: Use codec SSID matching for Lenovo devices
r8169: don't apply UDP padding quirk on RTL8126A
samples/bpf: Fix a resource leak
wifi: ath12k: fix atomic calls in ath12k_mac_op_set_bitrate_mask()
accel/qaic: Add AIC080 support
drm/amd/display: Full exit out of IPS2 when all allow signals have been cleared
net: fec_mpc52xx_phy: Use %pa to format resource_size_t
net: ethernet: fs_enet: Use %pa to format resource_size_t
net/sched: cbs: Fix integer overflow in cbs_set_port_rate()
af_packet: avoid erroring out after sock_init_data() in packet_create()
Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create()
Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc()
net: af_can: do not leave a dangling sk pointer in can_create()
net: ieee802154: do not leave a dangling sk pointer in ieee802154_create()
net: inet: do not leave a dangling sk pointer in inet_create()
net: inet6: do not leave a dangling sk pointer in inet6_create()
wifi: ath10k: avoid NULL pointer error during sdio remove
wifi: ath5k: add PCI ID for SX76X
wifi: ath5k: add PCI ID for Arcadyan devices
fanotify: allow reporting errors on failure to open fd
bpf: Prevent tailcall infinite loop caused by freplace
ASoC: sdw_utils: Add support for exclusion DAI quirks
ASoC: sdw_utils: Add a quirk to allow the cs42l43 mic DAI to be ignored
ASoC: Intel: sof_sdw: Add quirk for cs42l43 system using host DMICs
ASoC: Intel: sof_sdw: Add quirks for some new Lenovo laptops
drm/xe/guc/ct: Flush g2h worker in case of g2h response timeout
drm/panel: simple: Add Microchip AC69T88A LVDS Display panel
net: sfp: change quirks for Alcatel Lucent G-010S-P
net: stmmac: Programming sequence for VLAN packets with split header
drm/sched: memset() 'job' in drm_sched_job_init()
drm/amd/display: Adding array index check to prevent memory corruption
drm/amdgpu/gfx9: Add cleaner shader for GFX9.4.2
drm/amdgpu: clear RB_OVERFLOW bit when enabling interrupts for vega20_ih
drm/amdgpu: Dereference the ATCS ACPI buffer
netlink: specs: Add missing bitset attrs to ethtool spec
drm/amdgpu: refine error handling in amdgpu_ttm_tt_pin_userptr
ASoC: sdw_utils: Add quirk to exclude amplifier function
ASoC: Intel: soc-acpi-intel-arl-match: Add rt722 and rt1320 support
drm/amd/display: Fix underflow when playing 8K video in full screen mode
mptcp: annotate data-races around subflow->fully_established
dma-debug: fix a possible deadlock on radix_lock
jfs: array-index-out-of-bounds fix in dtReadFirst
jfs: fix shift-out-of-bounds in dbSplit
jfs: fix array-index-out-of-bounds in jfs_readdir
jfs: add a check to prevent array-index-out-of-bounds in dbAdjTree
fsl/fman: Validate cell-index value obtained from Device Tree
net/tcp: Add missing lockdep annotations for TCP-AO hlist traversals
drm/panic: Add ABGR2101010 support
drm/amd/display: Remove hw w/a toggle if on DP2/HPO
drm/amd/display: parse umc_info or vram_info based on ASIC
drm/amd/display: Prune Invalid Modes For HDMI Output
drm/amdgpu: skip amdgpu_device_cache_pci_state under sriov
virtio-net: fix overflow inside virtnet_rq_alloc
ALSA: usb-audio: Make mic volume workarounds globally applicable
drm/amdgpu: set the right AMDGPU sg segment limitation
wifi: ipw2x00: libipw_rx_any(): fix bad alignment
wifi: brcmfmac: Fix oops due to NULL pointer dereference in brcmf_sdiod_sglist_rw()
bpf: Call free_htab_elem() after htab_unlock_bucket()
mptcp: fix possible integer overflow in mptcp_reset_tout_timer
dsa: qca8k: Use nested lock to avoid splat
i2c: i801: Add support for Intel Panther Lake
Bluetooth: hci_conn: Reduce hci_conn_drop() calls in two functions
Bluetooth: btusb: Add RTL8852BE device 0489:e123 to device tables
Bluetooth: btusb: Add USB HW IDs for MT7920/MT7925
Bluetooth: hci_conn: Use disable_delayed_work_sync
Bluetooth: hci_core: Fix not checking skb length on hci_acldata_packet
Bluetooth: Add new quirks for ATS2851
Bluetooth: Support new quirks for ATS2851
Bluetooth: Set quirks for ATS2851
Bluetooth: btusb: Add new VID/PID 0489/e111 for MT7925
Bluetooth: btusb: Add new VID/PID 0489/e124 for MT7925
Bluetooth: btusb: Add 3 HWIDs for MT7925
ASoC: hdmi-codec: reorder channel allocation list
rocker: fix link status detection in rocker_carrier_init()
net/neighbor: clear error in case strict check is not set
netpoll: Use rcu_access_pointer() in __netpoll_setup
pinctrl: freescale: fix COMPILE_TEST error with PINCTRL_IMX_SCU
rtla: Fix consistency in getopt_long for timerlat_hist
tracing/ftrace: disable preemption in syscall probe
tracing: Use atomic64_inc_return() in trace_clock_counter()
tools/rtla: fix collision with glibc sched_attr/sched_set_attr
rtla/timerlat: Make timerlat_top_cpu->*_count unsigned long long
rtla/timerlat: Make timerlat_hist_cpu->*_count unsigned long long
scsi: hisi_sas: Add cond_resched() for no forced preemption model
scsi: hisi_sas: Create all dump files during debugfs initialization
ring-buffer: Limit time with disabled interrupts in rb_check_pages()
pinmux: Use sequential access to access desc->pinmux data
scsi: ufs: core: Make DMA mask configuration more flexible
iommu/amd: Fix corruption when mapping large pages from 0
bpf: put bpf_link's program when link is safe to be deallocated
scsi: lpfc: Call lpfc_sli4_queue_unset() in restart and rmmod paths
scsi: lpfc: Check SLI_ACTIVE flag in FDMI cmpl before submitting follow up FDMI
scsi: lpfc: Prevent NDLP reference count underflow in dev_loss_tmo callback
clk: qcom: rcg2: add clk_rcg2_shared_floor_ops
clk: qcom: rpmh: add support for SAR2130P
clk: qcom: tcsrcc-sm8550: add SAR2130P support
clk: qcom: dispcc-sm8550: enable support for SAR2130P
clk: qcom: clk-alpha-pll: Add NSS HUAYRA ALPHA PLL support for ipq9574
leds: class: Protect brightness_show() with led_cdev->led_access mutex
scsi: st: Don't modify unknown block number in MTIOCGET
scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device reset
pinctrl: qcom-pmic-gpio: add support for PM8937
pinctrl: qcom: spmi-mpp: Add PM8937 compatible
thermal/drivers/qcom/tsens-v1: Add support for MSM8937 tsens
nvdimm: rectify the illogical code within nd_dax_probe()
smb: client: memcpy() with surrounding object base address
tracing: Fix function name for trampoline
tools/rtla: Enhance argument parsing in timerlat_load.py
verification/dot2: Improve dot parser robustness
mailbox: pcc: Check before sending MCTP PCC response ACK
f2fs: fix f2fs_bug_on when uninstalling filesystem call f2fs_evict_inode.
KMSAN: uninit-value in inode_go_dump (5)
i3c: mipi-i3c-hci: Mask ring interrupts before ring stop request
PCI: qcom: Add support for IPQ9574
PCI: vmd: Add DID 8086:B06F and 8086:B60B for Intel client SKUs
PCI: vmd: Set devices to D0 before enabling PM L1 Substates
PCI: Detect and trust built-in Thunderbolt chips
PCI: starfive: Enable controller runtime PM before probing host bridge
PCI: Add 'reset_subordinate' to reset hierarchy below bridge
PCI: Add ACS quirk for Wangxun FF5xxx NICs
remoteproc: qcom: pas: enable SAR2130P audio DSP support
i3c: Use i3cdev->desc->info instead of calling i3c_device_get_info() to avoid deadlock
f2fs: print message if fscorrupted was found in f2fs_new_node_page()
f2fs: fix to shrink read extent node in batches
f2fs: add a sysfs node to limit max read extent count per-inode
ACPI: x86: Add skip i2c clients quirk for Acer Iconia One 8 A1-840
ACPI: x86: Clean up Asus entries in acpi_quirk_skip_dmi_ids[]
LoongArch: Fix sleeping in atomic context for PREEMPT_RT
fs/ntfs3: Fix warning in ni_fiemap
fs/ntfs3: Fix case when unmarked clusters intersect with zone
regulator: qcom-rpmh: Update ranges for FTSMPS525
usb: chipidea: add CI_HDRC_HAS_SHORT_PKT_LIMIT flag
usb: chipidea: udc: limit usb request length to max 16KB
usb: chipidea: udc: create bounce buffer for problem sglist entries if possible
usb: chipidea: udc: handle USB Error Interrupt if IOC not set
usb: typec: ucsi: Do not call ACPI _DSM method for UCSI read operations
iio: adc: ad7192: properly check spi_get_device_match_data()
iio: light: ltr501: Add LTER0303 to the supported devices
usb: typec: ucsi: glink: be more precise on orientation-aware ports
ASoC: amd: yc: fix internal mic on Redmi G 2022
drm/amdgpu/vcn: reset fw_shared when VCPU buffers corrupted on vcn v4.0.3
MIPS: Loongson64: DTS: Really fix PCIe port nodes for ls7a
ASoC: amd: yc: Add quirk for microphone on Lenovo Thinkpad T14s Gen 6 21M1CTO1WW
powerpc/prom_init: Fixup missing powermac #size-cells
misc: eeprom: eeprom_93cx6: Add quirk for extra read clock cycle
rtc: cmos: avoid taking rtc_lock for extended period of time
serial: 8250_dw: Add Sophgo SG2044 quirk
Revert "nvme: make keep-alive synchronous operation"
irqchip/gicv3-its: Add workaround for hip09 ITS erratum 162100801
smb: client: don't try following DFS links in cifs_tree_connect()
setlocalversion: work around "git describe" performance
io_uring/tctx: work around xa_store() allocation error issue
scsi: ufs: pltfrm: Dellocate HBA during ufshcd_pltfrm_remove()
drm/xe/devcoredump: Use drm_puts and already cached local variables
drm/xe/devcoredump: Improve section headings and add tile info
drm/xe/devcoredump: Add ASCII85 dump helper function
drm/xe/guc: Copy GuC log prior to dumping
drm/xe/forcewake: Add a helper xe_force_wake_ref_has_domain()
drm/xe/devcoredump: Update handling of xe_force_wake_get return
drm/amd/display: Add option to retrieve detile buffer size
sched: fix warning in sched_setaffinity
sched/core: Remove the unnecessary need_resched() check in nohz_csd_func()
sched/fair: Check idle_cpu() before need_resched() to detect ilb CPU turning busy
sched/core: Prevent wakeup of ksoftirqd during idle load balance
sched/deadline: Fix warning in migrate_enable for boosted tasks
btrfs: drop unused parameter options from open_ctree()
btrfs: drop unused parameter data from btrfs_fill_super()
btrfs: fix mount failure due to remount races
btrfs: fix missing snapshot drew unlock when root is dead during swap activation
clk: en7523: Initialize num before accessing hws in en7523_register_clocks()
tracing/eprobe: Fix to release eprobe when failed to add dyn_event
x86: Fix build regression with CONFIG_KEXEC_JUMP enabled
Revert "unicode: Don't special case ignorable code points"
vfio/mlx5: Align the page tracking max message size with the device capability
selftests/ftrace: adjust offset for kprobe syntax error test
KVM: x86/mmu: Ensure that kvm_release_pfn_clean() takes exact pfn from kvm_faultin_pfn()
jffs2: Prevent rtime decompress memory corruption
jffs2: Fix rtime decompressor
media: ipu6: use the IPU6 DMA mapping APIs to do mapping
ocfs2: Revert "ocfs2: fix the la space leak when unmounting an ocfs2 volume"
net/mlx5: unique names for per device caches
ASoC: Intel: avs: Fix return status of avs_pcm_hw_constraints_init()
drm/amdgpu: rework resume handling for display (v2)
ALSA: hda: Fix build error without CONFIG_SND_DEBUG
Revert "drm/amd/display: parse umc_info or vram_info based on ASIC"
s390/pci: Fix leak of struct zpci_dev when zpci_add_device() fails
ALSA: hda/realtek: Fix spelling mistake "Firelfy" -> "Firefly"
timekeeping: Remove CONFIG_DEBUG_TIMEKEEPING
clocksource: Make negative motion detection more robust
softirq: Allow raising SCHED_SOFTIRQ from SMP-call-function on RT kernel
Linux 6.12.5
Change-Id: If1b834954ed2ee1a16886f9a9909c6ca62d93b6c
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
[ Upstream commit 7ffc7481153bbabf3332c6a19b289730c7e1edf5 ]
rhashtable does not provide stable walk, duplicated elements are
possible in case of resizing. I considered that checking for errors when
calling rhashtable_walk_next() was sufficient to detect the resizing.
However, rhashtable_walk_next() returns -EAGAIN only at the end of the
iteration, which is too late, because a gc work containing duplicated
elements could have been already scheduled for removal to the worker.
Add a u32 gc worker sequence number per set, bump it on every workqueue
run. Annotate gc worker sequence number on the expired element. Use it
to skip those already seen in this gc workqueue run.
Note that this new field is never reset in case gc transaction fails, so
next gc worker run on the expired element overrides it. Wraparound of gc
worker sequence number should not be an issue with stale gc worker
sequence number in the element, that would just postpone the element
removal in one gc run.
Note that it is not possible to use flags to annotate that element is
pending gc run to detect duplicates, given that gc transaction can be
invalidated in case of update from the control plane, therefore, not
allowing to clear such flag.
On x86_64, pahole reports no changes in the size of nft_rhash_elem.
Fixes: f6c383b8c3 ("netfilter: nf_tables: adapt set backend to use GC transaction API")
Reported-by: Laurent Fasnacht <laurent.fasnacht@proton.ch>
Tested-by: Laurent Fasnacht <laurent.fasnacht@proton.ch>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 456f010bfaefde84d3390c755eedb1b0a5857c3c ]
User space may unload ip_set.ko while it is itself requesting a set type
backend module, leading to a kernel crash. The race condition may be
provoked by inserting an mdelay() right after the nfnl_unlock() call.
Fixes: a7b4f989a6 ("netfilter: ipset: IP set core support")
Signed-off-by: Phil Sutter <phil@nwl.cc>
Acked-by: Jozsef Kadlecsik <kadlec@netfilter.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 7b1d83da254be3bf054965c8f3b1ad976f460ae5 ]
Softirq can interrupt ongoing packet from process context that is
walking over the percpu area that contains inner header offsets.
Disable bh and perform three checks before restoring the percpu inner
header offsets to validate that the percpu area is valid for this
skbuff:
1) If the NFT_PKTINFO_INNER_FULL flag is set on, then this skbuff
has already been parsed before for inner header fetching to
register.
2) Validate that the percpu area refers to this skbuff using the
skbuff pointer as a cookie. If there is a cookie mismatch, then
this skbuff needs to be parsed again.
3) Finally, validate if the percpu area refers to this tunnel type.
Only after these three checks the percpu area is restored to a on-stack
copy and bh is enabled again.
After inner header fetching, the on-stack copy is stored back to the
percpu area.
Fixes: 3a07327d10 ("netfilter: nft_inner: support for inner tunnel header matching")
Reported-by: syzbot+84d0441b9860f0d63285@syzkaller.appspotmail.com
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit b7529880cb961d515642ce63f9d7570869bbbdc3 ]
cgroup maximum depth is INT_MAX by default, there is a cgroup toggle to
restrict this maximum depth to a more reasonable value not to harm
performance. Remove unnecessary WARN_ON_ONCE which is reachable from
userspace.
Fixes: 7f3287db65 ("netfilter: nft_socket: make cgroupsv2 matching work with namespaces")
Reported-by: syzbot+57bac0866ddd99fe47c0@syzkaller.appspotmail.com
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 146b6f1112eb30a19776d6c323c994e9d67790db ]
Under certain kernel configurations when building with Clang/LLVM, the
compiler does not generate a return or jump as the terminator
instruction for ip_vs_protocol_init(), triggering the following objtool
warning during build time:
vmlinux.o: warning: objtool: ip_vs_protocol_init() falls through to next function __initstub__kmod_ip_vs_rr__935_123_ip_vs_rr_init6()
At runtime, this either causes an oops when trying to load the ipvs
module or a boot-time panic if ipvs is built-in. This same issue has
been reported by the Intel kernel test robot previously.
Digging deeper into both LLVM and the kernel code reveals this to be a
undefined behavior problem. ip_vs_protocol_init() uses a on-stack buffer
of 64 chars to store the registered protocol names and leaves it
uninitialized after definition. The function calls strnlen() when
concatenating protocol names into the buffer. With CONFIG_FORTIFY_SOURCE
strnlen() performs an extra step to check whether the last byte of the
input char buffer is a null character (commit 3009f891bb ("fortify:
Allow strlen() and strnlen() to pass compile-time known lengths")).
This, together with possibly other configurations, cause the following
IR to be generated:
define hidden i32 @ip_vs_protocol_init() local_unnamed_addr #5 section ".init.text" align 16 !kcfi_type !29 {
%1 = alloca [64 x i8], align 16
...
14: ; preds = %11
%15 = getelementptr inbounds i8, ptr %1, i64 63
%16 = load i8, ptr %15, align 1
%17 = tail call i1 @llvm.is.constant.i8(i8 %16)
%18 = icmp eq i8 %16, 0
%19 = select i1 %17, i1 %18, i1 false
br i1 %19, label %20, label %23
20: ; preds = %14
%21 = call i64 @strlen(ptr noundef nonnull dereferenceable(1) %1) #23
...
23: ; preds = %14, %11, %20
%24 = call i64 @strnlen(ptr noundef nonnull dereferenceable(1) %1, i64 noundef 64) #24
...
}
The above code calculates the address of the last char in the buffer
(value %15) and then loads from it (value %16). Because the buffer is
never initialized, the LLVM GVN pass marks value %16 as undefined:
%13 = getelementptr inbounds i8, ptr %1, i64 63
br i1 undef, label %14, label %17
This gives later passes (SCCP, in particular) more DCE opportunities by
propagating the undef value further, and eventually removes everything
after the load on the uninitialized stack location:
define hidden i32 @ip_vs_protocol_init() local_unnamed_addr #0 section ".init.text" align 16 !kcfi_type !11 {
%1 = alloca [64 x i8], align 16
...
12: ; preds = %11
%13 = getelementptr inbounds i8, ptr %1, i64 63
unreachable
}
In this way, the generated native code will just fall through to the
next function, as LLVM does not generate any code for the unreachable IR
instruction and leaves the function without a terminator.
Zero the on-stack buffer to avoid this possible UB.
Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202402100205.PWXIz1ZK-lkp@intel.com/
Co-developed-by: Ruowen Qin <ruqin@redhat.com>
Signed-off-by: Ruowen Qin <ruqin@redhat.com>
Signed-off-by: Jinghao Jia <jinghao7@illinois.edu>
Acked-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
GKI (arm64) relevant 159 out of 815 changes, affecting 226 files +2434/-822
a11e7e3d2a arm64: probes: Disable kprobes/uprobes on MOPS instructions [2 files, +6/-2]
78de864e8a block/fs: Pass an iocb to generic_atomic_write_valid() [3 files, +7/-7]
cfe3e04e9a fs/block: Check for IOCB_DIRECT in generic_atomic_write_valid() [3 files, +19/-14]
63dfd728b3 brd: defer automatic disk creation until module initialization succeeds [1 file, +44/-22]
26cc5063e3 ext4: avoid remount errors with 'abort' mount option [1 file, +8/-3]
fb83b093f7 initramfs: avoid filename buffer overrun [1 file, +15/-0]
de56fa09a0 arm64: Expose ID_AA64ISAR1_EL1.XS to sanitised feature consumers [1 file, +1/-0]
582d9ed999 nvme-pci: fix freeing of the HMB descriptor table [1 file, +9/-7]
8ae5e37357 loop: fix type of block size [1 file, +3/-3]
7044259018 block: take chunk_sectors into account in bio_split_write_zeroes [1 file, +23/-12]
731d5bdc74 block: fix bio_split_rw_at to take zone_write_granularity into account [1 file, +9/-1]
61832ee7fa ext4: fix race in buffer_head read fault injection [10 files, +29/-29]
9abae59243 nvme-pci: reverse request order in nvme_queue_rqs [1 file, +17/-22]
475404eac5 virtio_blk: reverse request order in virtio_queue_rqs [1 file, +21/-25]
d01d9005fb thermal: core: Initialize thermal zones before registering them [1 file, +1/-1]
933ef9360a thermal: core: Rearrange PM notification code [1 file, +46/-42]
f52dc3c757 thermal: core: Represent suspend-related thermal zone flags as bits [2 files, +12/-10]
39a5ad6b63 thermal: core: Mark thermal zones as initializing to start with [2 files, +14/-3]
79cb9952e1 thermal: core: Fix race between zone registration and system suspend [1 file, +16/-2]
5ced426d97 rcu/kvfree: Fix data-race in __mod_timer / kvfree_call_rcu [1 file, +12/-2]
94f4e7b0eb cleanup: Remove address space of returned pointer [1 file, +2/-2]
5c3a9f6f7f time: Partially revert cleanup on msecs_to_jiffies() documentation [1 file, +1/-1]
b62a8825d3 time: Fix references to _msecs_to_jiffies() handling of values [2 files, +2/-2]
1dfa6c5200 timers: Add missing READ_ONCE() in __run_timer_base() [1 file, +2/-1]
8dbd7603e4 kcsan, seqlock: Fix incorrect assumption in read_seqbegin() [1 file, +1/-11]
0916201308 sched/ext: Remove sched_fork() hack [2 files, +1/-7]
351bb7f9ec soc: qcom: geni-se: fix array underflow in geni_se_clk_tbl_get() [1 file, +2/-1]
c365c1456e efi/libstub: fix efi_parse_options() ignoring the default command line [1 file, +1/-1]
30e42ac0bd tpm: fix signed/unsigned bug when checking event logs [1 file, +9/-8]
dd6ade970d Revert "cgroup: Fix memory leak caused by missing cgroup_bpf_offline" [1 file, +1/-3]
f390525e49 cgroup/bpf: only cgroup v2 can be attached by bpf programs [1 file, +11/-6]
a5b7bc2747 regmap: irq: Set lockdep class for hierarchical IRQ domains [1 file, +4/-0]
9beaff47bc firmware: arm_scpi: Check the DVFS OPP count returned by the firmware [1 file, +3/-0]
e369246067 pwm: Assume a disabled PWM to emit a constant inactive output [1 file, +7/-3]
f9aaa841ac drm/mm: Mark drm_mm_interval_tree*() functions with __maybe_unused [1 file, +1/-1]
4d8621151b bpf, arm64: Remove garbage frame for struct_ops trampoline [1 file, +31/-16]
aa51be3fa9 bpf: Tighten tail call checks for lingering locks, RCU, preempt_disable [1 file, +15/-0]
3634d4a310 bpf: Mark raw_tp arguments with PTR_MAYBE_NULL [4 files, +87/-9]
e883c475c4 drm: use ATOMIC64_INIT() for atomic64_t [1 file, +1/-1]
bc23584768 netlink: typographical error in nlmsg_type constants definition [1 file, +1/-1]
ce06c450ac bpf, sockmap: Several fixes to bpf_msg_push_data [1 file, +33/-20]
275a9f3ef8 bpf, sockmap: Several fixes to bpf_msg_pop_data [1 file, +9/-6]
08baa3f0a1 bpf, sockmap: Fix sk_msg_reset_curr [1 file, +9/-11]
0e4c6faaef ipv6: release nexthop on device removal [1 file, +3/-3]
36ede57f0c bpf: Allow return values 0 and 1 for kprobe session [1 file, +9/-0]
9ff1b95ccd bpf: Force uprobe bpf program to always return 0 [1 file, +2/-3]
34a949e7a0 ipv6: Fix soft lockups in fib6_select_path under high next hop churn [4 files, +297/-19]
9c44c06123 bpf: Use function pointers count as struct_ops links count [1 file, +25/-10]
449b1a7178 bpf: Add kernel symbol for struct_ops trampoline [4 files, +89/-5]
3397001cfa Bluetooth: btbcm: fix missing of_node_put() in btbcm_get_board_name() [1 file, +1/-3]
a58d0f5dac Bluetooth: ISO: Use kref to track lifetime of iso_conn [1 file, +71/-17]
67ead8f86a Bluetooth: ISO: Do not emit LE PA Create Sync if previous is pending [4 files, +139/-40]
91d19383b7 Bluetooth: ISO: Do not emit LE BIG Create Sync if previous is pending [5 files, +125/-16]
1360e5b6ce Bluetooth: ISO: Send BIG Create Sync via hci_sync [2 files, +25/-1]
7b277bd569 Bluetooth: fix use-after-free in device_for_each_child() [1 file, +4/-11]
d5d346deb6 xsk: Free skb when TX metadata options are invalid [1 file, +6/-5]
5036f2f024 erofs: fix file-backed mounts over FUSE [2 files, +7/-4]
679d8537e5 erofs: fix blksize < PAGE_SIZE for file-backed mounts [1 file, +5/-1]
daaf68fef4 erofs: handle NONHEAD !delta[1] lclusters gracefully [1 file, +9/-8]
6b8b9d9b06 netpoll: Use rcu_access_pointer() in netpoll_poll_lock [1 file, +1/-1]
f84c5ef6ca bpf: fix recursive lock when verdict program return SK_PASS [1 file, +2/-2]
89933f8ab3 unicode: Fix utf8_load() error path [1 file, +1/-1]
b746a3afa2 trace/trace_event_perf: remove duplicate samples on the first tracepoint event [1 file, +6/-0]
e691826a3d kasan: move checks to do_strncpy_from_user [1 file, +3/-2]
843d366ff1 zram: fix NULL pointer in comp_algorithm_show() [1 file, +2/-3]
fe6fae61f3 PCI: Fix reset_method_store() memory leak [1 file, +3/-2]
a26ace3c6e f2fs: compress: fix inconsistent update of i_blocks in release_compress_blocks and reserve_compress_blocks [1 file, +1/-1]
9e11b1d5fd f2fs: fix null-ptr-deref in f2fs_submit_page_bio() [1 file, +6/-6]
2bc07714dc virtiofs: use pages instead of pointer for kernel direct IO [3 files, +50/-19]
c31c7b81c1 i3c: master: Remove i3c_dev_disable_ibi_locked(olddev) on device hotjoin [1 file, +9/-4]
9b57a3f7e3 f2fs: fix the wrong f2fs_bug_on condition in f2fs_do_replace_block [1 file, +1/-1]
abfd2c13ba f2fs: check curseg->inited before write_sum_page in change_curseg [1 file, +2/-1]
5e69964251 f2fs: Fix not used variable 'index' [1 file, +2/-2]
801092a2c9 f2fs: fix to avoid potential deadlock in f2fs_record_stop_reason() [3 files, +9/-9]
a16e6f7966 PCI: qcom: Enable MSI interrupts together with Link up if 'Global IRQ' is supported [1 file, +3/-1]
c631207897 f2fs: fix race in concurrent f2fs_stop_gc_thread [1 file, +6/-3]
a10cc033b2 f2fs: fix to map blocks correctly for direct write [1 file, +2/-1]
bbe48e47b9 f2fs: fix to avoid forcing direct write to use buffered IO on inline_data inode [1 file, +5/-1]
45438da843 f2fs: fix to do cast in F2FS_{BLK_TO_BYTES, BTYES_TO_BLK} to avoid overflow [2 files, +4/-4]
f7f7f22dbb power: supply: core: Remove might_sleep() from power_supply_put() [1 file, +0/-2]
28af028a71 netlink: fix false positive warning in extack during dumps [1 file, +11/-10]
ad6e5bdca3 exfat: fix file being changed by unaligned direct write [1 file, +10/-0]
a487cc8986 net/l2tp: fix warning in l2tp_exit_net found by syzbot [1 file, +19/-3]
cb74207ef9 net/ipv6: delete temporary address if mngtmpaddr is removed or unmanaged [1 file, +29/-12]
87819234aa Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync [1 file, +9/-2]
cac34e4428 Bluetooth: MGMT: Fix possible deadlocks [1 file, +18/-9]
6d84502860 tcp: Fix use-after-free of nreq in reqsk_timer_handler(). [1 file, +1/-1]
ead7c1263e ip6mr: fix tables suspicious RCU usage [1 file, +27/-11]
14367e7170 usb: gadget: uvc: wake pump everytime we update the free list [1 file, +4/-0]
f380f895db firmware_loader: Fix possible resource leak in fw_log_firmware_info() [1 file, +2/-3]
98b8725630 f2fs: fix fiemap failure issue when page size is 16KB [1 file, +1/-21]
d716851d0a net_sched: sch_fq: don't follow the fast path if Tx is behind now [1 file, +6/-0]
b521b53ac6 ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices [1 file, +21/-6]
096bb5b43e ALSA: usb-audio: Fix out of bounds reads when finding clock sources [1 file, +23/-1]
ec56ada623 ext4: supress data-race warnings in ext4_free_inodes_{count,set}() [1 file, +4/-4]
ad34d9c738 ext4: fix FS_IOC_GETFSMAP handling [3 files, +68/-5]
f594a5683a KVM: arm64: vgic-v3: Sanitise guest writes to GICR_INVLPIR [1 file, +6/-1]
8b6916f4cf KVM: arm64: Ignore PMCNTENSET_EL0 while checking for overflow status [1 file, +0/-1]
d0571c3add KVM: arm64: Don't retire aborted MMIO instruction [1 file, +30/-2]
eabd7ef140 KVM: arm64: vgic-its: Clear ITE when DISCARD frees an ITE [1 file, +5/-1]
fe425d5239 KVM: arm64: Get rid of userspace_irqchip_in_use [3 files, +4/-19]
46018a04c5 KVM: arm64: vgic-its: Add a data length check in vgic_its_save_* [2 files, +31/-12]
1059f1e5f5 KVM: arm64: vgic-its: Clear DTE when MAPD unmaps a device [1 file, +4/-2]
69d2ceac11 PCI: Fix use-after-free of slot->bus on hot remove [1 file, +3/-1]
a6b283526b fsnotify: fix sending inotify event with unexpected filename [1 file, +13/-10]
83af1cfa10 fsnotify: Fix ordering of iput() and watched_objects decrement [1 file, +9/-3]
53bbfa6896 tty: ldsic: fix tty_ldisc_autoload sysctl's proc_handler [1 file, +1/-1]
88232a223a locking/lockdep: Avoid creating new name string literals in lockdep_set_subclass() [1 file, +1/-1]
a4fc6966d8 fcntl: make F_DUPFD_QUERY associative [1 file, +3/-0]
c500b0cca2 exfat: fix uninit-value in __exfat_get_dentry_set [1 file, +1/-0]
3ddd1cb2b4 exfat: fix out-of-bounds access of directory entries [1 file, +16/-4]
9258c9ed32 xhci: Fix control transfer error on Etron xHCI host [1 file, +14/-0]
218796e95a xhci: Combine two if statements for Etron xHCI host [1 file, +2/-6]
a92cd42097 xhci: Don't perform Soft Retry for Etron xHCI host [1 file, +1/-0]
827f963a0b xhci: Don't issue Reset Device command to Etron xHCI host [3 files, +21/-0]
33209e6f29 Bluetooth: Fix type of len in rfcomm_sock_getsockopt{,_old}() [1 file, +6/-4]
2637e8c5fb usb: xhci: Limit Stop Endpoint retries [3 files, +27/-4]
61bce2d8ff usb: xhci: Fix TD invalidation under pending Set TR Dequeue [1 file, +13/-5]
6debdd82c3 usb: xhci: Avoid queuing redundant Stop Endpoint commands [3 files, +29/-4]
13111945c2 Revert "fs: don't block i_writecount during exec" [5 files, +49/-14]
0586f12896 Revert "f2fs: remove unreachable lazytime mount option parsing" [1 file, +10/-0]
ca82b37c47 Revert "usb: gadget: composite: fix OS descriptors w_value logic" [1 file, +15/-3]
d222fd21dd io_uring: fix corner case forgetting to vunmap [1 file, +3/-1]
aaa90844af io_uring: check for overflows in io_pin_pages [1 file, +6/-1]
37c2ca4e89 blk-settings: round down io_opt to physical_block_size [1 file, +7/-0]
97b68bda72 spi: Fix acpi deferred irq probe [1 file, +10/-3]
e881c8f0a7 serial: amba-pl011: Fix RX stall when DMA is used [1 file, +5/-0]
1fae444a61 serial: amba-pl011: fix build regression [1 file, +2/-0]
7baf942326 Revert "block, bfq: merge bfq_release_process_ref() into bfq_put_cooperator()" [2 files, +5/-2]
43375e9bb7 block: Prevent potential deadlock in blk_revalidate_disk_zones() [1 file, +10/-4]
4ef8b6f7c4 ublk: fix ublk_ch_mmap() for 64K page size [1 file, +12/-3]
e4d1f38bc0 arm64: tls: Fix context-switching of tpidrro_el0 when kpti is enabled [1 file, +1/-1]
8b25c0a165 block: fix missing dispatching request when queue is started or unquiesced [1 file, +2/-0]
2094bd1b52 block: fix ordering between checking QUEUE_FLAG_QUIESCED request adding [1 file, +34/-13]
4170346747 block: fix ordering between checking BLK_MQ_S_STOPPED request adding [2 files, +19/-0]
aeb420ebdf blk-mq: Make blk_mq_quiesce_tagset() hold the tag list mutex less long [1 file, +2/-1]
28d4191e19 HID: wacom: Interpret tilt data from Intuos Pro BT as signed values [1 file, +2/-2]
343e3e903c netdev-genl: Hold rcu_read_lock in napi_get [1 file, +2/-0]
df225df839 ALSA: rawmidi: Fix kvfree() call in spinlock [1 file, +3/-1]
0c4c9bf5ea ALSA: pcm: Add sanity NULL check for the default mmap fault handler [1 file, +4/-2]
068aab9564 usb: dwc3: ep0: Don't clear ep0 DWC3_EP_TRANSFER_STARTED [1 file, +1/-1]
2f6c3acece usb: dwc3: gadget: Fix checking for number of TRBs left [1 file, +6/-3]
70777a23a5 usb: dwc3: gadget: Fix looping of queued SG entries [1 file, +3/-3]
31e45c09a8 ublk: fix error code for unsupported command [1 file, +1/-1]
9517bc76ff lib: string_helpers: silence snprintf() output truncation warning [1 file, +1/-1]
0a5c8b3fbf f2fs: fix to do sanity check on node blkaddr in truncate_node() [1 file, +10/-0]
e77bce0a8c rtc: check if __rtc_read_time was successful in rtc_timer_do_work() [1 file, +6/-1]
4eaa19c620 nvme/multipath: Fix RCU list traversal to use SRCU primitive [1 file, +14/-7]
9c3d53f113 blk-mq: add non_owner variant of start_freeze/unfreeze queue APIs [2 files, +22/-0]
a6fc2ba1c7 block: model freeze & enter queue as lock for supporting lockdep [5 files, +81/-13]
61092568f2 block: fix uaf for flush rq while iterating tags [2 files, +5/-10]
5e15cc7a1d block: return unsigned int from bdev_io_min [1 file, +1/-1]
5416b76a81 nvme-fabrics: fix kernel crash while shutting down controller [1 file, +5/-0]
d5457349e5 block: Don't allow an atomic write be truncated in blkdev_write_iter() [1 file, +4/-1]
e70c21daad modpost: remove incorrect code in do_eisa_entry() [1 file, +1/-4]
01a853faae block, bfq: fix bfqq uaf in bfq_limit_depth() [1 file, +24/-13]
fbc342372a brd: decrease the number of allocated pages which discarded [1 file, +3/-1]
b12cfcae8a block: always verify unfreeze lock on the owner task [4 files, +61/-10]
6cea47849d block: don't verify IO lock for freeze/unfreeze in elevator_init_mq() [1 file, +8/-2]
Changes in 6.12.2
MAINTAINERS: appoint myself the XFS maintainer for 6.12 LTS
drm/amd/display: Skip Invalid Streams from DSC Policy
drm/amd/display: Fix incorrect DSC recompute trigger
s390/facilities: Fix warning about shadow of global variable
s390/virtio_ccw: Fix dma_parm pointer not set up
efs: fix the efs new mount api implementation
arm64: probes: Disable kprobes/uprobes on MOPS instructions
kselftest/arm64: hwcap: fix f8dp2 cpuinfo name
kselftest/arm64: mte: fix printf type warnings about __u64
kselftest/arm64: mte: fix printf type warnings about longs
block/fs: Pass an iocb to generic_atomic_write_valid()
fs/block: Check for IOCB_DIRECT in generic_atomic_write_valid()
s390/cio: Do not unregister the subchannel based on DNV
s390/pageattr: Implement missing kernel_page_present()
x86/pvh: Call C code via the kernel virtual mapping
brd: defer automatic disk creation until module initialization succeeds
ext4: avoid remount errors with 'abort' mount option
mips: asm: fix warning when disabling MIPS_FP_SUPPORT
s390/cpum_sf: Fix and protect memory allocation of SDBs with mutex
initramfs: avoid filename buffer overrun
arm64: Expose ID_AA64ISAR1_EL1.XS to sanitised feature consumers
kselftest/arm64: Fix encoding for SVE B16B16 test
nvme-pci: fix freeing of the HMB descriptor table
m68k: mvme147: Fix SCSI controller IRQ numbers
m68k: mvme147: Reinstate early console
arm64: fix .data.rel.ro size assertion when CONFIG_LTO_CLANG
acpi/arm64: Adjust error handling procedure in gtdt_parse_timer_block()
loop: fix type of block size
cachefiles: Fix incorrect length return value in cachefiles_ondemand_fd_write_iter()
cachefiles: Fix missing pos updates in cachefiles_ondemand_fd_write_iter()
cachefiles: Fix NULL pointer dereference in object->file
netfs/fscache: Add a memory barrier for FSCACHE_VOLUME_CREATING
block: take chunk_sectors into account in bio_split_write_zeroes
block: fix bio_split_rw_at to take zone_write_granularity into account
s390/syscalls: Avoid creation of arch/arch/ directory
hfsplus: don't query the device logical block size multiple times
ext4: fix race in buffer_head read fault injection
nvme-pci: reverse request order in nvme_queue_rqs
virtio_blk: reverse request order in virtio_queue_rqs
crypto: mxs-dcp - Fix AES-CBC with hardware-bound keys
crypto: caam - Fix the pointer passed to caam_qi_shutdown()
crypto: qat - remove check after debugfs_create_dir()
crypto: qat/qat_420xx - fix off by one in uof_get_name()
crypto: qat/qat_4xxx - fix off by one in uof_get_name()
firmware: google: Unregister driver_info on failure
EDAC/bluefield: Fix potential integer overflow
crypto: qat - remove faulty arbiter config reset
thermal: core: Initialize thermal zones before registering them
thermal: core: Rearrange PM notification code
thermal: core: Represent suspend-related thermal zone flags as bits
thermal: core: Mark thermal zones as initializing to start with
thermal: core: Fix race between zone registration and system suspend
EDAC/fsl_ddr: Fix bad bit shift operations
EDAC/skx_common: Differentiate memory error sources
EDAC/{skx_common,i10nm}: Fix incorrect far-memory error source indicator
crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY
crypto: cavium - Fix the if condition to exit loop after timeout
cpufreq/amd-pstate: Don't update CPPC request in amd_pstate_cpu_boost_update()
amd-pstate: Set min_perf to nominal_perf for active mode performance gov
crypto: hisilicon/qm - disable same error report before resetting
EDAC/igen6: Avoid segmentation fault on module unload
crypto: qat - Fix missing destroy_workqueue in adf_init_aer()
crypto: inside-secure - Fix the return value of safexcel_xcbcmac_cra_init()
sched/cpufreq: Ensure sd is rebuilt for EAS check
doc: rcu: update printed dynticks counter bits
rcu/srcutiny: don't return before reenabling preemption
rcu/kvfree: Fix data-race in __mod_timer / kvfree_call_rcu
rcu/nocb: Fix missed RCU barrier on deoffloading
hwmon: (pmbus/core) clear faults after setting smbalert mask
hwmon: (nct6775-core) Fix overflows seen when writing limit attributes
ACPI: CPPC: Fix _CPC register setting issue
thermal: testing: Use DEFINE_FREE() and __free() to simplify code
thermal: testing: Initialize some variables annoteded with _free()
crypto: caam - add error check to caam_rsa_set_priv_key_form
crypto: bcm - add error check in the ahash_hmac_init function
crypto: cavium - Fix an error handling path in cpt_ucode_load_fw()
rcuscale: Do a proper cleanup if kfree_scale_init() fails
tools/lib/thermal: Make more generic the command encoding function
thermal/lib: Fix memory leak on error in thermal_genl_auto()
x86/unwind/orc: Fix unwind for newly forked tasks
Revert "scripts/faddr2line: Check only two symbols when calculating symbol size"
cleanup: Remove address space of returned pointer
time: Partially revert cleanup on msecs_to_jiffies() documentation
time: Fix references to _msecs_to_jiffies() handling of values
timers: Add missing READ_ONCE() in __run_timer_base()
locking/atomic/x86: Use ALT_OUTPUT_SP() for __alternative_atomic64()
locking/atomic/x86: Use ALT_OUTPUT_SP() for __arch_{,try_}cmpxchg64_emu()
kcsan, seqlock: Support seqcount_latch_t
kcsan, seqlock: Fix incorrect assumption in read_seqbegin()
sched/ext: Remove sched_fork() hack
locking/rt: Add sparse annotation PREEMPT_RT's sleeping locks.
rust: helpers: Avoid raw_spin_lock initialization for PREEMPT_RT
clocksource/drivers:sp804: Make user selectable
clocksource/drivers/timer-ti-dm: Fix child node refcount handling
irqchip/riscv-aplic: Prevent crash when MSI domain is missing
regulator: qcom-smd: make smd_vreg_rpm static
spi: spi-fsl-lpspi: Use IRQF_NO_AUTOEN flag in request_irq()
arm64: dts: qcom: qcs6390-rb3gen2: use modem.mbn for modem DSP
ARM: dts: renesas: genmai: Fix partition size for QSPI NOR Flash
drivers: soc: xilinx: add the missing kfree in xlnx_add_cb_for_suspend()
microblaze: Export xmb_manager functions
arm64: dts: mediatek: mt8188: Fix wrong clock provider in MFG1 power domain
arm64: dts: mediatek: mt8395-genio-1200-evk: Fix dtbs_check error for phy
arm64: dts: mt8195: Fix dtbs_check error for mutex node
arm64: dts: mt8195: Fix dtbs_check error for infracfg_ao node
arm64: dts: mediatek: mt8183-kukui: Disable DPI display interface
arm64: dts: mt8183: Add port node to dpi node
soc: ti: smartreflex: Use IRQF_NO_AUTOEN flag in request_irq()
soc: qcom: geni-se: fix array underflow in geni_se_clk_tbl_get()
arm64: dts: qcom: sm6350: Fix GPU frequencies missing on some speedbins
arm64: dts: qcom: sda660-ifc6560: fix l10a voltage ranges
ARM: dts: microchip: sam9x60: Add missing property atmel,usart-mode
mmc: mmc_spi: drop buggy snprintf()
scripts/kernel-doc: Do not track section counter across processed files
arm64: dts: qcom: x1e80100-slim7x: Drop orientation-switch from USB SS[0-1] QMP PHYs
arm64: dts: qcom: x1e80100-vivobook-s15: Drop orientation-switch from USB SS[0-1] QMP PHYs
openrisc: Implement fixmap to fix earlycon
efi/libstub: fix efi_parse_options() ignoring the default command line
tpm: fix signed/unsigned bug when checking event logs
media: i2c: max96717: clean up on error in max96717_subdev_init()
media: i2c: vgxy61: Fix an error handling path in vgxy61_detect()
media: i2c: ds90ub960: Fix missing return check on ub960_rxport_read call
arm64: dts: mt8183: krane: Fix the address of eeprom at i2c4
arm64: dts: mt8183: kukui: Fix the address of eeprom at i2c4
arm64: dts: qcom: x1e80100: Resize GIC Redistributor register region
kernel-doc: allow object-like macros in ReST output
arm64: dts: ti: k3-am62x-phyboard-lyra: Drop unnecessary McASP AFIFOs
gpio: sloppy-logic-analyzer remove reference to rcu_momentary_dyntick_idle()
arm64: dts: mediatek: mt8173-elm-hana: Add vdd-supply to second source trackpad
arm64: dts: mediatek: mt8188: Fix USB3 PHY port default status
arm64: dts: mediatek: mt8195-cherry: Use correct audio codec DAI
Revert "cgroup: Fix memory leak caused by missing cgroup_bpf_offline"
cgroup/bpf: only cgroup v2 can be attached by bpf programs
regulator: rk808: Restrict DVS GPIOs to the RK808 variant only
power: sequencing: make the QCom PMU pwrseq driver depend on CONFIG_OF
arm64: tegra: p2180: Add mandatory compatible for WiFi node
arm64: dts: rockchip: Remove 'enable-active-low' from two boards
arm64: dts: mt8183: fennel: add i2c2's i2c-scl-internal-delay-ns
arm64: dts: mt8183: burnet: add i2c2's i2c-scl-internal-delay-ns
arm64: dts: mt8183: cozmo: add i2c2's i2c-scl-internal-delay-ns
arm64: dts: mt8183: Damu: add i2c2's i2c-scl-internal-delay-ns
pwm: imx27: Workaround of the pwm output bug when decrease the duty cycle
ARM: dts: cubieboard4: Fix DCDC5 regulator constraints
arm64: dts: ti: k3-j7200: Fix register map for main domain pmx
arm64: dts: ti: k3-j7200: Fix clock ids for MCSPI instances
arm64: dts: ti: k3-j721e: Fix clock IDs for MCSPI instances
arm64: dts: ti: k3-j721s2: Fix clock IDs for MCSPI instances
watchdog: Add HAS_IOPORT dependency for SBC8360 and SBC7240
arm64: dts: qcom: x1e80100: Update C4/C5 residency/exit numbers
dt-bindings: cache: qcom,llcc: Fix X1E80100 reg entries
of/fdt: add dt_phys arg to early_init_dt_scan and early_init_dt_verify
pmdomain: ti-sci: Add missing of_node_put() for args.np
spi: tegra210-quad: Avoid shift-out-of-bounds
spi: zynqmp-gqspi: Undo runtime PM changes at driver exit time
regmap: irq: Set lockdep class for hierarchical IRQ domains
arm64: dts: renesas: hihope: Drop #sound-dai-cells
arm64: dts: imx8mn-tqma8mqnl-mba8mx-usbot: fix coexistence of output-low and output-high in GPIO
arm64: dts: mediatek: mt6358: fix dtbs_check error
arm64: dts: mediatek: mt8183-kukui-jacuzzi: Fix DP bridge supply names
arm64: dts: mediatek: mt8183-kukui-jacuzzi: Add supplies for fixed regulators
selftests/resctrl: Print accurate buffer size as part of MBM results
selftests/resctrl: Fix memory overflow due to unhandled wraparound
selftests/resctrl: Protect against array overrun during iMC config parsing
firmware: arm_scpi: Check the DVFS OPP count returned by the firmware
media: ipu6: Fix DMA and physical address debugging messages for 32-bit
media: ipu6: not override the dma_ops of device in driver
media: ipu6: remove architecture DMA ops dependency in Kconfig
pwm: Assume a disabled PWM to emit a constant inactive output
media: atomisp: Add check for rgby_data memory allocation failure
arm64: dts: rockchip: correct analog audio name on Indiedroid Nova
sched_ext: scx_bpf_dispatch_from_dsq_set_*() are allowed from unlocked context
HID: hyperv: streamline driver probe to avoid devres issues
platform/x86: asus-wmi: Fix inconsistent use of thermal policies
platform/x86/intel/pmt: allow user offset for PMT callbacks
platform/x86: panasonic-laptop: Return errno correctly in show callback
drm/imagination: Convert to use time_before macro
drm/imagination: Use pvr_vm_context_get()
drm/mm: Mark drm_mm_interval_tree*() functions with __maybe_unused
drm/vc4: hvs: Don't write gamma luts on 2711
drm/vc4: hdmi: Avoid hang with debug registers when suspended
drm/vc4: hvs: Fix dlist debug not resetting the next entry pointer
drm/vc4: hvs: Remove incorrect limit from hvs_dlist debugfs function
drm/vc4: hvs: Correct logic on stopping an HVS channel
wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service()
drm/omap: Fix possible NULL dereference
drm/omap: Fix locking in omap_gem_new_dmabuf()
drm/v3d: Appease lockdep while updating GPU stats
wifi: p54: Use IRQF_NO_AUTOEN flag in request_irq()
wifi: mwifiex: Use IRQF_NO_AUTOEN flag in request_irq()
udmabuf: change folios array from kmalloc to kvmalloc
udmabuf: fix vmap_udmabuf error page set
drm/imx/dcss: Use IRQF_NO_AUTOEN flag in request_irq()
drm/imx/ipuv3: Use IRQF_NO_AUTOEN flag in request_irq()
drm/panel: nt35510: Make new commands optional
drm/v3d: Address race-condition in MMU flush
drm/v3d: Flush the MMU before we supply more memory to the binner
drm/amdgpu: Fix JPEG v4.0.3 register write
wifi: ath10k: fix invalid VHT parameters in supported_vht_mcs_rate_nss1
wifi: ath10k: fix invalid VHT parameters in supported_vht_mcs_rate_nss2
wifi: ath12k: Skip Rx TID cleanup for self peer
dt-bindings: vendor-prefixes: Add NeoFidelity, Inc
ASoC: fsl_micfil: fix regmap_write_bits usage
ASoC: dt-bindings: mt6359: Update generic node name and dmic-mode
drm/amdgpu/gfx9: Add Cleaner Shader Deinitialization in gfx_v9_0 Module
ASoC: fsl-asoc-card: Add missing handling of {hp,mic}-dt-gpios
drm/bridge: anx7625: Drop EDID cache on bridge power off
drm/bridge: it6505: Drop EDID cache on bridge power off
libbpf: Fix expected_attach_type set handling in program load callback
libbpf: Fix output .symtab byte-order during linking
selftests/bpf: Fix uprobe_multi compilation error
dlm: fix swapped args sb_flags vs sb_status
wifi: rtl8xxxu: Perform update_beacon_work when beaconing is enabled
ASoC: amd: acp: fix for inconsistent indenting
ASoC: amd: acp: fix for cpu dai index logic
drm/amd/display: fix a memleak issue when driver is removed
wifi: ath12k: fix use-after-free in ath12k_dp_cc_cleanup()
wifi: ath12k: fix one more memcpy size error
libbpf: Add missing per-arch include path
selftests: bpf: Add missing per-arch include path
bpf: Fix the xdp_adjust_tail sample prog issue
selftests/bpf: Fix backtrace printing for selftests crashes
wifi: ath11k: Fix CE offset address calculation for WCN6750 in SSR
selftests/bpf: add missing header include for htons
wifi: cfg80211: check radio iface combination for multi radio per wiphy
ice: consistently use q_idx in ice_vc_cfg_qs_msg()
drm/vc4: hdmi: Increase audio MAI fifo dreq threshold
drm/vc4: Introduce generation number enum
drm/vc4: Match drm_dev_enter and exit calls in vc4_hvs_lut_load
drm/vc4: Match drm_dev_enter and exit calls in vc4_hvs_atomic_flush
drm/vc4: Correct generation check in vc4_hvs_lut_load
libbpf: fix sym_is_subprog() logic for weak global subprogs
accel/ivpu: Prevent recovery invocation during probe and resume
ASoC: rt722-sdca: Remove logically deadcode in rt722-sdca.c
libbpf: never interpret subprogs in .text as entry programs
netdevsim: copy addresses for both in and out paths
drm/bridge: tc358767: Fix link properties discovery
drm/panic: Select ZLIB_DEFLATE for DRM_PANIC_SCREEN_QR_CODE
selftests/bpf: Fix msg_verify_data in test_sockmap
selftests/bpf: Fix txmsg_redir of test_txmsg_pull in test_sockmap
wifi: mwifiex: add missing locking for cfg80211 calls
wifi: wilc1000: Set MAC after operation mode
wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_config_scan()
drm: fsl-dcu: enable PIXCLK on LS1021A
drm: panel: nv3052c: correct spi_device_id for RG35XX panel
drm/msm/dpu: on SDM845 move DSPP_3 to LM_5 block
drm/msm/dpu: drop LM_3 / LM_4 on SDM845
drm/msm/dpu: drop LM_3 / LM_4 on MSM8998
octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_common.c
octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_ethtool.c
octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_flows.c
octeontx2-pf: handle otx2_mbox_get_rsp errors in cn10k.c
octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_dmac_flt.c
octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_dcbnl.c
selftests/bpf: fix test_spin_lock_fail.c's global vars usage
libbpf: move global data mmap()'ing into bpf_object__load()
wifi: rtw89: rename rtw89_vif to rtw89_vif_link ahead for MLO
wifi: rtw89: rename rtw89_sta to rtw89_sta_link ahead for MLO
wifi: rtw89: read bss_conf corresponding to the link
wifi: rtw89: read link_sta corresponding to the link
wifi: rtw89: refactor VIF related func ahead for MLO
wifi: rtw89: refactor STA related func ahead for MLO
wifi: rtw89: tweak driver architecture for impending MLO support
wifi: rtw89: Fix TX fail with A2DP after scanning
wifi: rtw89: unlock on error path in rtw89_ops_unassign_vif_chanctx()
drm/panfrost: Remove unused id_mask from struct panfrost_model
bpf, arm64: Remove garbage frame for struct_ops trampoline
drm/msm/adreno: Use IRQF_NO_AUTOEN flag in request_irq()
drm/msm/gpu: Check the status of registration to PM QoS
drm/xe/hdcp: Fix gsc structure check in fw check status
drm/etnaviv: Request pages from DMA32 zone on addressing_limited
drm/etnaviv: hold GPU lock across perfmon sampling
drm/amd/display: Increase idle worker HPD detection time
drm/amd/display: Reduce HPD Detection Interval for IPS
drm/nouveau/gr/gf100: Fix missing unlock in gf100_gr_chan_new()
drm: zynqmp_kms: Unplug DRM device before removal
drm: xlnx: zynqmp_disp: layer may be null while releasing
wifi: wfx: Fix error handling in wfx_core_init()
wifi: cw1200: Fix potential NULL dereference
drm/msm/dpu: cast crtc_clk calculation to u64 in _dpu_core_perf_calc_clk()
bpf, bpftool: Fix incorrect disasm pc
bpf: Tighten tail call checks for lingering locks, RCU, preempt_disable
drm/vkms: Drop unnecessary call to drm_crtc_cleanup()
drm/amdgpu: Fix the memory allocation issue in amdgpu_discovery_get_nps_info()
drm/amdkfd: Use dynamic allocation for CU occupancy array in 'kfd_get_cu_occupancy()'
bpf: Mark raw_tp arguments with PTR_MAYBE_NULL
drm: use ATOMIC64_INIT() for atomic64_t
netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion
netfilter: nf_tables: must hold rcu read lock while iterating expression type list
netfilter: nf_tables: must hold rcu read lock while iterating object type list
netlink: typographical error in nlmsg_type constants definition
wifi: rtw89: coex: check NULL return of kmalloc in btc_fw_set_monreg()
drm/panfrost: Add missing OPP table refcnt decremental
drm/panthor: introduce job cycle and timestamp accounting
drm/panthor: record current and maximum device clock frequencies
drm/panthor: Fix OPP refcnt leaks in devfreq initialisation
isofs: avoid memory leak in iocharset
selftests/bpf: Add txmsg_pass to pull/push/pop in test_sockmap
selftests/bpf: Fix SENDPAGE data logic in test_sockmap
selftests/bpf: Fix total_bytes in msg_loop_rx in test_sockmap
selftests/bpf: Add push/pop checking for msg_verify_data in test_sockmap
bpf, sockmap: Several fixes to bpf_msg_push_data
bpf, sockmap: Several fixes to bpf_msg_pop_data
bpf, sockmap: Fix sk_msg_reset_curr
ipv6: release nexthop on device removal
selftests: net: really check for bg process completion
wifi: cfg80211: Remove the Medium Synchronization Delay validity check
wifi: iwlwifi: allow fast resume on ax200
wifi: iwlwifi: mvm: tell iwlmei when we finished suspending
drm/amdgpu: fix ACA bank count boundary check error
drm/amdgpu: Fix map/unmap queue logic
drm/amdkfd: Fix wrong usage of INIT_WORK()
bpf: Allow return values 0 and 1 for kprobe session
bpf: Force uprobe bpf program to always return 0
selftests/bpf: skip the timer_lockup test for single-CPU nodes
ipv6: Fix soft lockups in fib6_select_path under high next hop churn
net: rfkill: gpio: Add check for clk_enable()
Revert "wifi: iwlegacy: do not skip frames with bad FCS"
bpf: Use function pointers count as struct_ops links count
bpf: Add kernel symbol for struct_ops trampoline
ALSA: usx2y: Use snd_card_free_when_closed() at disconnection
ALSA: us122l: Use snd_card_free_when_closed() at disconnection
ALSA: caiaq: Use snd_card_free_when_closed() at disconnection
ALSA: 6fire: Release resources at card release
i2c: dev: Fix memory leak when underlying adapter does not support I2C
selftests: netfilter: Fix missing return values in conntrack_dump_flush
Bluetooth: btintel_pcie: Add handshake between driver and firmware
Bluetooth: btintel: Do no pass vendor events to stack
Bluetooth: btmtk: adjust the position to init iso data anchor
Bluetooth: btbcm: fix missing of_node_put() in btbcm_get_board_name()
Bluetooth: ISO: Use kref to track lifetime of iso_conn
Bluetooth: ISO: Do not emit LE PA Create Sync if previous is pending
Bluetooth: ISO: Do not emit LE BIG Create Sync if previous is pending
Bluetooth: ISO: Send BIG Create Sync via hci_sync
Bluetooth: fix use-after-free in device_for_each_child()
xsk: Free skb when TX metadata options are invalid
erofs: fix file-backed mounts over FUSE
erofs: fix blksize < PAGE_SIZE for file-backed mounts
erofs: handle NONHEAD !delta[1] lclusters gracefully
dlm: fix dlm_recover_members refcount on error
eth: fbnic: don't disable the PCI device twice
net: txgbe: remove GPIO interrupt controller
net: txgbe: fix null pointer to pcs
netpoll: Use rcu_access_pointer() in netpoll_poll_lock
wireguard: selftests: load nf_conntrack if not present
bpf: fix recursive lock when verdict program return SK_PASS
unicode: Fix utf8_load() error path
cppc_cpufreq: Use desired perf if feedback ctrs are 0 or unchanged
RDMA/core: Provide rdma_user_mmap_disassociate() to disassociate mmap pages
RDMA/hns: Disassociate mmap pages for all uctx when HW is being reset
pinctrl: renesas: rzg2l: Fix missing return in rzg2l_pinctrl_register()
clk: mediatek: drop two dead config options
trace/trace_event_perf: remove duplicate samples on the first tracepoint event
pinctrl: zynqmp: drop excess struct member description
pinctrl: renesas: Select PINCTRL_RZG2L for RZ/V2H(P) SoC
clk: qcom: videocc-sm8550: depend on either gcc-sm8550 or gcc-sm8650
iommu/s390: Implement blocking domain
scsi: hisi_sas: Enable all PHYs that are not disabled by user during controller reset
powerpc/vdso: Flag VDSO64 entry points as functions
mfd: tps65010: Use IRQF_NO_AUTOEN flag in request_irq() to fix race
mfd: da9052-spi: Change read-mask to write-mask
mfd: intel_soc_pmic_bxtwc: Use IRQ domain for USB Type-C device
mfd: intel_soc_pmic_bxtwc: Use IRQ domain for TMU device
mfd: intel_soc_pmic_bxtwc: Use IRQ domain for PMIC devices
mfd: intel_soc_pmic_bxtwc: Fix IRQ domain names duplication
cpufreq: loongson2: Unregister platform_driver on failure
powerpc/fadump: Refactor and prepare fadump_cma_init for late init
powerpc/fadump: Move fadump_cma_init to setup_arch() after initmem_init()
mtd: hyperbus: rpc-if: Add missing MODULE_DEVICE_TABLE
mtd: rawnand: atmel: Fix possible memory leak
clk: Allow kunit tests to run without OF_OVERLAY enabled
powerpc/mm/fault: Fix kfence page fault reporting
iommu/tegra241-cmdqv: Staticize cmdqv_debugfs_dir
clk: sophgo: avoid integer overflow in sg2042_pll_recalc_rate()
mtd: spi-nor: spansion: Use nor->addr_nbytes in octal DTR mode in RD_ANY_REG_OP
powerpc/pseries: Fix dtl_access_lock to be a rw_semaphore
cpufreq: CPPC: Fix possible null-ptr-deref for cpufreq_cpu_get_raw()
cpufreq: CPPC: Fix possible null-ptr-deref for cppc_get_cpu_cost()
iommu/amd/pgtbl_v2: Take protection domain lock before invalidating TLB
RDMA/hns: Fix an AEQE overflow error caused by untimely update of eq_db_ci
RDMA/hns: Fix flush cqe error when racing with destroy qp
RDMA/hns: Modify debugfs name
RDMA/hns: Use dev_* printings in hem code instead of ibdev_*
RDMA/hns: Fix cpu stuck caused by printings during reset
RDMA/rxe: Fix the qp flush warnings in req
RDMA/bnxt_re: Check cqe flags to know imm_data vs inv_irkey
clk: sunxi-ng: d1: Fix PLL_AUDIO0 preset
clk: renesas: rzg2l: Fix FOUTPOSTDIV clk
RDMA/rxe: Set queue pair cur_qp_state when being queried
RDMA/mlx5: Call dev_put() after the blocking notifier
RDMA/core: Implement RoCE GID port rescan and export delete function
RDMA/mlx5: Ensure active slave attachment to the bond IB device
RISC-V: KVM: Fix APLIC in_clrip and clripnum write emulation
riscv: kvm: Fix out-of-bounds array access
clk: imx: lpcg-scu: SW workaround for errata (e10858)
clk: imx: fracn-gppll: correct PLL initialization flow
clk: imx: fracn-gppll: fix pll power up
clk: imx: clk-scu: fix clk enable state save and restore
clk: imx: imx8-acm: Fix return value check in clk_imx_acm_attach_pm_domains()
iommu/vt-d: Fix checks and print in dmar_fault_dump_ptes()
iommu/vt-d: Fix checks and print in pgtable_walk()
checkpatch: always parse orig_commit in fixes tag
mfd: rt5033: Fix missing regmap_del_irq_chip()
leds: max5970: Fix unreleased fwnode_handle in probe function
leds: ktd2692: Set missing timing properties
fs/proc/kcore.c: fix coccinelle reported ERROR instances
scsi: target: Fix incorrect function name in pscsi_create_type_disk()
scsi: bfa: Fix use-after-free in bfad_im_module_exit()
scsi: fusion: Remove unused variable 'rc'
scsi: qedf: Fix a possible memory leak in qedf_alloc_and_init_sb()
scsi: qedi: Fix a possible memory leak in qedi_alloc_and_init_sb()
scsi: sg: Enable runtime power management
x86/tdx: Introduce wrappers to read and write TD metadata
x86/tdx: Rename tdx_parse_tdinfo() to tdx_setup()
x86/tdx: Dynamically disable SEPT violations from causing #VEs
powerpc/fadump: allocate memory for additional parameters early
fadump: reserve param area if below boot_mem_top
RDMA/hns: Fix out-of-order issue of requester when setting FENCE
RDMA/hns: Fix NULL pointer derefernce in hns_roce_map_mr_sg()
cpufreq: loongson3: Check for error code from devm_mutex_init() call
cpufreq: CPPC: Fix wrong return value in cppc_get_cpu_cost()
cpufreq: CPPC: Fix wrong return value in cppc_get_cpu_power()
kasan: move checks to do_strncpy_from_user
kunit: skb: use "gfp" variable instead of hardcoding GFP_KERNEL
ocfs2: fix uninitialized value in ocfs2_file_read_iter()
zram: ZRAM_DEF_COMP should depend on ZRAM
iommu/tegra241-cmdqv: Fix alignment failure at max_n_shift
dax: delete a stale directory pmem
KVM: PPC: Book3S HV: Stop using vc->dpdes for nested KVM guests
KVM: PPC: Book3S HV: Avoid returning to nested hypervisor on pending doorbells
powerpc/sstep: make emulate_vsx_load and emulate_vsx_store static
RDMA/hns: Fix different dgids mapping to the same dip_idx
KVM: PPC: Book3S HV: Fix kmv -> kvm typo
powerpc/kexec: Fix return of uninitialized variable
fbdev: sh7760fb: Fix a possible memory leak in sh7760fb_alloc_mem()
RDMA/mlx5: Move events notifier registration to be after device registration
clk: clk-apple-nco: Add NULL check in applnco_probe
clk: ralink: mtmips: fix clock plan for Ralink SoC RT3883
clk: ralink: mtmips: fix clocks probe order in oldest ralink SoCs
clk: en7523: remove REG_PCIE*_{MEM,MEM_MASK} configuration
clk: en7523: move clock_register in hw_init callback
clk: en7523: introduce chip_scu regmap
clk: en7523: fix estimation of fixed rate for EN7581
dt-bindings: clock: axi-clkgen: include AXI clk
clk: clk-axi-clkgen: make sure to enable the AXI bus clock
zram: permit only one post-processing operation at a time
zram: fix NULL pointer in comp_algorithm_show()
RDMA/bnxt_re: Correct the sequence of device suspend
arm64: dts: qcom: sc8180x: Add a SoC-specific compatible to cpufreq-hw
pinctrl: k210: Undef K210_PC_DEFAULT
rtla/timerlat: Do not set params->user_workload with -U
smb: cached directories can be more than root file handle
mailbox: mtk-cmdq: fix wrong use of sizeof in cmdq_get_clocks()
mailbox: arm_mhuv2: clean up loop in get_irq_chan_comb()
x86: fix off-by-one in access_ok()
perf cs-etm: Don't flush when packet_queue fills up
gfs2: Rename GLF_VERIFY_EVICT to GLF_VERIFY_DELETE
gfs2: Allow immediate GLF_VERIFY_DELETE work
gfs2: Fix unlinked inode cleanup
perf mem: Fix printing PERF_MEM_LVLNUM_{L2_MHB|MSC}
dt-bindings: PCI: mediatek-gen3: Allow exact number of clocks only
PCI: Fix reset_method_store() memory leak
perf jevents: Don't stop at the first matched pmu when searching a events table
perf stat: Close cork_fd when create_perf_stat_counter() failed
perf stat: Fix affinity memory leaks on error path
perf trace: Keep exited threads for summary
perf test attr: Add back missing topdown events
rust: rbtree: fix `SAFETY` comments that should be `# Safety` sections
f2fs: compress: fix inconsistent update of i_blocks in release_compress_blocks and reserve_compress_blocks
f2fs: fix null-ptr-deref in f2fs_submit_page_bio()
mailbox, remoteproc: k3-m4+: fix compile testing
f2fs: fix to account dirty data in __get_secs_required()
perf dso: Fix symtab_type for kmod compression
perf disasm: Fix capstone memory leak
perf probe: Fix libdw memory leak
perf probe: Correct demangled symbols in C++ program
rust: kernel: fix THIS_MODULE header path in ThisModule doc comment
rust: macros: fix documentation of the paste! macro
PCI: cpqphp: Fix PCIBIOS_* return value confusion
rust: block: fix formatting of `kernel::block::mq::request` module
perf disasm: Use disasm_line__free() to properly free disasm_line
perf disasm: Fix not cleaning up disasm_line in symbol__disassemble_raw()
virtiofs: use pages instead of pointer for kernel direct IO
perf ftrace latency: Fix unit on histogram first entry when using --use-nsec
i3c: master: Remove i3c_dev_disable_ibi_locked(olddev) on device hotjoin
f2fs: fix the wrong f2fs_bug_on condition in f2fs_do_replace_block
f2fs: check curseg->inited before write_sum_page in change_curseg
f2fs: Fix not used variable 'index'
f2fs: fix to avoid potential deadlock in f2fs_record_stop_reason()
f2fs: fix to avoid use GC_AT when setting gc_mode as GC_URGENT_LOW or GC_URGENT_MID
PCI: qcom: Enable MSI interrupts together with Link up if 'Global IRQ' is supported
PCI: qcom-ep: Move controller cleanups to qcom_pcie_perst_deassert()
PCI: tegra194: Move controller cleanups to pex_ep_event_pex_rst_deassert()
PCI: j721e: Deassert PERST# after a delay of PCIE_T_PVPERL_MS milliseconds
perf build: Add missing cflags when building with custom libtraceevent
f2fs: fix race in concurrent f2fs_stop_gc_thread
f2fs: fix to map blocks correctly for direct write
f2fs: fix to avoid forcing direct write to use buffered IO on inline_data inode
perf trace: avoid garbage when not printing a trace event's arguments
m68k: mcfgpio: Fix incorrect register offset for CONFIG_M5441x
m68k: coldfire/device.c: only build FEC when HW macros are defined
svcrdma: Address an integer overflow
nfsd: drop inode parameter from nfsd4_change_attribute()
perf list: Fix topic and pmu_name argument order
perf trace: Fix tracing itself, creating feedback loops
perf trace: Do not lose last events in a race
perf trace: Avoid garbage when not printing a syscall's arguments
remoteproc: qcom: pas: Remove subdevs on the error path of adsp_probe()
remoteproc: qcom: adsp: Remove subdevs on the error path of adsp_probe()
remoteproc: qcom: pas: add minidump_id to SM8350 resources
rpmsg: glink: use only lower 16-bits of param2 for CMD_OPEN name length
remoteproc: qcom_q6v5_mss: Re-order writes to the IMEM region
PCI: endpoint: epf-mhi: Avoid NULL dereference if DT lacks 'mmio'
NFSD: Prevent NULL dereference in nfsd4_process_cb_update()
NFSD: Cap the number of bytes copied by nfs4_reset_recoverydir()
nfsd: release svc_expkey/svc_export with rcu_work
svcrdma: fix miss destroy percpu_counter in svc_rdma_proc_init()
NFSD: Fix nfsd4_shutdown_copy()
nfs_common: must not hold RCU while calling nfsd_file_put_local
f2fs: fix to do cast in F2FS_{BLK_TO_BYTES, BTYES_TO_BLK} to avoid overflow
perf bpf-filter: Return -ENOMEM directly when pfi allocation fails
hwmon: (tps23861) Fix reporting of negative temperatures
hwmon: (aquacomputer_d5next) Fix length of speed_input array
phy: airoha: Fix REG_CSR_2L_PLL_CMN_RESERVE0 config in airoha_pcie_phy_init_clk_out()
phy: airoha: Fix REG_PCIE_PMA_TX_RESET config in airoha_pcie_phy_init_csr_2l()
phy: airoha: Fix REG_CSR_2L_JCPLL_SDM_HREN config in airoha_pcie_phy_init_ssc_jcpll()
phy: airoha: Fix REG_CSR_2L_RX{0,1}_REV0 definitions
vdpa/mlx5: Fix suboptimal range on iotlb iteration
vfio/mlx5: Fix an unwind issue in mlx5vf_add_migration_pages()
vfio/mlx5: Fix unwind flows in mlx5vf_pci_save/resume_device_data()
selftests/mount_setattr: Fix failures on 64K PAGE_SIZE kernels
gpio: zevio: Add missed label initialisation
vfio/pci: Properly hide first-in-list PCIe extended capability
fs_parser: update mount_api doc to match function signature
LoongArch: Fix build failure with GCC 15 (-std=gnu23)
LoongArch: BPF: Sign-extend return values
power: supply: core: Remove might_sleep() from power_supply_put()
power: supply: bq27xxx: Fix registers of bq27426
power: supply: rt9471: Fix wrong WDT function regfield declaration
power: supply: rt9471: Use IC status regfield to report real charger status
fs/ntfs3: Equivalent transition from page to folio
power: reset: ep93xx: add AUXILIARY_BUS dependency
net: usb: lan78xx: Fix double free issue with interrupt buffer allocation
net: usb: lan78xx: Fix memory leak on device unplug by freeing PHY device
tg3: Set coherent DMA mask bits to 31 for BCM57766 chipsets
net: usb: lan78xx: Fix refcounting and autosuspend on invalid WoL configuration
net: microchip: vcap: Add typegroup table terminators in kunit tests
netlink: fix false positive warning in extack during dumps
exfat: fix file being changed by unaligned direct write
net/l2tp: fix warning in l2tp_exit_net found by syzbot
s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct()
rtase: Refactor the rtase_check_mac_version_valid() function
rtase: Correct the speed for RTL907XD-V1
rtase: Corrects error handling of the rtase_check_mac_version_valid()
net/ipv6: delete temporary address if mngtmpaddr is removed or unmanaged
net: mdio-ipq4019: add missing error check
marvell: pxa168_eth: fix call balance of pep->clk handling routines
net: stmmac: dwmac-socfpga: Set RX watchdog interrupt as broken
octeontx2-af: RPM: Fix mismatch in lmac type
octeontx2-af: RPM: Fix low network performance
octeontx2-af: RPM: fix stale RSFEC counters
octeontx2-af: RPM: fix stale FCFEC counters
octeontx2-af: Quiesce traffic before NIX block reset
spi: atmel-quadspi: Fix register name in verbose logging function
net: hsr: fix hsr_init_sk() vs network/transport headers.
bnxt_en: Reserve rings after PCIe AER recovery if NIC interface is down
bnxt_en: Set backplane link modes correctly for ethtool
bnxt_en: Fix queue start to update vnic RSS table
bnxt_en: Fix receive ring space parameters when XDP is active
bnxt_en: Refactor bnxt_ptp_init()
bnxt_en: Unregister PTP during PCI shutdown and suspend
Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync
Bluetooth: MGMT: Fix possible deadlocks
llc: Improve setsockopt() handling of malformed user input
rxrpc: Improve setsockopt() handling of malformed user input
tcp: Fix use-after-free of nreq in reqsk_timer_handler().
ip6mr: fix tables suspicious RCU usage
ipmr: fix tables suspicious RCU usage
iio: light: al3010: Fix an error handling path in al3010_probe()
usb: using mutex lock and supporting O_NONBLOCK flag in iowarrior_read()
usb: yurex: make waiting on yurex_write interruptible
USB: chaoskey: fail open after removal
USB: chaoskey: Fix possible deadlock chaoskey_list_lock
misc: apds990x: Fix missing pm_runtime_disable()
devres: Fix page faults when tracing devres from unloaded modules
usb: gadget: uvc: wake pump everytime we update the free list
interconnect: qcom: icc-rpmh: probe defer incase of missing QoS clock dependency
iio: backend: fix wrong pointer passed to IS_ERR()
iio: adc: ad4000: fix reading unsigned data
iio: adc: ad4000: Check for error code from devm_mutex_init() call
iio: adc: pac1921: Check for error code from devm_mutex_init() call
iio: accel: adxl380: fix raw sample read
phy: realtek: usb: fix NULL deref in rtk_usb2phy_probe
phy: realtek: usb: fix NULL deref in rtk_usb3phy_probe
counter: stm32-timer-cnt: Add check for clk_enable()
counter: ti-ecap-capture: Add check for clk_enable()
bus: mhi: host: Switch trace_mhi_gen_tre fields to native endian
usb: typec: fix potential array underflow in ucsi_ccg_sync_control()
firmware_loader: Fix possible resource leak in fw_log_firmware_info()
ALSA: hda/realtek: Update ALC256 depop procedure
drm/radeon: Fix spurious unplug event on radeon HDMI
drm/amd/display: Fix null check for pipe_ctx->plane_state in dcn20_program_pipe
drm/amd/display: Fix null check for pipe_ctx->plane_state in hwss_setup_dpp
ASoC: imx-audmix: Add NULL check in imx_audmix_probe
drm/xe/ufence: Wake up waiters after setting ufence->signalled
apparmor: fix 'Do simple duplicate message elimination'
ALSA: core: Fix possible NULL dereference caused by kunit_kzalloc()
ASoC: amd: yc: Fix for enabling DMIC on acp6x via _DSD entry
ASoC: mediatek: Check num_codecs is not zero to avoid panic during probe
s390/pci: Fix potential double remove of hotplug slot
f2fs: fix fiemap failure issue when page size is 16KB
net_sched: sch_fq: don't follow the fast path if Tx is behind now
xen: Fix the issue of resource not being properly released in xenbus_dev_probe()
ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices
ALSA: usb-audio: Fix out of bounds reads when finding clock sources
usb: ehci-spear: fix call balance of sehci clk handling routines
usb: typec: ucsi: glink: fix off-by-one in connector_status
xfs: fix simplify extent lookup in xfs_can_free_eofblocks
ext4: supress data-race warnings in ext4_free_inodes_{count,set}()
ext4: fix FS_IOC_GETFSMAP handling
MAINTAINERS: update location of media main tree
docs: media: update location of the media patches
jfs: xattr: check invalid xattr size more strictly
ASoC: amd: yc: Add a quirk for microfone on Lenovo ThinkPad P14s Gen 5 21MES00B00
ASoC: codecs: Fix atomicity violation in snd_soc_component_get_drvdata()
ASoC: da7213: Populate max_register to regmap_config
perf/x86/intel/pt: Fix buffer full but size is 0 case
crypto: x86/aegis128 - access 32-bit arguments as 32-bit
KVM: x86: switch hugepage recovery thread to vhost_task
KVM: x86/mmu: Skip the "try unsync" path iff the old SPTE was a leaf SPTE
KVM: x86: add back X86_LOCAL_APIC dependency
KVM: x86: Break CONFIG_KVM_X86's direct dependency on KVM_INTEL || KVM_AMD
powerpc/pseries: Fix KVM guest detection for disabling hardlockup detector
KVM: arm64: vgic-v3: Sanitise guest writes to GICR_INVLPIR
KVM: arm64: Ignore PMCNTENSET_EL0 while checking for overflow status
Revert "KVM: VMX: Move LOAD_IA32_PERF_GLOBAL_CTRL errata handling out of setup_vmcs_config()"
KVM: arm64: Don't retire aborted MMIO instruction
KVM: arm64: vgic-its: Clear ITE when DISCARD frees an ITE
KVM: arm64: Get rid of userspace_irqchip_in_use
KVM: arm64: vgic-its: Add a data length check in vgic_its_save_*
KVM: arm64: vgic-its: Clear DTE when MAPD unmaps a device
Compiler Attributes: disable __counted_by for clang < 19.1.3
PCI: Fix use-after-free of slot->bus on hot remove
LoongArch: Explicitly specify code model in Makefile
clk: clk-loongson2: Fix memory corruption bug in struct loongson2_clk_provider
clk: clk-loongson2: Fix potential buffer overflow in flexible-array member access
fsnotify: fix sending inotify event with unexpected filename
fsnotify: Fix ordering of iput() and watched_objects decrement
comedi: Flush partial mappings in error case
apparmor: test: Fix memory leak for aa_unpack_strdup()
iio: dac: adi-axi-dac: fix wrong register bitfield
tty: ldsic: fix tty_ldisc_autoload sysctl's proc_handler
locking/lockdep: Avoid creating new name string literals in lockdep_set_subclass()
tools/nolibc: s390: include std.h
fcntl: make F_DUPFD_QUERY associative
pinctrl: qcom: spmi: fix debugfs drive strength
dt-bindings: pinctrl: samsung: Fix interrupt constraint for variants with fallbacks
dt-bindings: iio: dac: ad3552r: fix maximum spi speed
exfat: fix uninit-value in __exfat_get_dentry_set
exfat: fix out-of-bounds access of directory entries
xhci: Fix control transfer error on Etron xHCI host
xhci: Combine two if statements for Etron xHCI host
xhci: Don't perform Soft Retry for Etron xHCI host
xhci: Don't issue Reset Device command to Etron xHCI host
Bluetooth: Fix type of len in rfcomm_sock_getsockopt{,_old}()
usb: xhci: Limit Stop Endpoint retries
usb: xhci: Fix TD invalidation under pending Set TR Dequeue
usb: xhci: Avoid queuing redundant Stop Endpoint commands
ARM: dts: omap36xx: declare 1GHz OPP as turbo again
wifi: ath12k: fix warning when unbinding
wifi: rtlwifi: Drastically reduce the attempts to read efuse in case of failures
wifi: nl80211: fix bounds checker error in nl80211_parse_sched_scan
wifi: ath12k: fix crash when unbinding
wifi: brcmfmac: release 'root' node in all execution paths
Revert "fs: don't block i_writecount during exec"
Revert "f2fs: remove unreachable lazytime mount option parsing"
Revert "usb: gadget: composite: fix OS descriptors w_value logic"
serial: sh-sci: Clean sci_ports[0] after at earlycon exit
Revert "serial: sh-sci: Clean sci_ports[0] after at earlycon exit"
io_uring: fix corner case forgetting to vunmap
io_uring: check for overflows in io_pin_pages
blk-settings: round down io_opt to physical_block_size
gpio: exar: set value when external pull-up or pull-down is present
netfilter: ipset: add missing range check in bitmap_ip_uadt
spi: Fix acpi deferred irq probe
mtd: spi-nor: core: replace dummy buswidth from addr to data
cpufreq: mediatek-hw: Fix wrong return value in mtk_cpufreq_get_cpu_power()
cifs: support mounting with alternate password to allow password rotation
parisc/ftrace: Fix function graph tracing disablement
RISC-V: Scalar unaligned access emulated on hotplug CPUs
RISC-V: Check scalar unaligned access on all CPUs
ksmbd: fix use-after-free in SMB request handling
smb: client: fix NULL ptr deref in crypto_aead_setkey()
platform/chrome: cros_ec_typec: fix missing fwnode reference decrement
irqchip/irq-mvebu-sei: Move misplaced select() callback to SEI CP domain
x86/CPU/AMD: Terminate the erratum_1386_microcode array
ubi: wl: Put source PEB into correct list if trying locking LEB failed
um: ubd: Do not use drvdata in release
um: net: Do not use drvdata in release
dt-bindings: serial: rs485: Fix rs485-rts-delay property
serial: 8250_fintek: Add support for F81216E
serial: 8250: omap: Move pm_runtime_get_sync
serial: amba-pl011: Fix RX stall when DMA is used
serial: amba-pl011: fix build regression
Revert "block, bfq: merge bfq_release_process_ref() into bfq_put_cooperator()"
mtd: ubi: fix unreleased fwnode_handle in find_volume_fwnode()
block: Prevent potential deadlock in blk_revalidate_disk_zones()
um: vector: Do not use drvdata in release
sh: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK
iio: gts: Fix uninitialized symbol 'ret'
ublk: fix ublk_ch_mmap() for 64K page size
arm64: tls: Fix context-switching of tpidrro_el0 when kpti is enabled
block: fix missing dispatching request when queue is started or unquiesced
block: fix ordering between checking QUEUE_FLAG_QUIESCED request adding
block: fix ordering between checking BLK_MQ_S_STOPPED request adding
blk-mq: Make blk_mq_quiesce_tagset() hold the tag list mutex less long
gve: Flow steering trigger reset only for timeout error
HID: wacom: Interpret tilt data from Intuos Pro BT as signed values
i40e: Fix handling changed priv flags
media: wl128x: Fix atomicity violation in fmc_send_cmd()
media: intel/ipu6: do not handle interrupts when device is disabled
arm64: dts: mediatek: mt8186-corsola-voltorb: Merge speaker codec nodes
netdev-genl: Hold rcu_read_lock in napi_get
soc: fsl: cpm1: qmc: Set the ret error code on platform_get_irq() failure
soc: fsl: rcpm: fix missing of_node_put() in copy_ippdexpcr1_setting()
media: v4l2-core: v4l2-dv-timings: check cvt/gtf result
x86/mm: Carve out INVLPG inline asm for use by others
x86/microcode/AMD: Flush patch buffer mapping after application
ALSA: rawmidi: Fix kvfree() call in spinlock
ALSA: ump: Fix evaluation of MIDI 1.0 FB info
ALSA: pcm: Add sanity NULL check for the default mmap fault handler
ALSA: hda/realtek: Update ALC225 depop procedure
ALSA: hda/realtek: Enable speaker pins for Medion E15443 platform
ALSA: hda/realtek: Set PCBeep to default value for ALC274
ALSA: hda/realtek: Fix Internal Speaker and Mic boost of Infinix Y4 Max
ALSA: hda/realtek: fix mute/micmute LEDs don't work for EliteBook X G1i
ALSA: hda/realtek: Apply quirk for Medion E15433
fs/smb/client: implement chmod() for SMB3 POSIX Extensions
smb: client: fix use-after-free of signing key
smb3: request handle caching when caching directories
smb: client: handle max length for SMB symlinks
smb: Don't leak cfid when reconnect races with open_cached_dir
smb: prevent use-after-free due to open_cached_dir error paths
smb: During unmount, ensure all cached dir instances drop their dentry
usb: misc: ljca: set small runtime autosuspend delay
usb: misc: ljca: move usb_autopm_put_interface() after wait for response
usb: dwc3: ep0: Don't clear ep0 DWC3_EP_TRANSFER_STARTED
usb: musb: Fix hardware lockup on first Rx endpoint request
usb: dwc3: gadget: Add missing check for single port RAM in TxFIFO resizing logic
usb: dwc3: gadget: Fix checking for number of TRBs left
usb: dwc3: gadget: Fix looping of queued SG entries
staging: vchiq_arm: Fix missing refcount decrement in error path for fw_node
counter: stm32-timer-cnt: fix device_node handling in probe_encoder()
ublk: fix error code for unsupported command
lib: string_helpers: silence snprintf() output truncation warning
f2fs: fix to do sanity check on node blkaddr in truncate_node()
ipc: fix memleak if msg_init_ns failed in create_ipc_ns
Input: cs40l50 - fix wrong usage of INIT_WORK()
NFSD: Prevent a potential integer overflow
SUNRPC: make sure cache entry active before cache_show
um: Fix potential integer overflow during physmem setup
um: Fix the return value of elf_core_copy_task_fpregs
kfifo: don't include dma-mapping.h in kfifo.h
um: ubd: Initialize ubd's disk pointer in ubd_add
um: Always dump trace for specified task in show_stack
NFSv4.0: Fix a use-after-free problem in the asynchronous open()
nfs/localio: must clear res.replen in nfs_local_read_done
rtc: st-lpc: Use IRQF_NO_AUTOEN flag in request_irq()
rtc: abx80x: Fix WDT bit position of the status register
rtc: check if __rtc_read_time was successful in rtc_timer_do_work()
ubi: fastmap: wl: Schedule fm_work if wear-leveling pool is empty
ubifs: Correct the total block count by deducting journal reservation
ubi: fastmap: Fix duplicate slab cache names while attaching
ubifs: authentication: Fix use-after-free in ubifs_tnc_end_commit
jffs2: fix use of uninitialized variable
hostfs: Fix the NULL vs IS_ERR() bug for __filemap_get_folio()
net/9p/usbg: fix handling of the failed kzalloc() memory allocation
rtc: rzn1: fix BCD to rtc_time conversion errors
Revert "nfs: don't reuse partially completed requests in nfs_lock_and_join_requests"
nvme/multipath: Fix RCU list traversal to use SRCU primitive
blk-mq: add non_owner variant of start_freeze/unfreeze queue APIs
block: model freeze & enter queue as lock for supporting lockdep
block: fix uaf for flush rq while iterating tags
block: return unsigned int from bdev_io_min
nvme-fabrics: fix kernel crash while shutting down controller
9p/xen: fix init sequence
9p/xen: fix release of IRQ
perf/arm-smmuv3: Fix lockdep assert in ->event_init()
perf/arm-cmn: Ensure port and device id bits are set properly
smb: client: disable directory caching when dir_cache_timeout is zero
x86/Documentation: Update algo in init_size description of boot protocol
cifs: Fix parsing native symlinks relative to the export
cifs: Fix parsing reparse point with native symlink in SMB1 non-UNICODE session
rtc: ab-eoz9: don't fail temperature reads on undervoltage notification
Rename .data.unlikely to .data..unlikely
Rename .data.once to .data..once to fix resetting WARN*_ONCE
kbuild: deb-pkg: Don't fail if modules.order is missing
smb: Initialize cfid->tcon before performing network ops
block: Don't allow an atomic write be truncated in blkdev_write_iter()
modpost: remove incorrect code in do_eisa_entry()
cifs: during remount, make sure passwords are in sync
cifs: unlock on error in smb3_reconfigure()
nfs: ignore SB_RDONLY when mounting nfs
sunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport
SUNRPC: timeout and cancel TLS handshake with -ETIMEDOUT
sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket
nfs/blocklayout: Don't attempt unregister for invalid block device
nfs/blocklayout: Limit repeat device registration on failure
block, bfq: fix bfqq uaf in bfq_limit_depth()
brd: decrease the number of allocated pages which discarded
sh: intc: Fix use-after-free bug in register_intc_controller()
tools/power turbostat: Fix trailing '\n' parsing
tools/power turbostat: Fix child's argument forwarding
block: always verify unfreeze lock on the owner task
block: don't verify IO lock for freeze/unfreeze in elevator_init_mq()
Linux 6.12.2
Change-Id: Ifebddb35b5a6a6ff2a65eb795a912633639aca9a
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Greg Kroah-Hartman
Pablo Neira Ayuso
Florian Westphal
Fernando Fernandez Mancera
Zhongqiu Duan
Nicolas Bouchinet
Jozsef Kadlecsik
Julian Anastasov
Lin Ma
Alexey Kashavkin
Dan Carpenter
Kohei Enju
Nicklas Bo Jensen
Sebastian Andrzej Siewior
Phil Sutter
David Laight
Dmitry Antipov
Jinghao Jia