[PATCH 6.12 000/220] 6.12.105-rc1 review

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

This is the start of the stable review cycle for the 6.12.105 release.
There are 220 patches in this series, all will be posted as a response
to this one.  If anyone has any issues with these being applied, please
let me know.

Responses should be made by Sat, 22 Aug 2026 14:51:11 +0000.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
	https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.105-rc1.gz
or in the git tree and branch at:
	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Linux 6.12.105-rc1

Eric Dumazet <edumazet@google.com>
    ip_tunnel: adapt iptunnel_xmit_stats() to NETDEV_PCPU_STAT_DSTATS

Paolo Abeni <pabeni@redhat.com>
    net: harmonize tstats and dstats

Christian Brauner <brauner@kernel.org>
    binfmt_misc: use exe_file_deny_write_access() for the interpreter clone

Darrick J. Wong <djwong@kernel.org>
    fs: unlock the superblock during iterate_supers_type

Aditya Chillara <aditya.chillara@oss.qualcomm.com>
    perf/core: Fix group leader use-after-free after sibling detach

Peter Zijlstra <peterz@infradead.org>
    perf: Unify perf_event_free_task() / perf_event_exit_task_context()

Gao Xiang <xiang@kernel.org>
    erofs: fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms

Linmao Li <lilinmao@kylinos.cn>
    drm/xe/oa: Fix sync entry leak on OA config emit failure

Jamal Hadi Salim <jhs@mojatatu.com>
    net/sched: cls_bpf: reject dev-bound programs bound to a different device

Siddharth Vadapalli <s-vadapalli@ti.com>
    net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG

Uwe Kleine-König <ukleinek@kernel.org>
    m68k: Define NR_CPUS to 1

Zhang Changzhong <zhangchangzhong@huawei.com>
    net/sched: cls_u32: skip hash tables in u32_bind_class()

Jamal Hadi Salim <jhs@mojatatu.com>
    net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain

Eric Dumazet <edumazet@google.com>
    af_packet: Don't send zero-byte data in tpacket_snd().

Rosen Penev <rosenp@gmail.com>
    ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers

Chuck Lever <chuck.lever@oracle.com>
    net/tls: Fail tls_sw_splice_read() after a failed async decrypt

Wei Fang <wei.fang@nxp.com>
    net: packet: fix wrong transport_header when sending VLAN-tagged frame

Jiayuan Chen <jiayuan.chen@linux.dev>
    tcp: fix icsk_ack.ato bitfield overflow

Jonas Köppeler <j.koeppeler@tu-berlin.de>
    veth: fix queue index used to wake the peer txq in veth_poll

Eric Dumazet <edumazet@google.com>
    macvlan: inherit needed_headroom and needed_tailroom from lowerdev

Eric Dumazet <edumazet@google.com>
    ipvlan: inherit needed_headroom and needed_tailroom from phy_dev

Florian Westphal <fw@strlen.de>
    netfilter: ipset: let destroy callbacks adjust ext mem size

Florian Westphal <fw@strlen.de>
    netfilter: ipset: fix list type element drift bug

Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
    netfilter: flowtable: publish GC-visible tuple last

Alexey Velichayshiy <a.velichayshiy@ispras.ru>
    netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path

Xiang Mei (Microsoft) <xmei5@asu.edu>
    netfilter: ipset: fix refcount race between list:set GC and swap

Vladislav Dronov <vdronov@redhat.com>
    crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req()

Herbert Xu <herbert@gondor.apana.org.au>
    crypto: ccm - Set rfc4309 maxauthsize from child

Jon Hunter <jonathanh@nvidia.com>
    arm64: tegra: Add EL2 virtual timer interrupt for Tegra194

Baul Lee <baul.lee@xbow.com>
    net/x25: fix use-after-free of the socket by its timers

Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
    ASoC: SOF: ipc4-topology: Refresh copier IPC payload before widget setup

Eric Dumazet <edumazet@google.com>
    ipv4: start using dst_dev_rcu()

Breno Leitao <leitao@debian.org>
    x86/mce: Set up the polling timer before CMCI discovery

Yazen Ghannam <yazen.ghannam@amd.com>
    x86/mce: Set CR4.MCE last during init

Yazen Ghannam <yazen.ghannam@amd.com>
    x86/mce: Remove __mcheck_cpu_init_early()

Vincent Donnefort <vdonnefort@google.com>
    ring-buffer: Prevent resizing of persistent ring buffer

Steven Rostedt <rostedt@goodmis.org>
    ring-buffer: Make ring_buffer_{un}map() simpler with guard(mutex)

Steven Rostedt <rostedt@goodmis.org>
    ring-buffer: Simplify ring_buffer_read_page() with guard()

Paolo Bonzini <pbonzini@redhat.com>
    KVM: SVM: Serialize accesses to the owner and mirror list with separate lock

Lorenzo Stoakes (ARM) <ljs@kernel.org>
    mm/ptdump: always stabilise against page table freeing using init_mm

Lorenzo Stoakes (ARM) <ljs@kernel.org>
    mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF

Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
    mm/pagewalk: split walk_page_range_novma() into kernel/user parts

Vincent Donnefort <vdonnefort@google.com>
    ring-buffer: Initialise reader page order in rb_allocate_cpu_buffer()

Steven Rostedt <rostedt@goodmis.org>
    ring-buffer: Simplify functions with __free(kfree) to free allocations

Zack Rusin <zack.rusin@broadcom.com>
    drm/vmwgfx: take fman->lock around fence list mutation in fifo_down

Dongli Zhang <dongli.zhang@oracle.com>
    net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp()

Yang Wang <kevinyang.wang@amd.com>
    drm/amd/pm: fix pptable use-after-free

Yang Wang <kevinyang.wang@amd.com>
    drm/amd/pm: adjust the visibility of pp_table sysfs node

Pierre-Eric Pelloux-Prayer <pierre-eric.pelloux-prayer@amd.com>
    drm/amdgpu: move debug_vm handling to amdgpu_cs_parser_fini

Yunxiang Li <Yunxiang.Li@amd.com>
    drm/amdgpu: remove unused function parameter

Yang Wang <kevinyang.wang@amd.com>
    drm/amd/pm: fix torn gpu metrics reads

Lijo Lazar <lijo.lazar@amd.com>
    drm/amd/pm: Use macro to initialize metrics table

Asad Kamal <asad.kamal@amd.com>
    drm/amd/pm: Use same metric table for APU

Tu Nguyen <tu.nguyen.xg@renesas.com>
    can: rcar_canfd: change the initializing flow for clocks and resets

Frank Sorenson <sorenson@redhat.com>
    cifs: add fscache_resize_cookie() to cifs_setsize()

Paulo Alcantara <pc@manguebit.org>
    smb: client: fix race with fallocate(2) and AIO+DIO

Max Kellermann <max.kellermann@ionos.com>
    include/linux/fs.h: add inode_lock_killable()

Dawid Osuchowski <dawid.osuchowski@linux.intel.com>
    ice: fix VF interrupts cleanup

Eric Dumazet <edumazet@google.com>
    vxlan: use pskb_network_may_pull() for transmit path header pulls

Guillaume Nault <gnault@redhat.com>
    vxlan: Handle stats using NETDEV_PCPU_STAT_DSTATS.

Guillaume Nault <gnault@redhat.com>
    vrf: Make pcpu_dstats update functions available to other modules.

Christian Brauner <brauner@kernel.org>
    binfmt_misc: restore write access when removing an entry

Amir Goldstein <amir73il@gmail.com>
    fs: don't block write during exec on pre-content watched files

Amir Goldstein <amir73il@gmail.com>
    fsnotify: opt-in for permission events at file open time

Song Liu <song@kernel.org>
    fsnotify, lsm: Decouple fsnotify from lsm

Christian Brauner <brauner@kernel.org>
    binfmt_misc: don't leak the user namespace when the mount fails

Chengfeng Ye <nicoyip.dev@gmail.com>
    net: pktgen: fix proc entry use-after-free

Peter Seiderer <ps.report@gmx.net>
    net: pktgen: fix code style (WARNING: Block comments)

Namjae Jeon <linkinjeon@kernel.org>
    ksmbd: reject repeated SMB2 NEGOTIATE requests

Namjae Jeon <linkinjeon@kernel.org>
    ksmbd: conn lock to serialize smb2 negotiate

David Carlier <devnexen@gmail.com>
    igc: remove napi_synchronize() in igc_down()

Damien Le Moal <dlemoal@kernel.org>
    ata: libata-scsi: terminate deferred commands on time out

Mark Brown <broonie@kernel.org>
    ASoC: tas2562: Validate values for volume writes

Weiming Shi <bestswngs@gmail.com>
    KVM: x86: Cancel delayed I/O APIC EOI handling before destroying vCPUs

Guanghui Yang <3497809730@qq.com>
    btrfs: zoned: fix missing chunk metadata reservation

Filipe Manana <fdmanana@suse.com>
    btrfs: remove fs_info argument from btrfs_zoned_activate_one_bg()

Naohiro Aota <naohiro.aota@wdc.com>
    btrfs: add space_info argument to btrfs_chunk_alloc()

David Sterba <dsterba@suse.com>
    btrfs: add debug build only WARN

Peiyang He <peiyang_he@smail.nju.edu.cn>
    iommufd: Fix wrong hwpt passed to iommufd_auto_response_faults on replace

Yuxiang Yang <yangyx22@mails.tsinghua.edu.cn>
    tcp: challenge ACK for non-exact RST in SYN-RECEIVED

Chia-Yu Chang <chia-yu.chang@nokia-bell-labs.com>
    tcp: reorganize tcp_sock_write_txrx group for variables later

Ilpo Järvinen <ij@kernel.org>
    tcp: fast path functions later

Ilpo Järvinen <ij@kernel.org>
    tcp: Pass flags to __tcp_send_ack

Guidong Han <2045gemini@gmail.com>
    eventpoll: pin files while checking reverse paths

Namjae Jeon <linkinjeon@kernel.org>
    ksmbd: validate minimum PDU size for transform requests

ChenXiaoSong <chenxiaosong@kylinos.cn>
    smb/server: fix minimum SMB2 PDU size

ChenXiaoSong <chenxiaosong@kylinos.cn>
    smb/server: fix minimum SMB1 PDU size

Namjae Jeon <linkinjeon@kernel.org>
    ksmbd: rename smb2_get_msg to smb_get_msg

ChenXiaoSong <chenxiaosong@kylinos.cn>
    smb/server: rename include guard in smb_common.h

ZhangGuoDong <zhangguodong@kylinos.cn>
    smb: move get_rfc1002_len() to common/smbglob.h

ZhangGuoDong <zhangguodong@kylinos.cn>
    smb: move smb_version_values to common/smbglob.h

Christian Brauner <brauner@kernel.org>
    super: fix emergency thaw deadlock on frozen block devices

Chen Changcheng <chenchangcheng@kylinos.cn>
    fs/super: fix emergency thaw double-unlock of s_umount

Christian Brauner <brauner@kernel.org>
    super: use common iterator (Part 2)

Christian Brauner <brauner@kernel.org>
    super: use a common iterator (Part 1)

Christian Brauner <brauner@kernel.org>
    super: skip dying superblocks early

Christian Brauner <brauner@kernel.org>
    super: remove pointless s_root checks

Aldo Ariel Panzardo <qwe.aldo@gmail.com>
    net/sched: serialize qdisc_rtab_list against concurrent get/put

Pavitra Jha <jhapavitra98@gmail.com>
    libceph: fix two unsafe bare decodes in decode_lockers()

Mike Rapoport (Microsoft) <rppt@kernel.org>
    userfaultfd: prevent registration of special VMAs

Lance Yang <lance.yang@linux.dev>
    mm/khugepaged: guard is_zero_pfn() calls with pte_present()

Xiang Mei <xmei5@asu.edu>
    libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE

Andy Shevchenko <andriy.shevchenko@linux.intel.com>
    libceph: Amend checking to fix `make W=1` build breakage

Max Kellermann <max.kellermann@ionos.com>
    ceph: fix hanging __ceph_get_caps() with stale mds_wanted

Max Kellermann <max.kellermann@ionos.com>
    ceph: avoid fs reclaim while using current->journal_info

Wentao Liang <vulab@iscas.ac.cn>
    ceph: fix writeback_count leak in write_folio_nounlock()

Matthew Wilcox (Oracle) <willy@infradead.org>
    ceph: Convert writepage_nounlock() to write_folio_nounlock()

Matthew Wilcox (Oracle) <willy@infradead.org>
    ceph: Convert ceph_find_incompatible() to take a folio

Matthew Wilcox (Oracle) <willy@infradead.org>
    ceph: Use a folio in ceph_page_mkwrite()

Matthew Wilcox (Oracle) <willy@infradead.org>
    ceph: Remove ceph_writepage()

Christoph Hellwig <hch@lst.de>
    xfs: check v5 superblock features early

Darrick J. Wong <djwong@kernel.org>
    xfs: check xfarray iteration errors when committing unlinked inode lists

Long Li <leo.lilong@huawei.com>
    xfs: don't swallow dquot recovery verification errors

Lin Jiapeng <ljp1205831794@gmail.com>
    xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN

Darrick J. Wong <djwong@kernel.org>
    xfs: avoid UAF on sc->tempip in xrep_tempfile_create

Darrick J. Wong <djwong@kernel.org>
    xfs: don't return EFSCORRUPTED when scrubbing corrupt parent pointers

Darrick J. Wong <djwong@kernel.org>
    xfs: fix another iunlink infinite loop bug in online fsck

Darrick J. Wong <djwong@kernel.org>
    xfs: fix allocated inodes that show up in the unlinked list

Darrick J. Wong <djwong@kernel.org>
    xfs: don't walk off the end of a null sc->sa.agi_bp in AGI repair

Darrick J. Wong <djwong@kernel.org>
    xfs: don't zap the attr fork on repair when there are queued pptr updates

Long Li <leo.lilong@huawei.com>
    xfs: fix ilock leak on error in xfs_dq_get_next_id

Darrick J. Wong <djwong@kernel.org>
    xfs: load next_agino from the correct xfarray in xrep_iunlink_relink_prev

Darrick J. Wong <djwong@kernel.org>
    xfs: nlink scrub must take IOLOCK before determining ILOCK state

Darrick J. Wong <djwong@kernel.org>
    xfs: pass runtime errors from xrep_iunlink_mark_ondisk_rec up to callers

Darrick J. Wong <djwong@kernel.org>
    xfs: set the prev pointer when reinserting an inode on the unlinked list

Darrick J. Wong <djwong@kernel.org>
    xfs: don't double-lock when deleting a self-referential directory

Darrick J. Wong <djwong@kernel.org>
    xfs: only check mergeability of bnobt records

Darrick J. Wong <djwong@kernel.org>
    xfs: zero i_nlink before repair puts inode on unlinked list

Qiang Ma <maqianga@uniontech.com>
    xfs: clear zapped attr fork state when bmap repair finds no attr fork

Junrui Luo <moonafterrain@outlook.com>
    drm/amdgpu: disallow multiple FENCE chunks in one submit

David Rosca <david.rosca@amd.com>
    drm/amdgpu: Fix UVD decode image min size calculation

David Rosca <david.rosca@amd.com>
    drm/amdgpu: Fix UVD dpb min size calculation for H264

David Rosca <david.rosca@amd.com>
    drm/amdgpu: Fix UVD min buffer sizes

David Rosca <david.rosca@amd.com>
    drm/amdgpu: Implement insert_end for VCE 3

David Rosca <david.rosca@amd.com>
    drm/amdgpu: Reject UVD message with dimensions above 4096

Candice Li <candice.li@amd.com>
    drm/amdgpu: validate GEM_CREATE domain combinations

Yang Wang <kevinyang.wang@amd.com>
    drm/amdgpu: check ASPM on the dGPU host link

Yang Wang <kevinyang.wang@amd.com>
    drm/amdgpu: fix nbif 6.3.1 l1 low power not functional

David Rosca <david.rosca@amd.com>
    drm/amdgpu: Reject UVD message with invalid number of h265 refs

Nathan Lucas <nlucasgit@gmail.com>
    drm/amd/display: fix BT.2020 YCbCr output CSC matrices for DCE

Nathan Lucas <nlucasgit@gmail.com>
    drm/amd/display: fix BT.2020 YCbCr limited output CSC matrix

Eric Farman <farman@linux.ibm.com>
    s390/vfio_ccw: Implement a crw lock

Eric Farman <farman@linux.ibm.com>
    s390/vfio_ccw: Calculate idal length based on idaw type

Eric Farman <farman@linux.ibm.com>
    s390/vfio_ccw: Selectively expand io_mutex

Eric Farman <farman@linux.ibm.com>
    s390/vfio_ccw: Move cp cleanup out of not operational

Eric Farman <farman@linux.ibm.com>
    s390/vfio_ccw: Fix out of bounds check on CCW array

Eric Farman <farman@linux.ibm.com>
    s390/vfio_ccw: Ensure first IDAW remains constant

Eric Farman <farman@linux.ibm.com>
    s390/vfio_ccw: Ensure index for read/write regions are within range

Eric Farman <farman@linux.ibm.com>
    s390/vfio_ccw: Cancel existing workqueues

Eric Farman <farman@linux.ibm.com>
    s390/vfio_ccw: Limit the number of channel program segments

Eric Farman <farman@linux.ibm.com>
    s390/vfio_ccw: Free all memory if cp_init() fails

Guangshuo Li <lgs201920130244@gmail.com>
    drm/radeon: fix autosuspend cleanup during teardown

Matthew Brost <matthew.brost@intel.com>
    drm/xe: Order ring writes before ring tail updates

John Harrison <John.Harrison@Igalia.com>
    drm/connector/hdmi: Fix out of bounds memory read

Pei Xiao <xiaopei01@kylinos.cn>
    mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition

Haibo Chen <haibo.chen@nxp.com>
    mmc: sdhci: make tuning_err a signed int

Myeonghun Pak <mhun512@gmail.com>
    mmc: sdhci: unmap the bounce buffer before device release

Zhan Xusheng <zhanxusheng1024@gmail.com>
    mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit

Kefu Chai <k.chai@proxmox.com>
    libceph: tolerate addrvecs with multiple entries of the same type

Yiming Zhu <zhuyiming@kuaishou.com>
    ceph: fix MDS random selection readiness predicate

Raphael Zimmer <raphael.zimmer@tu-ilmenau.de>
    libceph: Avoid using invalid osd indices from primary_temp

Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Input: sur40 - fix V4L error path cleanup

Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Input: sur40 - fix input device registration ordering

Ali Ahmet Memis <ali@iusegentoo.com>
    openrisc: signal: do not restore privileged SR bits on sigreturn

Josh Poimboeuf <jpoimboe@kernel.org>
    ftrace: Fix off-by-one fentry site disable in ftrace_free_mem()

Leon Hwang <leon.hwang@linux.dev>
    ftrace: Protect direct_functions in ftrace_find_rec_direct

Pavitra Jha <jhapavitra98@gmail.com>
    libceph: fix multiple unsafe decodes in decode_locker()

Praveen Talari <praveen.talari@oss.qualcomm.com>
    pmdomain: arm: Fix -EINVAL from scmi_pd_set_perf_state() on state 0

Cengiz Can <cengiz.can@canonical.com>
    gpio: sloppy-logic-analyzer: fix use-after-free via debugfs trigger on unbind

Thorsten Blum <thorsten.blum@linux.dev>
    crypto: qce - fix error path in devm_qce_register_algs

Thorsten Blum <thorsten.blum@linux.dev>
    crypto: starfive - use scatterlist length before DMA mapping

Jianing Li <m13940358460@163.com>
    Input: hynitron_cstxxx - validate touch count and finger IDs

Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue

Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Input: synaptics-rmi4 - block s_input when F54 queue is busy

Bryam Vargas <hexlabsecurity@proton.me>
    Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer

Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Input: synaptics-rmi4 - zero report size on F54 work error

George Wilson <gcwilson@linux.ibm.com>
    powerpc/pseries: lparcfg - fix kbuf[] underflow

Pengpeng Hou <pengpeng@iscas.ac.cn>
    Input: iforce - validate input packet lengths

Zhefu Zhang <a723356@gmail.com>
    Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard

Linmao Li <lilinmao@kylinos.cn>
    Input: psxpad-spi - set driver data before use

Richard Davies <richard@arachsys.com>
    Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet

Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Input: synaptics-rmi4 - fix F55 transmitter electrode count typo

George Wilson <gcwilson@linux.ibm.com>
    powerpc/pseries: pci - logic bug

HyeongJun An <sammiee5311@gmail.com>
    Input: cs40l50-vibra - validate custom data from user space

Kyohei Kadota <lufia@lufia.org>
    Input: xpad - add support for ZENAIM LEVERLESS

Bard Liao <yung-chuan.liao@linux.intel.com>
    ASoC: SOF: topology: Use acpi mach from the machine driver

Asad Kamal <asad.kamal@amd.com>
    drm/amdgpu: fix aperture iounmap skipped on device removal

Qiang Yu <Qiang.Yu@amd.com>
    drm/amdgpu: read TRUNCATE_COORD_MODE on gfx12

Candice Li <candice.li@amd.com>
    drm/amdgpu: reject oversized IBs with per-ring packet limits

Osama Abdelkader <osama.abdelkader@gmail.com>
    drm/panthor: skip zero-sized firmware sections

Mingyu Wang <25181214217@stu.xidian.edu.cn>
    fbdev: core: Fix pointer desynchronization in fb_io_read()

Dawid Wróbel <me@dawidwrobel.com>
    ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses

Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
    ASoC: cs35l41: sort the register default table

Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
    ASoC: cs35l45: sort the register default table

Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
    ASoC: cs4265: sort the register default table

Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
    ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked()

Hidayath Khan <hidayath@linux.ibm.com>
    s390/qeth: validate user buffer length in SNMP and ARP query ioctls

Wyatt Feng <bronzed_45_vested@icloud.com>
    mptcp: fastopen: only mark MPTFO subflows with SYN data

Matthieu Baerts (NGI0) <matttbe@kernel.org>
    mptcp: options: reset DSS fields in case of unexpected size

Matthieu Baerts (NGI0) <matttbe@kernel.org>
    mptcp: avoid combining some incoming suboptions

Gang Yan <yangang@kylinos.cn>
    selftests: mptcp: join: mark tests with data corruption as failed

Bryam Vargas <hexlabsecurity@proton.me>
    selinux: reject an unclaimed class value in security_get_classes()

Bryam Vargas <hexlabsecurity@proton.me>
    selinux: do not cancel a policy conversion that never started

Bryam Vargas <hexlabsecurity@proton.me>
    selinux: reject a class permission count below its inherited common

Bryam Vargas <hexlabsecurity@proton.me>
    selinux: require every boolean value to be defined

Sean Christopherson <seanjc@google.com>
    KVM: SVM: Ensure PSP module is initialized if KVM module is built-in

Sean Christopherson <seanjc@google.com>
    crypto: ccp: Add external API interface for PSP module initialization

Erni Sri Satya Vennela <ernis@linux.microsoft.com>
    net: mana: Fix EQ leak in mana_remove on NULL port

Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
    ipvs: separate destination availability state

Philipp David <pd-lkml@3b.pm>
    igc: fix netdev not re-attached after resume if interface is down

SJ Park <sj@kernel.org>
    mm/damon: adjust isolated pages stat for DAMOS_MIGRATE_{HOT,COLD}

liyouhong <liyouhong@kylinos.cn>
    mm/damon/ops-common: putback folios on invalid migrate nid

Liyuan Pang <pangliyuan1@huawei.com>
    ubi: fastmap: fix ubi->fm memory leak

Cheng Ming Lin <chengminglin@mxic.com.tw>
    mtd: ubi: skip programming unused bits in ubi headers

Chao Yu <chao@kernel.org>
    f2fs: fix UAF issue in f2fs_merge_page_bio()

Daniel Borkmann <daniel@iogearbox.net>
    selftests/bpf: Add tests for stale delta leaking through id reassignment

Daniel Borkmann <daniel@iogearbox.net>
    selftests/bpf: Add tests for delta tracking when src_reg == dst_reg

Daniel Borkmann <daniel@iogearbox.net>
    bpf: Clear delta when clearing reg id for non-{add,sub} ops

Daniel Borkmann <daniel@iogearbox.net>
    bpf: Fix linked reg delta tracking when src_reg == dst_reg

Chao Shi <coshi036@gmail.com>
    block: stop the timeout timer when releasing a never added disk


-------------

Diffstat:

 Makefile                                           |   4 +-
 arch/arm64/boot/dts/nvidia/tegra194.dtsi           |   2 +
 arch/loongarch/mm/pageattr.c                       |   2 +-
 arch/m68k/Kconfig.cpu                              |   4 +
 arch/openrisc/include/asm/processor.h              |   2 +
 arch/openrisc/kernel/dma.c                         |   4 +-
 arch/openrisc/kernel/signal.c                      |   5 +-
 arch/powerpc/platforms/pseries/lparcfg.c           |   2 +-
 arch/powerpc/platforms/pseries/pci.c               |   2 +-
 arch/riscv/mm/pageattr.c                           |   8 +-
 arch/x86/kernel/cpu/mce/amd.c                      |   4 +
 arch/x86/kernel/cpu/mce/core.c                     |  21 +--
 arch/x86/kvm/svm/sev.c                             |  49 ++++--
 arch/x86/kvm/svm/svm.h                             |   1 +
 arch/x86/kvm/x86.c                                 |  13 ++
 block/genhd.c                                      |  12 +-
 crypto/ccm.c                                       |   2 +-
 drivers/ata/libata-eh.c                            |  29 +---
 drivers/ata/libata-scsi.c                          | 115 +++++++++++++--
 drivers/ata/libata.h                               |   3 +-
 drivers/crypto/ccp/sp-dev.c                        |  14 ++
 drivers/crypto/qce/core.c                          |   2 +-
 drivers/crypto/starfive/jh7110-aes.c               |   2 +-
 drivers/crypto/tegra/tegra-se-aes.c                |  22 +--
 drivers/gpio/gpio-sloppy-logic-analyzer.c          |   2 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c             |  63 ++++++--
 drivers/gpu/drm/amd/amdgpu/amdgpu_device.c         |  50 ++++++-
 drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c        |   2 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c            |  24 ++-
 drivers/gpu/drm/amd/amdgpu/amdgpu_object.c         |   3 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c            |  10 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c            |  85 +++--------
 drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c             |   4 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h             |   3 +-
 drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c             |   5 +
 drivers/gpu/drm/amd/amdgpu/nbif_v6_3_1.c           |  42 +++---
 drivers/gpu/drm/amd/amdgpu/vce_v3_0.c              |  26 +++-
 .../gpu/drm/amd/display/dc/core/dc_hw_sequencer.c  |  31 ++--
 drivers/gpu/drm/amd/display/dc/dce/dce_transform.c |   7 +-
 .../drm/amd/display/dc/dce110/dce110_opp_csc_v.c   |   7 +-
 drivers/gpu/drm/amd/pm/amdgpu_dpm.c                |  36 ++++-
 drivers/gpu/drm/amd/pm/amdgpu_pm.c                 |  26 ++--
 drivers/gpu/drm/amd/pm/inc/amdgpu_dpm.h            |   6 +-
 drivers/gpu/drm/amd/pm/powerplay/amd_powerplay.c   |   5 +-
 drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c          |   2 +-
 .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c   | 102 +++++++------
 drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c             |  58 --------
 drivers/gpu/drm/amd/pm/swsmu/smu_cmn.h             |  14 +-
 drivers/gpu/drm/display/drm_hdmi_state_helper.c    |   3 +-
 drivers/gpu/drm/panthor/panthor_fw.c               |   3 +
 drivers/gpu/drm/radeon/radeon_kms.c                |   1 +
 drivers/gpu/drm/vmwgfx/vmwgfx_fence.c              |  10 +-
 drivers/gpu/drm/xe/xe_lrc.c                        |   7 +
 drivers/gpu/drm/xe/xe_oa.c                         |   4 +
 drivers/input/joystick/iforce/iforce-packets.c     |  11 +-
 drivers/input/joystick/iforce/iforce-usb.c         |   3 +
 drivers/input/joystick/psxpad-spi.c                |   1 +
 drivers/input/joystick/xpad.c                      |   2 +
 drivers/input/keyboard/atkbd.c                     |   8 +
 drivers/input/misc/cs40l50-vibra.c                 |  10 +-
 drivers/input/mouse/focaltech.c                    |   2 +-
 drivers/input/rmi4/rmi_f54.c                       |  43 ++++--
 drivers/input/rmi4/rmi_f55.c                       |   4 +-
 drivers/input/touchscreen/hynitron_cstxxx.c        |  13 +-
 drivers/input/touchscreen/sur40.c                  |  23 +--
 drivers/iommu/iommufd/device.c                     |   2 +-
 drivers/mmc/host/atmel-mci.c                       |   2 +
 drivers/mmc/host/omap_hsmmc.c                      |   2 +-
 drivers/mmc/host/sdhci.c                           |  16 ++
 drivers/mmc/host/sdhci.h                           |   2 +-
 drivers/mtd/ubi/attach.c                           |   4 +-
 drivers/mtd/ubi/fastmap-wl.c                       |   8 +-
 drivers/mtd/ubi/io.c                               |  10 ++
 drivers/mtd/ubi/ubi.h                              |  12 ++
 drivers/net/can/rcar/rcar_canfd.c                  |  28 ++--
 drivers/net/ethernet/intel/ice/ice_vf_lib.c        |  27 ++++
 .../net/ethernet/intel/ice/ice_vf_lib_private.h    |   1 +
 drivers/net/ethernet/intel/ice/ice_virtchnl.c      |  21 +++
 drivers/net/ethernet/intel/igc/igc_main.c          |   9 +-
 drivers/net/ethernet/microsoft/mana/mana_en.c      |   4 +-
 drivers/net/ethernet/ti/am65-cpsw-nuss.c           |   2 +
 drivers/net/ipvlan/ipvlan_main.c                   |   4 +
 drivers/net/macvlan.c                              |   4 +
 drivers/net/tap.c                                  |  24 +--
 drivers/net/veth.c                                 |   2 +-
 drivers/net/vrf.c                                  |  49 ++----
 drivers/net/vxlan/vxlan_core.c                     |  34 ++---
 drivers/net/vxlan/vxlan_mdb.c                      |   4 +-
 drivers/pmdomain/arm/scmi_perf_domain.c            |   2 +-
 drivers/s390/cio/vfio_ccw_async.c                  |  16 ++
 drivers/s390/cio/vfio_ccw_chp.c                    |  31 +++-
 drivers/s390/cio/vfio_ccw_cp.c                     |  74 +++++++---
 drivers/s390/cio/vfio_ccw_cp.h                     |  10 ++
 drivers/s390/cio/vfio_ccw_drv.c                    |  21 ++-
 drivers/s390/cio/vfio_ccw_fsm.c                    |   8 +-
 drivers/s390/cio/vfio_ccw_ops.c                    |  39 ++++-
 drivers/s390/cio/vfio_ccw_private.h                |  10 +-
 drivers/s390/net/qeth_core_main.c                  |   3 +
 drivers/s390/net/qeth_l3_main.c                    |   5 +
 drivers/video/fbdev/core/fb_io_fops.c              |   8 +
 fs/binfmt_elf.c                                    |   4 +-
 fs/binfmt_elf_fdpic.c                              |   4 +-
 fs/binfmt_misc.c                                   |  46 +++---
 fs/btrfs/block-group.c                             |  61 ++++----
 fs/btrfs/block-group.h                             |   3 +-
 fs/btrfs/extent-tree.c                             |   6 +-
 fs/btrfs/messages.h                                |   7 +
 fs/btrfs/space-info.c                              |   2 +-
 fs/btrfs/transaction.c                             |   5 +-
 fs/btrfs/zoned.c                                   |   5 +-
 fs/btrfs/zoned.h                                   |   6 +-
 fs/ceph/addr.c                                     | 164 ++++++++++-----------
 fs/ceph/caps.c                                     |  17 ++-
 fs/ceph/file.c                                     |   9 +-
 fs/ceph/mds_client.c                               |  11 ++
 fs/ceph/mds_client.h                               |   1 +
 fs/ceph/mdsmap.c                                   |   2 +-
 fs/erofs/Kconfig                                   |   3 +-
 fs/eventpoll.c                                     |  17 ++-
 fs/exec.c                                          |   8 +-
 fs/f2fs/data.c                                     |   2 +-
 fs/notify/fanotify/Kconfig                         |   1 -
 fs/notify/fsnotify.c                               |  38 +++++
 fs/open.c                                          |  12 +-
 fs/smb/client/cifsfs.c                             |  22 ++-
 fs/smb/client/cifsglob.h                           |  27 ----
 fs/smb/client/cifssmb.c                            |   6 +-
 fs/smb/client/connect.c                            |   2 +-
 fs/smb/client/inode.c                              |   2 +
 fs/smb/client/smb2ops.c                            |  18 +--
 fs/smb/client/transport.c                          |   8 +-
 fs/smb/common/cifsglob.h                           |  36 +++++
 fs/smb/server/auth.c                               |   4 +-
 fs/smb/server/connection.c                         |  23 ++-
 fs/smb/server/connection.h                         |   5 +
 fs/smb/server/oplock.c                             |   8 +-
 fs/smb/server/smb2misc.c                           |   2 +-
 fs/smb/server/smb2ops.c                            |  32 ++--
 fs/smb/server/smb2pdu.c                            |  88 ++++++-----
 fs/smb/server/smb2pdu.h                            |   9 --
 fs/smb/server/smb_common.c                         |  43 ++++--
 fs/smb/server/smb_common.h                         |  43 ++----
 fs/super.c                                         | 137 +++++++++--------
 fs/xfs/libxfs/xfs_exchmaps.c                       |  10 ++
 fs/xfs/libxfs/xfs_sb.c                             |   4 +-
 fs/xfs/scrub/agheader_repair.c                     | 120 ++++++++++++---
 fs/xfs/scrub/alloc.c                               |   5 +-
 fs/xfs/scrub/attr_repair.c                         |   3 +-
 fs/xfs/scrub/bmap.c                                |   5 +
 fs/xfs/scrub/dirtree_repair.c                      |  22 ++-
 fs/xfs/scrub/nlinks.c                              |  13 +-
 fs/xfs/scrub/nlinks_repair.c                       |   7 +-
 fs/xfs/scrub/parent.c                              |   2 +-
 fs/xfs/scrub/tempfile.c                            |   1 +
 fs/xfs/scrub/trace.h                               |   2 +
 fs/xfs/xfs_dquot.c                                 |   3 +-
 fs/xfs/xfs_dquot_item_recover.c                    |   2 +-
 include/linux/fs.h                                 |  77 +++++++++-
 include/linux/fsnotify.h                           |  39 +++--
 include/linux/libata.h                             |   2 +
 include/linux/netdevice.h                          |  45 +++++-
 include/linux/pagewalk.h                           |   7 +-
 include/linux/psp-sev.h                            |   9 ++
 include/linux/tcp.h                                |   4 +-
 include/linux/userfaultfd_k.h                      |   6 +
 include/net/ip_tunnels.h                           |  28 +++-
 include/net/ip_vs.h                                |   7 +
 include/net/tcp.h                                  |  58 ++++----
 include/uapi/linux/ip_vs.h                         |   6 -
 kernel/bpf/verifier.c                              |  51 ++++---
 kernel/events/core.c                               | 159 ++++++++------------
 kernel/fork.c                                      |  12 +-
 kernel/trace/ftrace.c                              |   9 +-
 kernel/trace/ring_buffer.c                         |  93 +++++-------
 mm/damon/paddr.c                                   |  15 +-
 mm/hugetlb_vmemmap.c                               |   2 +-
 mm/internal.h                                      |   6 +
 mm/khugepaged.c                                    |  35 +++--
 mm/pagewalk.c                                      |  97 ++++++++----
 mm/ptdump.c                                        |  10 +-
 mm/vmalloc.c                                       |  60 +++++++-
 net/ceph/cls_lock_client.c                         |  21 ++-
 net/ceph/decode.c                                  |  18 +--
 net/ceph/osdmap.c                                  |   9 +-
 net/core/dev.c                                     |  14 ++
 net/core/pktgen.c                                  |  43 +++---
 net/ipv4/bpf_tcp_ca.c                              |   2 +-
 net/ipv4/icmp.c                                    |   6 +-
 net/ipv4/ip_fragment.c                             |   6 +-
 net/ipv4/ipmr.c                                    |   4 +-
 net/ipv4/route.c                                   |   4 +-
 net/ipv4/tcp.c                                     |   4 +-
 net/ipv4/tcp_dctcp.h                               |   2 +-
 net/ipv4/tcp_input.c                               |  62 ++++++--
 net/ipv4/tcp_minisocks.c                           |  12 +-
 net/ipv4/tcp_output.c                              |   6 +-
 net/ipv4/tcp_timer.c                               |   4 +-
 net/mptcp/fastopen.c                               |   7 +-
 net/mptcp/options.c                                |  67 ++++++++-
 net/mptcp/protocol.h                               |   1 +
 net/netfilter/ipset/ip_set_bitmap_gen.h            |   2 +-
 net/netfilter/ipset/ip_set_core.c                  |  19 ++-
 net/netfilter/ipset/ip_set_list_set.c              |  10 +-
 net/netfilter/ipvs/ip_vs_conn.c                    |   4 +-
 net/netfilter/ipvs/ip_vs_core.c                    |   6 +-
 net/netfilter/ipvs/ip_vs_ctl.c                     |   4 +-
 net/netfilter/ipvs/ip_vs_dh.c                      |   4 +-
 net/netfilter/ipvs/ip_vs_lblc.c                    |   2 +-
 net/netfilter/ipvs/ip_vs_lblcr.c                   |   8 +-
 net/netfilter/nf_flow_table_core.c                 |   7 +-
 net/netfilter/nf_tables_offload.c                  |   2 +-
 net/packet/af_packet.c                             |   7 +-
 net/sched/act_api.c                                |  10 +-
 net/sched/cls_bpf.c                                |  18 ++-
 net/sched/cls_u32.c                                |   3 +
 net/sched/sch_api.c                                |  24 ++-
 net/tls/tls_sw.c                                   |   5 +
 net/x25/af_x25.c                                   |   4 +-
 net/x25/x25_timer.c                                |  25 ++--
 security/security.c                                |   9 +-
 security/selinux/ss/policydb.c                     |  31 ++++
 security/selinux/ss/services.c                     |  28 +++-
 sound/soc/codecs/cs35l41-lib.c                     |   2 +-
 sound/soc/codecs/cs35l45-tables.c                  |  32 ++--
 sound/soc/codecs/cs4265.c                          |   4 +-
 sound/soc/codecs/lpass-wsa-macro.c                 |   8 +-
 sound/soc/codecs/tas2562.c                         |   9 +-
 sound/soc/intel/common/sof-function-topology-lib.c |   7 +-
 sound/soc/sof/ipc4-topology.c                      |  33 +++++
 sound/soc/sof/sof-audio.c                          |   9 +-
 sound/soc/xilinx/xlnx_formatter_pcm.c              |  10 +-
 .../selftests/bpf/progs/verifier_linked_scalars.c  | 112 ++++++++++++++
 tools/testing/selftests/net/mptcp/mptcp_join.sh    |   4 +-
 233 files changed, 2826 insertions(+), 1496 deletions(-)