* [PATCH 6.18 000/315] 6.18.35-rc1 review
@ 2026-06-07 9:56 Greg Kroah-Hartman
2026-06-07 16:58 ` Pavel Machek
` (5 more replies)
0 siblings, 6 replies; 9+ messages in thread
From: Greg Kroah-Hartman @ 2026-06-07 9:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, linux-kernel, torvalds, akpm, linux,
shuah, patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill, sr
This is the start of the stable review cycle for the 6.18.35 release.
There are 315 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Tue, 09 Jun 2026 09:56:45 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.35-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Linux 6.18.35-rc1
Michael Bommarito <michael.bommarito@gmail.com>
thunderbolt: property: Cap recursion depth in __tb_property_parse_dir()
Jouni Högander <jouni.hogander@intel.com>
drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable
Jassi Brar <jassisinghbrar@gmail.com>
mailbox: Fix NULL message support in mbox_send_message()
Wei-Cheng Chen <weichengc@nvidia.com>
xhci: tegra: Fix ghost USB device on dual-role port unplug
Robert Marko <robert.marko@sartura.hr>
net: phy: micrel: fix LAN8814 QSGMII soft reset
Qing Wang <wangqing7171@gmail.com>
mm/slub: hold cpus_read_lock around flush_rcu_sheaves_on_cache()
Abdurrahman Hussain <abdurrahman@nexthop.ai>
hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock
Abdurrahman Hussain <abdurrahman@nexthop.ai>
hwmon: (pmbus/adm1266) serialize sequencer_state debugfs read with pmbus_lock
Guenter Roeck <linux@roeck-us.net>
hwmon: (pmbus) Add support for guarded PMBus lock
Johan Hovold <johan@kernel.org>
USB: serial: mct_u232: fix memory corruption with small endpoint
Johan Hovold <johan@kernel.org>
USB: serial: digi_acceleport: fix memory corruption with small endpoints
Johan Hovold <johan@kernel.org>
USB: serial: cypress_m8: fix memory corruption with small endpoint
Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
usb: dwc3: xilinx: fix error handling in zynqmp init error paths
Shaomin Chen <eeesssooo020@gmail.com>
xfrm: iptfs: reset runtime state when cloning SAs
Rafael J. Wysocki <rafael.j.wysocki@intel.com>
cpufreq: intel_pstate: Use correct scaling factor on Raptor Lake-E
Rafael J. Wysocki <rafael.j.wysocki@intel.com>
cpufreq: intel_pstate: Add and use hybrid_get_cpu_type()
Paolo Abeni <pabeni@redhat.com>
mptcp: reset rcv wnd on disconnect
Paolo Abeni <pabeni@redhat.com>
mptcp: cleanup fallback dummy mapping generation
Dawei Feng <dawei.feng@seu.edu.cn>
octeontx2-pf: avoid double free of pool->stack on AQ init failure
Zeng Heng <zengheng4@huawei.com>
arm64: tlb: Flush walk cache when unsharing PMD tables
Shardul Bankar <shardul.b@mpiricsoftware.com>
mptcp: do not drop partial packets
Paolo Abeni <pabeni@redhat.com>
mptcp: borrow forward memory from subflow
Paolo Abeni <pabeni@redhat.com>
mptcp: handle first subflow closing consistently
David Carlier <devnexen@gmail.com>
net: devmem: reject dma-buf bind with non-page-aligned size or SG length
Matthieu Baerts (NGI0) <matttbe@kernel.org>
selftests: mptcp: drop nanoseconds width specifier
Shuai Zhang <shuai.zhang@oss.qualcomm.com>
Bluetooth: hci_qca: Convert timeout from jiffies to ms
Uwe Kleine-König <u.kleine-koenig@baylibre.com>
Bluetooth: hci_qca: Migrate to serdev specific shutdown function
Uwe Kleine-König <u.kleine-koenig@baylibre.com>
serdev: Provide a bustype shutdown function
David Howells <dhowells@redhat.com>
rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer
David Howells <dhowells@redhat.com>
rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg
Tom Lendacky <thomas.lendacky@amd.com>
x86/mm: Disable broadcast TLB flush when PCID is disabled
Lukas Wunner <lukas@wunner.de>
platform/x86/intel/vsec: Fix enable_cnt imbalance on PCIe error recovery
David E. Box <david.e.box@linux.intel.com>
platform/x86/intel/vsec: Make driver_data info const
David E. Box <david.e.box@linux.intel.com>
platform/x86/intel/vsec: Refactor base_addr handling
Jacques Nilo <jnilo@free.fr>
serial: 8250_dw: dispatch SysRq character in dw8250_handle_irq()
Jacques Nilo <jnilo@free.fr>
serial: 8250: dispatch SysRq character in serial8250_handle_irq()
Jacques Nilo <jnilo@free.fr>
serial: core: introduce guard(uart_port_lock_check_sysrq_irqsave)
Maciej W. Rozycki <macro@orcam.me.uk>
serial: zs: Convert to use a platform device
Maciej W. Rozycki <macro@orcam.me.uk>
serial: zs: Switch to using channel reset
Maciej W. Rozycki <macro@orcam.me.uk>
serial: zs: Fix bootconsole handover lockup
Maciej W. Rozycki <macro@orcam.me.uk>
serial: dz: Convert to use a platform device
Maciej W. Rozycki <macro@orcam.me.uk>
serial: dz: Fix bootconsole handover lockup
Maciej W. Rozycki <macro@orcam.me.uk>
serial: dz: Fix bootconsole message clobbering at chip reset
Ziyi Guo <n7l8m4@u.northwestern.edu>
drm/amdgpu: check num_entries in GEM_OP GET_MAPPING_INFO
Christian König <christian.koenig@amd.com>
drm/amdgpu: fix calling VM invalidation in amdgpu_hmm_invalidate_gfx
Michael Bommarito <michael.bommarito@gmail.com>
drm/amdgpu: fix lock leak on ENOMEM in AMDGPU_GEM_OP_GET_MAPPING_INFO
David Francis <David.Francis@amd.com>
drm/amdkfd: Check for pdd drm file first in CRIU restore path
Eric Huang <jinhuieric.huang@amd.com>
drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger
Eric Huang <jinhuieric.huang@amd.com>
drm/amdkfd: fix NULL pointer bug in svm_range_set_attr
Shitalkumar Gandhi <shital.gandhi45@gmail.com>
serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma
Maciej W. Rozycki <macro@orcam.me.uk>
serial: zs: Fix swapped RI/DSR modem line transition counting
Hongling Zeng <zenghongling@kylinos.cn>
serial: sh-sci: fix memory region release in error path
Viken Dadhaniya <viken.dadhaniya@oss.qualcomm.com>
serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ
Prasanna S <prasanna.s@oss.qualcomm.com>
serial: qcom-geni: fix UART_RX_PAR_EN bit position
Myeonghun Pak <mhun512@gmail.com>
serial: altera_jtaguart: handle uart_add_one_port() failures
Timur Kristóf <timur.kristof@gmail.com>
drm/amd/pm/si: Disregard vblank time when no displays are connected
Janusz Krzysztofik <janusz.krzysztofik@linux.intel.com>
drm/i915: Fix potential UAF in TTM object purge
Jouni Högander <jouni.hogander@intel.com>
drm/i915/psr: Block DC states on vblank enable when Panel Replay supported
Zhenghang Xiao <kipreyyy@gmail.com>
drm/gem: fix race between change_handle and handle_delete
Berkant Koc <me@berkoc.com>
drm/hyperv: validate VMBus packet size in receive callback
Berkant Koc <me@berkoc.com>
drm/hyperv: validate resolution_count and fix WIN8 fallback
Alexandru Hossu <hossu.alexandru@gmail.com>
scsi: target: iscsi: Validate CHAP_R length before base64 decode
Michael Bommarito <michael.bommarito@gmail.com>
scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf
Michael Bommarito <michael.bommarito@gmail.com>
scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()
Michael Bommarito <michael.bommarito@gmail.com>
scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32
Michael Bommarito <michael.bommarito@gmail.com>
scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker
Michael Bommarito <michael.bommarito@gmail.com>
thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow
Michael Bommarito <michael.bommarito@gmail.com>
thunderbolt: property: Reject u32 wrap in tb_property_entry_valid()
Michael Bommarito <michael.bommarito@gmail.com>
usb: gadget: f_fs: serialize DMABUF cancel against request completion
Michael Bommarito <michael.bommarito@gmail.com>
usb: gadget: f_fs: copy only received bytes on short ep0 read
Seungjin Bae <eeodqql09@gmail.com>
usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports
Jeremy Erazo <mendozayt13@gmail.com>
usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling
Guangshuo Li <lgs201920130244@gmail.com>
usb: gadget: f_hid: fix device reference leak in hidg_alloc()
Guangshuo Li <lgs201920130244@gmail.com>
usb: gadget: net2280: Fix double free in probe error path
Kai Aizen <kai.aizen.dev@gmail.com>
usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind
Johan Hovold <johan@kernel.org>
USB: serial: mct_u232: fix missing interrupt-in transfer sanity check
Johan Hovold <johan@kernel.org>
USB: serial: mxuport: fix memory corruption with small endpoint
Johan Hovold <johan@kernel.org>
USB: serial: keyspan: fix missing indat transfer sanity check
Zhang Cen <rollkingzzc@gmail.com>
USB: serial: cypress_m8: validate interrupt packet headers
Zhang Cen <rollkingzzc@gmail.com>
USB: serial: belkin_sa: validate interrupt status length
Wanquan Zhong <wanquan.zhong@fibocom.com>
USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL
Jan Volckaert <janvolck@gmail.com>
USB: serial: option: add MeiG SRM813Q
Myrrh Periwinkle <myrrhperiwinkle@qtmlabs.xyz>
usb: typec: ucsi: Don't update power_supply on power role change if not connected
Myrrh Periwinkle <myrrhperiwinkle@qtmlabs.xyz>
usb: typec: ucsi: Check if power role change actually happened before handling
Sebastian Reichel <sebastian.reichel@collabora.com>
usb: typec: tcpm: improve handling of DISCOVER_MODES failures
Dan Carpenter <error27@gmail.com>
usb: typec: tipd: Fix error code in tps6598x_probe()
Heitor Alves de Siqueira <halves@igalia.com>
usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize
Heitor Alves de Siqueira <halves@igalia.com>
usb: usbtmc: check URB actual_length for interrupt-IN notifications
Michael Bommarito <michael.bommarito@gmail.com>
usbip: vudc: Fix use after free bug in vudc_remove due to race condition
Sam Burkels <sam@1a38.nl>
usb: storage: Add quirks for PNY Elite Portable SSD
Stephen J. Fuhry <fuhrysteve@gmail.com>
USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers
Wentao Liang <vulab@iscas.ac.cn>
usb: musb: omap2430: Fix use-after-free in omap2430_probe()
Michal Pecio <michal.pecio@gmail.com>
usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval
Xu Yang <xu.yang_2@nxp.com>
usb: chipidea: core: convert ci_role_switch to local variable
Tudor Ambarus <tudor.ambarus@linaro.org>
tty: serial: samsung: Remove redundant port lock acquisition in rx helpers
Zhaoyang Yu <2426767509@qq.com>
tty: serial: pch_uart: add check for dma_alloc_coherent()
Guangshuo Li <lgs201920130244@gmail.com>
counter: Fix refcount leak in counter_alloc() error path
Ian Abbott <abbotti@mev.co.uk>
comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest()
Ian Abbott <abbotti@mev.co.uk>
comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest()
Hongling Zeng <zenghongling@kylinos.cn>
gpib: cb7210: Fix region leak when request_irq fails
Nicolás Bazaes <contacto@bazaes.cl>
Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490
Dmitry Torokhov <dmitry.torokhov@gmail.com>
Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem
Xiaolei Wang <xiaolei.wang@windriver.com>
misc: rp1: Send IACK on IRQ activate to fix kdump/kexec
Ali Ganiyev <ali.qaniyev@gmail.com>
ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops
Dmitriy Zharov <contact@zharov.dev>
Input: xpad - add support for ASUS ROG RAIKIRI II
Qbeliw Tanaka <q.tanaka@gmx.com>
Input: xpad - add "Nova 2 Lite" from GameSir
Zhang Heng <zhangheng@kylinos.cn>
ALSA: hda/realtek: Fix speaker output on ASUS ROG Strix G615LP
Jingguo Tan <tanjingguo@huawei.com>
xfrm: esp: restore combined single-frag length gate
Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks
Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
ASoC: qcom: q6asm-dai: close stream only when running
Hamza Mahfooz <hamzamahfooz@linux.microsoft.com>
netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check
Cássio Gabriel <cassiogabrielcontato@gmail.com>
ALSA: firewire-motu: Protect register DSP event queue positions
Geoffrey D. Bennett <g@b4.vu>
ALSA: scarlett2: Fix 2i2 Gen 4 direct monitor gain on firmware 2417
Michael Bommarito <michael.bommarito@gmail.com>
xfrm: ah: use skb_to_full_sk in async output callbacks
Herbert Xu <herbert@gondor.apana.org.au>
xfrm: ipcomp: Free destination pages on acomp errors
Maoyi Xie <maoyixie.tju@gmail.com>
xfrm: route MIGRATE notifications to caller's netns
Ashutosh Desai <ashutoshdesai993@gmail.com>
nfc: hci: fix out-of-bounds read in HCP header parsing
Arnd Bergmann <arnd@arndb.de>
iommu, debugobjects: avoid gcc-16.1 section mismatch warnings
Lee Jones <lee@kernel.org>
HID: wacom: Fix OOB write in wacom_hid_set_device_mode()
Santhosh Kumar K <s-k6@ti.com>
spi: spi-mem: avoid mutating op template in spi_mem_supports_op()
Minh Nguyen <minhnguyen.080505@gmail.com>
net: skbuff: fix missing zerocopy reference in pskb_carve helpers
Kuniyuki Iwashima <kuniyu@google.com>
ip6: vti: Use ip6_tnl.net in vti6_changelink().
Michael Bommarito <michael.bommarito@gmail.com>
l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname
Zhengchuan Liang <zcliangcn@gmail.com>
xfrm: input: hold netns during deferred transport reinjection
Qi Tang <tpluszz77@gmail.com>
ipv6: validate extension header length before copying to cmsg
Maoyi Xie <maoyixie.tju@gmail.com>
ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().
Zhengchuan Liang <zcliangcn@gmail.com>
ipv6: exthdrs: refresh nh after handling HAO option
Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params
Justin Iurman <justin.iurman@gmail.com>
ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()
Junrui Luo <moonafterrain@outlook.com>
macsec: fix replay protection at XPN lower-PN wrap
Yuqi Xu <xuyq21@lenovo.com>
bpf: sockmap: fix tail fragment offset in bpf_msg_push_data
Jason A. Donenfeld <Jason@zx2c4.com>
wireguard: send: append trailer after expanding head
Alexis Lothoré (eBPF Foundation) <alexis.lothore@bootlin.com>
x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines
Chaitanya Sabnis <chaitanya.msabnis@gmail.com>
i2c: davinci: fix division by zero on missing clock-frequency
Dmitry Torokhov <dmitry.torokhov@gmail.com>
Input: elan_i2c - validate firmware size before use
Dan Carpenter <error27@gmail.com>
usb: dwc2: Fix use after free in debug code
Peter Chen <peter.chen@cixtech.com>
usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles
Peter Chen <peter.chen@cixtech.com>
usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure
Yongchao Wu <yongchao.wu@autochips.com>
usb: cdns3: gadget: fix request skipping after clearing halt
Johan Hovold <johan@kernel.org>
USB: serial: omninet: fix memory corruption with small endpoint
Benoît Monin <benoit.monin@bootlin.com>
iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf()
Felix Gu <ustc.gu@gmail.com>
iio: buffer: hw-consumer: fix use-after-free in error path
Aldo Conte <aldocontelk@gmail.com>
iio: light: cm3323: fix reg_conf not being initialized correctly
Antoniu Miclaus <antoniu.miclaus@analog.com>
iio: chemical: scd30: fix division by zero in write_raw
Pengpeng Hou <pengpeng@iscas.ac.cn>
iio: chemical: mhz19b: reject oversized serial replies
Svyatoslav Ryhel <clamor95@gmail.com>
iio: Fix iio_multiply_value use in iio_read_channel_processed_scale
Felix Gu <ustc.gu@gmail.com>
iio: light: veml6070: Fix resource leak in probe error path
Advait Dhamorikar <advaitd@mechasystems.com>
iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL
Salah Triki <salah.triki@gmail.com>
iio: temperature: tsys01: fix broken PROM checksum validation
Sanjay Chitroda <sanjayembeddedse@gmail.com>
iio: ssp_sensors: cancel delayed work_refresh on remove
Antoniu Miclaus <antoniu.miclaus@analog.com>
iio: gyro: adis16260: fix division by zero in write_raw
David Carlier <devnexen@gmail.com>
iio: gyro: itg3200: fix i2c read into the wrong stack location
Radu Sabau <radu.sabau@analog.com>
iio: adc: ad4695: Fix call ordering in offload buffer postenable
Salah Triki <salah.triki@gmail.com>
iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw
Salah Triki <salah.triki@gmail.com>
iio: adc: mt6359: fix unchecked return value in mt6358_read_imp
Rodrigo Alencar <rodrigo.alencar@analog.com>
iio: dac: ad5686: fix powerdown control on dual-channel devices
Rodrigo Alencar <rodrigo.alencar@analog.com>
iio: dac: ad5686: acquire lock when doing powerdown control
Rodrigo Alencar <rodrigo.alencar@analog.com>
iio: dac: ad5686: fix input raw value check
Rodrigo Alencar <rodrigo.alencar@analog.com>
iio: dac: ad5686: fix ref bit initialization for single-channel parts
Salah Triki <salah.triki@gmail.com>
iio: dac: max5821: fix return value check in powerdown sync
Kim Seer Paller <kimseer.paller@analog.com>
iio: dac: ad3530r: Fix AD3531/AD3531R powerdown mode strings
David Carlier <devnexen@gmail.com>
iio: adc: npcm: fix unbalanced clk_disable_unprepare()
Christofer Jonason <christofer.jonason@guidelinegeo.com>
iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux
Nathan Chancellor <nathan@kernel.org>
Disable -Wattribute-alias for clang-23 and newer
Sean Christopherson <seanjc@google.com>
KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc()
Sean Christopherson <seanjc@google.com>
KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer
Sean Christopherson <seanjc@google.com>
KVM: SEV: Check PSC request indices against the actual size of the buffer
Sean Christopherson <seanjc@google.com>
KVM: SEV: Compute the correct max length of the in-GHCB scratch area
Sean Christopherson <seanjc@google.com>
KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0
Sean Christopherson <seanjc@google.com>
KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests
Sean Christopherson <seanjc@google.com>
KVM: SEV: Ignore Port I/O requests of length '0'
Michael Roth <michael.roth@amd.com>
KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use
Sean Christopherson <seanjc@google.com>
KVM: SVM: Flush the current TLB when transitioning from xAVIC => x2AVIC
Qiang Ma <maqianga@uniontech.com>
KVM: arm64: PMU: Preserve AArch32 counter low bits
Mark Brown <broonie@kernel.org>
KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor
Wentao Guan <guanwentao@uniontech.com>
USB: cdc-acm: Fix bit overlap and move quirk definitions to header
Alice Ryhl <aliceryhl@google.com>
rust_binder: avoid calling pending_oneway_finished() on TF_UPDATE_TXN
Matthew Maurer <mmaurer@google.com>
rust_binder: Avoid holding lock when dropping delivered_death
Ben Hutchings <benh@debian.org>
parport: Fix race between port and client registration
Dmitry Torokhov <dmitry.torokhov@gmail.com>
Input: xpad - fix out-of-bounds access for Share button
Doruk Tan Ozturk <doruk@0sec.ai>
Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync
Shuai Zhang <shuai.zhang@oss.qualcomm.com>
Bluetooth: hci_qca: Use 100 ms SSR delay for rampatch and NVM loading
Pavitra Jha <jhapavitra98@gmail.com>
Bluetooth: hci_conn: Fix memory leak in hci_le_big_terminate()
Muhammad Bilal <meatuni001@gmail.com>
Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock
Muhammad Bilal <meatuni001@gmail.com>
Bluetooth: ISO: fix UAF in iso_recv_frame
Muhammad Bilal <meatuni001@gmail.com>
Bluetooth: HIDP: fix missing length checks in hidp_input_report()
Siwei Zhang <oss@fourdim.xyz>
Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn
Siwei Zhang <oss@fourdim.xyz>
Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen()
Steve French <stfrench@microsoft.com>
smb: client: fix uninitialized variable in smb2_writev_callback
Stepan Ionichev <sozdayvek@gmail.com>
auxdisplay: line-display: fix OOB read on zero-length message_store()
Dev Jain <dev.jain@arm.com>
mm/rmap: initialize nr_pages to 1 at loop start in try_to_unmap_one
Pratyush Yadav (Google) <pratyush@kernel.org>
memfd: deny writeable mappings when implying SEAL_WRITE
Alexandre Ghiti <alex@ghiti.fr>
mm: memcontrol: propagate NMI slab stats to memcg vmstats
Linpu Yu <linpu5433@gmail.com>
ipc: limit next_id allocation to the valid ID range
SeongJae Park <sj@kernel.org>
mm/damon/sysfs-schemes: delete tried region in regions_rmdirs()
Mikulas Patocka <mpatocka@redhat.com>
hpfs: fix a crash if hpfs_map_dnode_bitmap fails
Shuai Zhang <shuai.zhang@oss.qualcomm.com>
Bluetooth: btusb: Allow firmware re-download when version matches
hlleng <a909204013@gmail.com>
HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse
Thomas Fourier <fourier.thomas@gmail.com>
Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free()
Henri A <contact@henrialfonso.com>
media: rc: igorplugusb: fix control request setup packet
Johan Hovold <johan@kernel.org>
USB: serial: safe_serial: fix memory corruption with small endpoint
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
usb: typec: ucsi: validate connector number in ucsi_connector_change()
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer()
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
usb: typec: altmodes/displayport: validate count before reading Status Update VDO
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes()
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
usb: typec: ucsi: ccg: reject firmware images without a ':' record header
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
iio: pressure: bmp280: fix stack leak in bmp580 trigger handler
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
iio: imu: adis16550: fix stack leak in trigger handler
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer
Horatiu Vultur <horatiu.vultur@microchip.com>
phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X
Jouni Högander <jouni.hogander@intel.com>
drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used
Jouni Högander <jouni.hogander@intel.com>
drm/i915/psr: Read Intel DPCD workaround register
Jouni Högander <jouni.hogander@intel.com>
drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register
Peter Oberparleiter <oberpar@linux.ibm.com>
s390/cio: Restore GFP_DMA for CHSC allocation
Andrei Vagin <avagin@google.com>
Revert "x86/fpu: Refine and simplify the magic number check during signal return"
Michael Bommarito <michael.bommarito@gmail.com>
smb: client: validate the whole DACL before rewriting it in cifsacl
Oliver Neukum <oneukum@suse.com>
media: rc: ttusbir: fix inverted error logic
Sean Young <sean@mess.org>
media: rc: fix race between unregister and urb/irq callbacks
Pavel Begunkov <asml.silence@gmail.com>
net: skbuff: fix pskb_carve leaking zcopy pages
Jiayuan Chen <jiayuan.chen@linux.dev>
ipv6: fix possible infinite loop in fib6_select_path()
Jiayuan Chen <jiayuan.chen@linux.dev>
ipv6: fix possible infinite loop in rt6_fill_node()
Jingguo Tan <tanjingguo@huawei.com>
vsock/virtio: bind uarg before filling zerocopy skb
Zhenghang Xiao <kipreyyy@gmail.com>
sctp: fix race between sctp_wait_for_connect and peeloff
Dipayaan Roy <dipayanroy@linux.microsoft.com>
net: mana: Skip redundant detach on already-detached port
Dipayaan Roy <dipayanroy@linux.microsoft.com>
net: mana: Add NULL guards in teardown path to prevent panic on attach failure
Marco Scardovi <scardracs@disroot.org>
gpio: rockchip: teardown bugs and resource leaks
Marco Scardovi <scardracs@disroot.org>
gpio: rockchip: convert bank->clk to devm_clk_get_enabled()
Dan Carpenter <error27@gmail.com>
gpio: virtuser: Fix uninitialized data bug in gpio_virtuser_direction_do_write()
Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
gpio: adnp: fix flow control regression caused by scoped_guard()
Heitor Alves de Siqueira <halves@igalia.com>
Bluetooth: hci_sync: Reset device counters in hci_dev_close_sync()
Heitor Alves de Siqueira <halves@igalia.com>
Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close
Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp
Zhenghang Xiao <kipreyyy@gmail.com>
Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success
Chuck Lever <chuck.lever@oracle.com>
net/handshake: Pass negative errno through handshake_complete()
Chuck Lever <chuck.lever@oracle.com>
nvme-tcp: store negative errno in queue->tls_err
Chuck Lever <chuck.lever@oracle.com>
net/handshake: Use spin_lock_bh for hn_lock
Jijie Shao <shaojijie@huawei.com>
net: hibmcge: disable Relaxed Ordering to fix RX packet corruption
Jamal Hadi Salim <jhs@mojatatu.com>
net/sched: Revert "net/sched: Restrict conditions for adding duplicating netems to qdisc tree"
Rahul Chandelkar <rc@rexion.ai>
ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()
Jakub Kicinski <kuba@kernel.org>
ethtool: eeprom: add more safeties to EEPROM Netlink fallback
Jakub Kicinski <kuba@kernel.org>
ethtool: eeprom: add missing ethnl_ops_begin() / _complete() during fallback
Jakub Kicinski <kuba@kernel.org>
ethtool: strset: fix header attribute index in ethnl_req_get_phydev()
Jakub Kicinski <kuba@kernel.org>
ethtool: tsinfo: don't pass ERR_PTR to genlmsg_cancel on prepare failure
Jakub Kicinski <kuba@kernel.org>
ethtool: tsinfo: fix uninitialized stats on the by-PHC path
Jakub Kicinski <kuba@kernel.org>
ethtool: tsconfig: fix missing ethnl_ops_complete()
Jakub Kicinski <kuba@kernel.org>
ethtool: pse-pd: fix missing ethnl_ops_complete()
Jakub Kicinski <kuba@kernel.org>
ethtool: linkstate: fix unbalanced ethnl_ops_complete() on PHY lookup error
Jakub Kicinski <kuba@kernel.org>
ethtool: tsconfig: fix reply error handling
Jakub Kicinski <kuba@kernel.org>
ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES
Ido Schimmel <idosch@nvidia.com>
bridge: Fix sleep in atomic context in sysfs path
Ido Schimmel <idosch@nvidia.com>
bridge: Fix sleep in atomic context in netlink path
Oliver Hartkopp <socketcan@hartkopp.net>
bonding: refuse to enslave CAN devices
Zhao Dongdong <zhaodongdong@kylinos.cn>
Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt()
Balasubramani Vivekanandan <balasubramani.vivekanandan@intel.com>
drm/xe: Restore IDLEDLY regiter on engine reset
Cássio Gabriel <cassiogabrielcontato@gmail.com>
ASoC: codecs: simple-mux: Fix enum control bounds check
Sean Shen <grayhat@foxmail.com>
ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE
Eric Dumazet <edumazet@google.com>
tunnels: do not assume transport header in iptunnel_pmtud_check_icmp()
Eric Dumazet <edumazet@google.com>
vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()
Eric Dumazet <edumazet@google.com>
tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]()
Li Ming <ming.li@zohomail.com>
cxl/test: Update mock dev array before calling platform_device_add()
Jakub Kicinski <kuba@kernel.org>
ethtool: cmis: validate fw->size against start_cmd_payload_size
Jakub Kicinski <kuba@kernel.org>
ethtool: cmis: validate start_cmd_payload_size from module
Jakub Kicinski <kuba@kernel.org>
ethtool: cmis: fix u16-to-u8 truncation of msleep_pre_rpl
Jakub Kicinski <kuba@kernel.org>
ethtool: cmis: require exact CDB reply length
Jakub Kicinski <kuba@kernel.org>
ethtool: module: fix cleanup if socket used for flashing multiple devices
Jakub Kicinski <kuba@kernel.org>
ethtool: module: check fw_flash_in_progress under rtnl_lock
Jakub Kicinski <kuba@kernel.org>
ethtool: module: avoid racy updates to dev->ethtool bitfield
Jakub Kicinski <kuba@kernel.org>
ethtool: module: avoid leaking a netdev ref on module flash errors
Jakub Kicinski <kuba@kernel.org>
ethtool: module: call ethnl_ops_complete() on module flash errors
Jakub Kicinski <kuba@kernel.org>
ethtool: rss: avoid device context leak on reply-build failure
Jakub Kicinski <kuba@kernel.org>
ethtool: rss: fix hkey leak when indir_size is 0
Jakub Kicinski <kuba@kernel.org>
ethtool: rss: fix indir_table and hkey leak on get_rxfh failure
Jakub Kicinski <kuba@kernel.org>
ethtool: rss: fix falsely ignoring indir table updates
Jakub Kicinski <kuba@kernel.org>
ethtool: rss: add missing errno on RSS context delete
Jakub Kicinski <kuba@kernel.org>
ethtool: rss: avoid modifying the RSS context response
Björn Töpel <bjorn@kernel.org>
net: Avoid checksumming unreadable skb tail on trim
Weiming Shi <bestswngs@gmail.com>
net: team: fix NULL pointer dereference in team_xmit during mode change
Marc Harvey <marcharvey@google.com>
net: team: Rename port_disabled team mode op to port_tx_disabled
Marc Harvey <marcharvey@google.com>
net: team: Remove unused team_mode_op, port_enabled
Alexander Stein <alexander.stein@ew.tq-group.com>
gpio: mxc: fix irq_high handling
Luka Gejak <luka.gejak@linux.dev>
net: hsr: fix potential OOB access in supervision frame handling
Prathamesh Deshpande <prathameshdeshpande7@gmail.com>
net/mlx5: HWS: Reject unsupported remove-header action
Cássio Gabriel <cassiogabrielcontato@gmail.com>
ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors
Cássio Gabriel <cassiogabrielcontato@gmail.com>
ALSA: pcm: oss: Fix setup list UAF on proc write error
Eric Dumazet <edumazet@google.com>
ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()
David Jeffery <djeffery@redhat.com>
scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues
Breno Leitao <leitao@debian.org>
net/iucv: fix locking in .getsockopt
Alexandra Winter <wintera@linux.ibm.com>
net/smc: Do not re-initialize smc hashtables
Ilya Maximets <i.maximets@ovn.org>
net: netlink: don't set nsid on local notifications
Ilya Maximets <i.maximets@ovn.org>
net: netlink: fix sending unassigned nsid after assigned one
Ziyu Zhang <ziyuzhang201@gmail.com>
vsock: keep poll shutdown state consistent
Weiming Shi <bestswngs@gmail.com>
tun: free page on build_skb failure in tun_xdp_one()
Weiming Shi <bestswngs@gmail.com>
tun: free page on short-frame rejection in tun_xdp_one()
Fernando Fernandez Mancera <fmancera@suse.de>
netfilter: nf_tables: fix dst corruption in same register operation
Florian Westphal <fw@strlen.de>
netfilter: ebtables: fix OOB read in compat_mtw_from_user
Florian Westphal <fw@strlen.de>
netfilter: xt_cpu: prefer raw_smp_processor_id
Chris Mason <clm@meta.com>
netfilter: synproxy: refresh tcphdr after skb_ensure_writable
Deepanshu Kartikey <kartikey406@gmail.com>
kernel/fork: validate exit_signal in kernel_clone()
Dhabaleshwar Das <dhabal123@gmail.com>
accel/rocket: fix UAF via dangling GEM handle in create_bo
Florian Schmaus <florian.schmaus@codasip.com>
kunit: fix use-after-free in debugfs when using kunit.filter
Liu Kai <lukace97@outlook.com>
HID: remove duplicate hid_warn_ratelimited definition
Hongtao Lee <lihongtao@kylinos.cn>
tools/bootconfig: Fix buf leaks in apply_xbc
Carl Lee <carl.lee@amd.com>
nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems
David Ahern <dahern@nvidia.com>
xfrm: Check for underflow in xfrm_state_mtu
Lee Jones <lee@kernel.org>
nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc()
Lee Jones <lee@kernel.org>
nfc: llcp: Fix use-after-free in llcp_sock_release()
Mingzhe Zou <mingzhe.zou@easystack.cn>
bcache: fix uninitialized closure object
Victor Nogueria <victor@mojatatu.com>
net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked
Usama Arif <usama.arif@linux.dev>
xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit
Jeremy Kerr <jk@codeconstruct.com.au>
net: mctp: ensure our nlmsg responses are initialised
Davide Caratti <dcaratti@redhat.com>
net/sched: cls_fw: fix NULL dereference of "old" filters before change()
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size
-------------
Diffstat:
Documentation/netlink/specs/handshake.yaml | 8 +
Makefile | 4 +-
arch/arm64/include/asm/kvm_host.h | 2 +-
arch/arm64/include/asm/tlb.h | 2 +-
arch/arm64/kvm/hyp/include/hyp/switch.h | 16 +-
arch/arm64/kvm/nested.c | 5 +
arch/arm64/kvm/pmu-emul.c | 4 +-
arch/arm64/kvm/sys_regs.c | 11 +-
arch/mips/dec/platform.c | 109 ++++++++++-
arch/riscv/include/asm/syscall_wrapper.h | 4 +
arch/x86/kernel/cpu/cpuid-deps.c | 1 +
arch/x86/kernel/fpu/signal.c | 11 +-
arch/x86/kernel/ftrace.c | 7 +
arch/x86/kvm/svm/avic.c | 35 +++-
arch/x86/kvm/svm/sev.c | 76 ++++---
drivers/accel/rocket/rocket_gem.c | 17 +-
drivers/android/binder/allocation.rs | 8 +
drivers/android/binder/process.rs | 7 +-
drivers/android/binder/transaction.rs | 11 +-
drivers/auxdisplay/line-display.c | 2 +-
drivers/bluetooth/btusb.c | 8 +-
drivers/bluetooth/hci_qca.c | 42 ++--
drivers/comedi/drivers/comedi_test.c | 5 +-
drivers/counter/counter-core.c | 3 +-
drivers/cpufreq/intel_pstate.c | 13 +-
drivers/gpio/gpio-adnp.c | 4 +-
drivers/gpio/gpio-mxc.c | 2 +-
drivers/gpio/gpio-rockchip.c | 23 ++-
drivers/gpio/gpio-virtuser.c | 4 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 11 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_hmm.c | 1 +
drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 7 +-
drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 10 +-
.../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 8 +-
drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 3 +
drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 4 +
drivers/gpu/drm/bridge/sil-sii8620.c | 1 +
drivers/gpu/drm/drm_gem.c | 2 +
drivers/gpu/drm/hyperv/hyperv_drm_proto.c | 113 +++++++++--
drivers/gpu/drm/i915/display/intel_display_core.h | 1 +
drivers/gpu/drm/i915/display/intel_display_irq.c | 8 +-
drivers/gpu/drm/i915/display/intel_display_types.h | 3 +
drivers/gpu/drm/i915/display/intel_dpcd.h | 15 ++
drivers/gpu/drm/i915/display/intel_psr.c | 60 ++++--
drivers/gpu/drm/i915/gem/i915_gem_ttm.c | 28 +--
drivers/gpu/drm/xe/xe_guc_ads.c | 5 +
drivers/hid/hid-ids.h | 1 +
drivers/hid/hid-picolcd_cir.c | 1 +
drivers/hid/hid-quirks.c | 1 +
drivers/hid/wacom_sys.c | 13 +-
drivers/hid/wacom_wac.h | 1 +
drivers/hwmon/pmbus/adm1266.c | 7 +
drivers/hwmon/pmbus/pmbus.h | 5 +
drivers/hwmon/pmbus/pmbus_core.c | 8 +
drivers/i2c/busses/i2c-davinci.c | 2 +-
drivers/iio/adc/ad4695.c | 23 +--
drivers/iio/adc/mt6359-auxadc.c | 1 +
drivers/iio/adc/npcm_adc.c | 25 +--
drivers/iio/adc/viperboard_adc.c | 4 +-
drivers/iio/adc/xilinx-xadc-core.c | 11 +-
drivers/iio/buffer/industrialio-hw-consumer.c | 4 +-
drivers/iio/chemical/mhz19b.c | 17 ++
drivers/iio/chemical/scd30_core.c | 2 +-
drivers/iio/common/ssp_sensors/ssp_dev.c | 1 +
drivers/iio/dac/ad3530r.c | 54 +++--
drivers/iio/dac/ad5686.c | 56 ++++--
drivers/iio/dac/ad5686.h | 1 +
drivers/iio/dac/max5821.c | 9 +-
drivers/iio/gyro/adis16260.c | 3 +
drivers/iio/gyro/itg3200_buffer.c | 2 +-
drivers/iio/imu/adis16550.c | 2 +-
drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c | 2 +-
drivers/iio/industrialio-buffer.c | 1 +
drivers/iio/inkern.c | 6 +-
drivers/iio/light/cm3323.c | 5 +-
drivers/iio/light/veml6070.c | 14 +-
drivers/iio/magnetometer/st_magn_core.c | 13 +-
drivers/iio/pressure/bmp280-core.c | 2 +-
drivers/iio/temperature/tsys01.c | 2 +-
drivers/input/joystick/xpad.c | 14 +-
drivers/input/misc/ims-pcu.c | 2 +-
drivers/input/mouse/elan_i2c_core.c | 5 +
drivers/input/mouse/synaptics.c | 1 +
drivers/input/touchscreen/atmel_mxt_ts.c | 2 +-
drivers/input/touchscreen/usbtouchscreen.c | 5 +
drivers/iommu/io-pgtable-arm-v7s.c | 18 +-
drivers/mailbox/mailbox.c | 15 +-
drivers/mailbox/tegra-hsp.c | 2 +-
drivers/md/bcache/super.c | 3 +-
drivers/media/cec/core/cec-core.c | 2 +-
drivers/media/common/siano/smsir.c | 1 +
drivers/media/i2c/ir-kbd-i2c.c | 2 +
drivers/media/pci/bt8xx/bttv-input.c | 3 +-
drivers/media/pci/cx23885/cx23885-input.c | 1 +
drivers/media/pci/cx88/cx88-input.c | 3 +-
drivers/media/pci/dm1105/dm1105.c | 1 +
drivers/media/pci/mantis/mantis_input.c | 1 +
drivers/media/pci/saa7134/saa7134-input.c | 1 +
drivers/media/pci/smipcie/smipcie-ir.c | 1 +
drivers/media/pci/ttpci/budget-ci.c | 1 +
drivers/media/rc/ati_remote.c | 6 +-
drivers/media/rc/ene_ir.c | 2 +-
drivers/media/rc/fintek-cir.c | 3 +-
drivers/media/rc/igorplugusb.c | 3 +-
drivers/media/rc/iguanair.c | 1 +
drivers/media/rc/img-ir/img-ir-hw.c | 3 +-
drivers/media/rc/img-ir/img-ir-raw.c | 3 +-
drivers/media/rc/imon.c | 3 +-
drivers/media/rc/ir-hix5hd2.c | 2 +-
drivers/media/rc/ir_toy.c | 1 +
drivers/media/rc/ite-cir.c | 2 +-
drivers/media/rc/mceusb.c | 1 +
drivers/media/rc/rc-ir-raw.c | 5 -
drivers/media/rc/rc-loopback.c | 1 +
drivers/media/rc/rc-main.c | 6 +-
drivers/media/rc/redrat3.c | 4 +-
drivers/media/rc/st_rc.c | 2 +-
drivers/media/rc/streamzap.c | 7 +-
drivers/media/rc/sunxi-cir.c | 1 +
drivers/media/rc/ttusbir.c | 4 +-
drivers/media/rc/winbond-cir.c | 2 +-
drivers/media/rc/xbox_remote.c | 5 +-
drivers/media/usb/au0828/au0828-input.c | 1 +
drivers/media/usb/dvb-usb-v2/dvb_usb_core.c | 1 +
drivers/media/usb/dvb-usb/dvb-usb-remote.c | 6 +-
drivers/media/usb/em28xx/em28xx-input.c | 1 +
drivers/misc/rp1/rp1_pci.c | 1 +
drivers/net/bonding/bond_main.c | 6 +
drivers/net/ethernet/hisilicon/hibmcge/hbg_main.c | 3 +
.../ethernet/marvell/octeontx2/nic/otx2_common.c | 2 +
.../mellanox/mlx5/core/steering/hws/fs_hws.c | 4 +-
drivers/net/ethernet/microsoft/mana/mana_en.c | 78 +++++---
drivers/net/macsec.c | 3 +-
drivers/net/phy/micrel.c | 15 +-
drivers/net/phy/mscc/mscc.h | 8 +-
drivers/net/phy/mscc/mscc_main.c | 23 +--
drivers/net/team/team_core.c | 51 +++--
drivers/net/team/team_mode_loadbalance.c | 4 +-
drivers/net/tun.c | 5 +-
drivers/net/vxlan/vxlan_core.c | 4 +-
drivers/net/wireguard/send.c | 20 +-
drivers/nfc/nxp-nci/i2c.c | 21 +-
drivers/nvme/host/tcp.c | 2 +-
drivers/parport/share.c | 11 +-
drivers/platform/x86/intel/vsec.c | 91 ++++-----
drivers/s390/cio/chsc.c | 4 +-
drivers/s390/cio/chsc_sch.c | 20 +-
drivers/s390/cio/scm.c | 2 +-
drivers/scsi/fcoe/fcoe_ctlr.c | 2 +-
drivers/scsi/scsi_lib.c | 27 ++-
drivers/scsi/scsi_transport_fc.c | 77 ++++----
drivers/spi/spi-mem.c | 15 +-
drivers/staging/gpib/cb7210/cb7210.c | 10 +-
drivers/staging/media/av7110/av7110_ir.c | 1 +
drivers/target/iscsi/iscsi_target.c | 5 +-
drivers/target/iscsi/iscsi_target_auth.c | 19 +-
drivers/target/iscsi/iscsi_target_nego.c | 7 +-
drivers/target/iscsi/iscsi_target_parameters.c | 62 ++++--
drivers/target/iscsi/iscsi_target_parameters.h | 2 +-
drivers/thunderbolt/property.c | 32 ++-
drivers/tty/serdev/core.c | 21 ++
drivers/tty/serial/8250/8250_dw.c | 2 +-
drivers/tty/serial/8250/8250_port.c | 7 +-
drivers/tty/serial/altera_jtaguart.c | 7 +-
drivers/tty/serial/dz.c | 171 ++++++++--------
drivers/tty/serial/fsl_lpuart.c | 15 +-
drivers/tty/serial/pch_uart.c | 19 +-
drivers/tty/serial/qcom_geni_serial.c | 16 +-
drivers/tty/serial/samsung_tty.c | 8 -
drivers/tty/serial/sh-sci.c | 2 +-
drivers/tty/serial/zs.c | 218 ++++++++-------------
drivers/tty/serial/zs.h | 1 -
drivers/usb/cdns3/cdns3-gadget.c | 12 +-
drivers/usb/cdns3/cdns3-plat.c | 11 +-
drivers/usb/chipidea/core.c | 16 +-
drivers/usb/class/cdc-acm.c | 2 -
drivers/usb/class/cdc-acm.h | 2 +
drivers/usb/class/usbtmc.c | 14 ++
drivers/usb/core/config.c | 9 +-
drivers/usb/core/quirks.c | 4 +
drivers/usb/dwc2/hcd.c | 4 +-
drivers/usb/dwc3/dwc3-xilinx.c | 27 +--
drivers/usb/gadget/composite.c | 5 +-
drivers/usb/gadget/function/f_fs.c | 26 ++-
drivers/usb/gadget/function/f_hid.c | 3 +-
drivers/usb/gadget/function/f_uvc.c | 28 ++-
drivers/usb/gadget/udc/dummy_hcd.c | 4 +
drivers/usb/gadget/udc/net2280.c | 4 +-
drivers/usb/host/xhci-tegra.c | 77 ++++----
drivers/usb/musb/omap2430.c | 3 +-
drivers/usb/serial/belkin_sa.c | 3 +
drivers/usb/serial/cypress_m8.c | 20 +-
drivers/usb/serial/digi_acceleport.c | 23 ++-
drivers/usb/serial/keyspan.c | 4 +
drivers/usb/serial/mct_u232.c | 26 ++-
drivers/usb/serial/mxuport.c | 8 +
drivers/usb/serial/omninet.c | 9 +-
drivers/usb/serial/option.c | 9 +-
drivers/usb/serial/safe_serial.c | 11 ++
drivers/usb/storage/unusual_uas.h | 7 +
drivers/usb/typec/altmodes/displayport.c | 2 +
drivers/usb/typec/tcpm/tcpci_maxim_core.c | 9 +
drivers/usb/typec/tcpm/tcpm.c | 117 ++++++-----
drivers/usb/typec/tcpm/wcove.c | 13 +-
drivers/usb/typec/tipd/core.c | 1 +
drivers/usb/typec/ucsi/displayport.c | 4 +
drivers/usb/typec/ucsi/ucsi.c | 24 ++-
drivers/usb/typec/ucsi/ucsi_ccg.c | 5 +
drivers/usb/usbip/vudc_dev.c | 1 +
drivers/usb/usbip/vudc_transfer.c | 3 +-
fs/hpfs/alloc.c | 2 +-
fs/smb/client/cifsacl.c | 116 ++++++++---
fs/smb/client/smb2pdu.c | 2 +-
fs/smb/server/smb2pdu.c | 11 ++
fs/smb/server/smbacl.c | 8 +-
include/kunit/test.h | 1 +
include/linux/compat.h | 4 +
include/linux/compiler-clang.h | 6 +
include/linux/compiler_attributes.h | 11 ++
include/linux/compiler_types.h | 4 +
include/linux/hid.h | 2 -
include/linux/if_team.h | 3 +-
include/linux/intel_vsec.h | 4 +-
include/linux/mailbox_controller.h | 3 +
include/linux/parport.h | 1 +
include/linux/serdev.h | 1 +
include/linux/serial_core.h | 12 ++
include/linux/syscalls.h | 4 +
include/media/rc-core.h | 2 -
include/net/netfilter/nf_tables.h | 7 +
include/net/xfrm.h | 3 +-
ipc/util.c | 2 +-
kernel/fork.c | 11 +-
lib/debugobjects.c | 2 +-
lib/kunit/executor.c | 19 +-
lib/kunit/test.c | 1 +
mm/damon/sysfs-schemes.c | 8 +-
mm/memcontrol.c | 6 +
mm/memfd.c | 12 +-
mm/rmap.c | 2 +
mm/slab_common.c | 2 +
mm/slub.c | 1 +
net/bluetooth/6lowpan.c | 2 +
net/bluetooth/hci_conn.c | 4 +-
net/bluetooth/hci_sync.c | 16 +-
net/bluetooth/hidp/core.c | 23 ++-
net/bluetooth/iso.c | 12 +-
net/bluetooth/l2cap_core.c | 41 +++-
net/bluetooth/l2cap_sock.c | 16 +-
net/bridge/br_netlink.c | 17 +-
net/bridge/br_switchdev.c | 1 -
net/bridge/br_sysfs_if.c | 30 ++-
net/bridge/netfilter/ebtables.c | 30 +++
net/core/devmem.c | 11 ++
net/core/filter.c | 2 +-
net/core/skbuff.c | 45 ++++-
net/ethtool/cmis.h | 4 +-
net/ethtool/cmis_cdb.c | 9 +-
net/ethtool/cmis_fw_update.c | 44 +++--
net/ethtool/coalesce.c | 6 +
net/ethtool/eeprom.c | 10 +-
net/ethtool/linkstate.c | 6 +-
net/ethtool/module.c | 41 ++--
net/ethtool/netlink.c | 4 +-
net/ethtool/netlink.h | 4 +-
net/ethtool/pse-pd.c | 10 +-
net/ethtool/rss.c | 37 ++--
net/ethtool/strset.c | 2 +-
net/ethtool/tsconfig.c | 15 +-
net/ethtool/tsinfo.c | 19 +-
net/handshake/genl.c | 3 +-
net/handshake/genl.h | 1 +
net/handshake/handshake-test.c | 2 +-
net/handshake/handshake.h | 4 +-
net/handshake/netlink.c | 6 +-
net/handshake/request.c | 16 +-
net/handshake/tlshd.c | 6 +-
net/hsr/hsr_forward.c | 4 +-
net/ipv4/ah4.c | 2 +-
net/ipv4/esp4.c | 4 +-
net/ipv4/ip_tunnel_core.c | 22 ++-
net/ipv4/sysctl_net_ipv4.c | 2 +-
net/ipv6/ah6.c | 2 +-
net/ipv6/datagram.c | 54 ++++-
net/ipv6/esp6.c | 4 +-
net/ipv6/exthdrs.c | 6 +-
net/ipv6/ip6_vti.c | 23 ++-
net/ipv6/route.c | 5 +
net/iucv/af_iucv.c | 20 +-
net/key/af_key.c | 6 +-
net/l2tp/l2tp_core.c | 11 +-
net/mctp/device.c | 1 +
net/mctp/neigh.c | 1 +
net/mctp/route.c | 1 +
net/mptcp/fastopen.c | 4 +-
net/mptcp/mib.c | 1 -
net/mptcp/mib.h | 1 -
net/mptcp/protocol.c | 65 ++++--
net/mptcp/protocol.h | 31 ++-
net/mptcp/subflow.c | 8 +-
net/netfilter/nf_conntrack_proto_tcp.c | 3 +-
net/netfilter/nf_synproxy_core.c | 2 +
net/netfilter/nft_bitwise.c | 18 +-
net/netfilter/nft_byteorder.c | 13 +-
net/netfilter/xt_cpu.c | 2 +-
net/netlink/af_netlink.c | 11 +-
net/nfc/hci/core.c | 10 +
net/nfc/llcp_core.c | 11 ++
net/nfc/llcp_sock.c | 2 +
net/nfc/nci/hci.c | 10 +
net/rxrpc/ar-internal.h | 14 +-
net/rxrpc/call_event.c | 22 +--
net/rxrpc/call_object.c | 2 +
net/rxrpc/conn_event.c | 30 ++-
net/rxrpc/insecure.c | 8 +-
net/rxrpc/recvmsg.c | 68 +++++--
net/rxrpc/rxgk.c | 147 ++++++--------
net/rxrpc/rxgk_app.c | 46 ++---
net/rxrpc/rxgk_common.h | 66 +++----
net/rxrpc/rxkad.c | 115 ++++-------
net/sched/cls_fw.c | 6 +-
net/sched/sch_netem.c | 40 ----
net/sched/sch_sfb.c | 2 +-
net/sctp/socket.c | 2 +
net/smc/af_smc.c | 4 +-
net/vmw_vsock/af_vsock.c | 49 +++--
net/vmw_vsock/hyperv_transport.c | 9 +-
net/vmw_vsock/virtio_transport_common.c | 26 ++-
net/vmw_vsock/vmci_transport.c | 8 +-
net/xfrm/xfrm_input.c | 16 +-
net/xfrm/xfrm_ipcomp.c | 12 +-
net/xfrm/xfrm_iptfs.c | 29 ++-
net/xfrm/xfrm_policy.c | 17 +-
net/xfrm/xfrm_state.c | 23 ++-
net/xfrm/xfrm_user.c | 5 +-
sound/core/oss/pcm_oss.c | 18 +-
.../motu/motu-register-dsp-message-parser.c | 11 +-
sound/hda/codecs/realtek/alc269.c | 1 +
sound/soc/codecs/simple-mux.c | 2 +-
sound/soc/intel/boards/bytcht_es8316.c | 29 ++-
sound/soc/qcom/qdsp6/q6asm-dai.c | 43 ++--
sound/usb/mixer_scarlett2.c | 33 +++-
tools/bootconfig/main.c | 4 +-
tools/testing/cxl/test/cxl.c | 105 ++++------
tools/testing/selftests/net/mptcp/mptcp_connect.sh | 6 +-
tools/testing/selftests/net/mptcp/mptcp_lib.sh | 10 +-
346 files changed, 3284 insertions(+), 1733 deletions(-)
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH 6.18 000/315] 6.18.35-rc1 review
2026-06-07 9:56 [PATCH 6.18 000/315] 6.18.35-rc1 review Greg Kroah-Hartman
@ 2026-06-07 16:58 ` Pavel Machek
2026-06-08 12:13 ` Jon Hunter
2026-06-07 17:04 ` Miguel Ojeda
` (4 subsequent siblings)
5 siblings, 1 reply; 9+ messages in thread
From: Pavel Machek @ 2026-06-07 16:58 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill, sr
[-- Attachment #1: Type: text/plain, Size: 60243 bytes --]
Hi!
> This is the start of the stable review cycle for the 6.18.35 release.
> There are 315 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
We see build problem here:
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/jobs/14732223960
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/pipelines/2582906697
Best regards,
Pavel
arch/arm64/kvm/nested.c: In function 'kvm_init_nv_sysregs':
1807
12:45:08
arch/arm64/kvm/nested.c:1776:9: error: 'resx' undeclared (first use in this function); did you mean 'res1'?
1808
12:45:08
1776 | resx.res0 = ZCR_ELx_RES0 | GENMASK_ULL(8, 4);
1809
12:45:08
| ^~~~
1810
12:45:08
| res1
1811
12:45:08
arch/arm64/kvm/nested.c:1776:9: note: each undeclared identifier is reported only once for each function it appears in
1812
12:45:08
arch/arm64/kvm/nested.c:1778:9: error: too few arguments to function 'set_sysreg_masks'
1813
12:45:08
1778 | set_sysreg_masks(kvm, ZCR_EL2, resx);
1814
12:45:08
| ^~~~~~~~~~~~~~~~
1815
12:45:08
arch/arm64/kvm/nested.c:1641:29: note: declared here
1816
12:45:08
1641 | static __always_inline void set_sysreg_masks(struct kvm *kvm, int sr, u64 res0, u64 res1)
1817
12:45:08
| ^~~~~~~~~~~~~~~~
1818
12:45:08
CC block/holder.o
1819
12:45:08
CC drivers/irqchip/irq-ls-scfg-msi.o
1820
12:45:09
make[4]: *** [scripts/Makefile.build:287: arch/arm64/kvm/nested.o]
Error 1
>
> thanks,
>
> greg k-h
>
> -------------
> Pseudo-Shortlog of commits:
>
> Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Linux 6.18.35-rc1
>
> Michael Bommarito <michael.bommarito@gmail.com>
> thunderbolt: property: Cap recursion depth in __tb_property_parse_dir()
>
> Jouni Högander <jouni.hogander@intel.com>
> drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable
>
> Jassi Brar <jassisinghbrar@gmail.com>
> mailbox: Fix NULL message support in mbox_send_message()
>
> Wei-Cheng Chen <weichengc@nvidia.com>
> xhci: tegra: Fix ghost USB device on dual-role port unplug
>
> Robert Marko <robert.marko@sartura.hr>
> net: phy: micrel: fix LAN8814 QSGMII soft reset
>
> Qing Wang <wangqing7171@gmail.com>
> mm/slub: hold cpus_read_lock around flush_rcu_sheaves_on_cache()
>
> Abdurrahman Hussain <abdurrahman@nexthop.ai>
> hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock
>
> Abdurrahman Hussain <abdurrahman@nexthop.ai>
> hwmon: (pmbus/adm1266) serialize sequencer_state debugfs read with pmbus_lock
>
> Guenter Roeck <linux@roeck-us.net>
> hwmon: (pmbus) Add support for guarded PMBus lock
>
> Johan Hovold <johan@kernel.org>
> USB: serial: mct_u232: fix memory corruption with small endpoint
>
> Johan Hovold <johan@kernel.org>
> USB: serial: digi_acceleport: fix memory corruption with small endpoints
>
> Johan Hovold <johan@kernel.org>
> USB: serial: cypress_m8: fix memory corruption with small endpoint
>
> Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
> usb: dwc3: xilinx: fix error handling in zynqmp init error paths
>
> Shaomin Chen <eeesssooo020@gmail.com>
> xfrm: iptfs: reset runtime state when cloning SAs
>
> Rafael J. Wysocki <rafael.j.wysocki@intel.com>
> cpufreq: intel_pstate: Use correct scaling factor on Raptor Lake-E
>
> Rafael J. Wysocki <rafael.j.wysocki@intel.com>
> cpufreq: intel_pstate: Add and use hybrid_get_cpu_type()
>
> Paolo Abeni <pabeni@redhat.com>
> mptcp: reset rcv wnd on disconnect
>
> Paolo Abeni <pabeni@redhat.com>
> mptcp: cleanup fallback dummy mapping generation
>
> Dawei Feng <dawei.feng@seu.edu.cn>
> octeontx2-pf: avoid double free of pool->stack on AQ init failure
>
> Zeng Heng <zengheng4@huawei.com>
> arm64: tlb: Flush walk cache when unsharing PMD tables
>
> Shardul Bankar <shardul.b@mpiricsoftware.com>
> mptcp: do not drop partial packets
>
> Paolo Abeni <pabeni@redhat.com>
> mptcp: borrow forward memory from subflow
>
> Paolo Abeni <pabeni@redhat.com>
> mptcp: handle first subflow closing consistently
>
> David Carlier <devnexen@gmail.com>
> net: devmem: reject dma-buf bind with non-page-aligned size or SG length
>
> Matthieu Baerts (NGI0) <matttbe@kernel.org>
> selftests: mptcp: drop nanoseconds width specifier
>
> Shuai Zhang <shuai.zhang@oss.qualcomm.com>
> Bluetooth: hci_qca: Convert timeout from jiffies to ms
>
> Uwe Kleine-König <u.kleine-koenig@baylibre.com>
> Bluetooth: hci_qca: Migrate to serdev specific shutdown function
>
> Uwe Kleine-König <u.kleine-koenig@baylibre.com>
> serdev: Provide a bustype shutdown function
>
> David Howells <dhowells@redhat.com>
> rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer
>
> David Howells <dhowells@redhat.com>
> rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg
>
> Tom Lendacky <thomas.lendacky@amd.com>
> x86/mm: Disable broadcast TLB flush when PCID is disabled
>
> Lukas Wunner <lukas@wunner.de>
> platform/x86/intel/vsec: Fix enable_cnt imbalance on PCIe error recovery
>
> David E. Box <david.e.box@linux.intel.com>
> platform/x86/intel/vsec: Make driver_data info const
>
> David E. Box <david.e.box@linux.intel.com>
> platform/x86/intel/vsec: Refactor base_addr handling
>
> Jacques Nilo <jnilo@free.fr>
> serial: 8250_dw: dispatch SysRq character in dw8250_handle_irq()
>
> Jacques Nilo <jnilo@free.fr>
> serial: 8250: dispatch SysRq character in serial8250_handle_irq()
>
> Jacques Nilo <jnilo@free.fr>
> serial: core: introduce guard(uart_port_lock_check_sysrq_irqsave)
>
> Maciej W. Rozycki <macro@orcam.me.uk>
> serial: zs: Convert to use a platform device
>
> Maciej W. Rozycki <macro@orcam.me.uk>
> serial: zs: Switch to using channel reset
>
> Maciej W. Rozycki <macro@orcam.me.uk>
> serial: zs: Fix bootconsole handover lockup
>
> Maciej W. Rozycki <macro@orcam.me.uk>
> serial: dz: Convert to use a platform device
>
> Maciej W. Rozycki <macro@orcam.me.uk>
> serial: dz: Fix bootconsole handover lockup
>
> Maciej W. Rozycki <macro@orcam.me.uk>
> serial: dz: Fix bootconsole message clobbering at chip reset
>
> Ziyi Guo <n7l8m4@u.northwestern.edu>
> drm/amdgpu: check num_entries in GEM_OP GET_MAPPING_INFO
>
> Christian König <christian.koenig@amd.com>
> drm/amdgpu: fix calling VM invalidation in amdgpu_hmm_invalidate_gfx
>
> Michael Bommarito <michael.bommarito@gmail.com>
> drm/amdgpu: fix lock leak on ENOMEM in AMDGPU_GEM_OP_GET_MAPPING_INFO
>
> David Francis <David.Francis@amd.com>
> drm/amdkfd: Check for pdd drm file first in CRIU restore path
>
> Eric Huang <jinhuieric.huang@amd.com>
> drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger
>
> Eric Huang <jinhuieric.huang@amd.com>
> drm/amdkfd: fix NULL pointer bug in svm_range_set_attr
>
> Shitalkumar Gandhi <shital.gandhi45@gmail.com>
> serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma
>
> Maciej W. Rozycki <macro@orcam.me.uk>
> serial: zs: Fix swapped RI/DSR modem line transition counting
>
> Hongling Zeng <zenghongling@kylinos.cn>
> serial: sh-sci: fix memory region release in error path
>
> Viken Dadhaniya <viken.dadhaniya@oss.qualcomm.com>
> serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ
>
> Prasanna S <prasanna.s@oss.qualcomm.com>
> serial: qcom-geni: fix UART_RX_PAR_EN bit position
>
> Myeonghun Pak <mhun512@gmail.com>
> serial: altera_jtaguart: handle uart_add_one_port() failures
>
> Timur Kristóf <timur.kristof@gmail.com>
> drm/amd/pm/si: Disregard vblank time when no displays are connected
>
> Janusz Krzysztofik <janusz.krzysztofik@linux.intel.com>
> drm/i915: Fix potential UAF in TTM object purge
>
> Jouni Högander <jouni.hogander@intel.com>
> drm/i915/psr: Block DC states on vblank enable when Panel Replay supported
>
> Zhenghang Xiao <kipreyyy@gmail.com>
> drm/gem: fix race between change_handle and handle_delete
>
> Berkant Koc <me@berkoc.com>
> drm/hyperv: validate VMBus packet size in receive callback
>
> Berkant Koc <me@berkoc.com>
> drm/hyperv: validate resolution_count and fix WIN8 fallback
>
> Alexandru Hossu <hossu.alexandru@gmail.com>
> scsi: target: iscsi: Validate CHAP_R length before base64 decode
>
> Michael Bommarito <michael.bommarito@gmail.com>
> scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf
>
> Michael Bommarito <michael.bommarito@gmail.com>
> scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()
>
> Michael Bommarito <michael.bommarito@gmail.com>
> scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32
>
> Michael Bommarito <michael.bommarito@gmail.com>
> scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker
>
> Michael Bommarito <michael.bommarito@gmail.com>
> thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow
>
> Michael Bommarito <michael.bommarito@gmail.com>
> thunderbolt: property: Reject u32 wrap in tb_property_entry_valid()
>
> Michael Bommarito <michael.bommarito@gmail.com>
> usb: gadget: f_fs: serialize DMABUF cancel against request completion
>
> Michael Bommarito <michael.bommarito@gmail.com>
> usb: gadget: f_fs: copy only received bytes on short ep0 read
>
> Seungjin Bae <eeodqql09@gmail.com>
> usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports
>
> Jeremy Erazo <mendozayt13@gmail.com>
> usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling
>
> Guangshuo Li <lgs201920130244@gmail.com>
> usb: gadget: f_hid: fix device reference leak in hidg_alloc()
>
> Guangshuo Li <lgs201920130244@gmail.com>
> usb: gadget: net2280: Fix double free in probe error path
>
> Kai Aizen <kai.aizen.dev@gmail.com>
> usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind
>
> Johan Hovold <johan@kernel.org>
> USB: serial: mct_u232: fix missing interrupt-in transfer sanity check
>
> Johan Hovold <johan@kernel.org>
> USB: serial: mxuport: fix memory corruption with small endpoint
>
> Johan Hovold <johan@kernel.org>
> USB: serial: keyspan: fix missing indat transfer sanity check
>
> Zhang Cen <rollkingzzc@gmail.com>
> USB: serial: cypress_m8: validate interrupt packet headers
>
> Zhang Cen <rollkingzzc@gmail.com>
> USB: serial: belkin_sa: validate interrupt status length
>
> Wanquan Zhong <wanquan.zhong@fibocom.com>
> USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL
>
> Jan Volckaert <janvolck@gmail.com>
> USB: serial: option: add MeiG SRM813Q
>
> Myrrh Periwinkle <myrrhperiwinkle@qtmlabs.xyz>
> usb: typec: ucsi: Don't update power_supply on power role change if not connected
>
> Myrrh Periwinkle <myrrhperiwinkle@qtmlabs.xyz>
> usb: typec: ucsi: Check if power role change actually happened before handling
>
> Sebastian Reichel <sebastian.reichel@collabora.com>
> usb: typec: tcpm: improve handling of DISCOVER_MODES failures
>
> Dan Carpenter <error27@gmail.com>
> usb: typec: tipd: Fix error code in tps6598x_probe()
>
> Heitor Alves de Siqueira <halves@igalia.com>
> usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize
>
> Heitor Alves de Siqueira <halves@igalia.com>
> usb: usbtmc: check URB actual_length for interrupt-IN notifications
>
> Michael Bommarito <michael.bommarito@gmail.com>
> usbip: vudc: Fix use after free bug in vudc_remove due to race condition
>
> Sam Burkels <sam@1a38.nl>
> usb: storage: Add quirks for PNY Elite Portable SSD
>
> Stephen J. Fuhry <fuhrysteve@gmail.com>
> USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers
>
> Wentao Liang <vulab@iscas.ac.cn>
> usb: musb: omap2430: Fix use-after-free in omap2430_probe()
>
> Michal Pecio <michal.pecio@gmail.com>
> usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval
>
> Xu Yang <xu.yang_2@nxp.com>
> usb: chipidea: core: convert ci_role_switch to local variable
>
> Tudor Ambarus <tudor.ambarus@linaro.org>
> tty: serial: samsung: Remove redundant port lock acquisition in rx helpers
>
> Zhaoyang Yu <2426767509@qq.com>
> tty: serial: pch_uart: add check for dma_alloc_coherent()
>
> Guangshuo Li <lgs201920130244@gmail.com>
> counter: Fix refcount leak in counter_alloc() error path
>
> Ian Abbott <abbotti@mev.co.uk>
> comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest()
>
> Ian Abbott <abbotti@mev.co.uk>
> comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest()
>
> Hongling Zeng <zenghongling@kylinos.cn>
> gpib: cb7210: Fix region leak when request_irq fails
>
> Nicolás Bazaes <contacto@bazaes.cl>
> Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490
>
> Dmitry Torokhov <dmitry.torokhov@gmail.com>
> Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem
>
> Xiaolei Wang <xiaolei.wang@windriver.com>
> misc: rp1: Send IACK on IRQ activate to fix kdump/kexec
>
> Ali Ganiyev <ali.qaniyev@gmail.com>
> ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops
>
> Dmitriy Zharov <contact@zharov.dev>
> Input: xpad - add support for ASUS ROG RAIKIRI II
>
> Qbeliw Tanaka <q.tanaka@gmx.com>
> Input: xpad - add "Nova 2 Lite" from GameSir
>
> Zhang Heng <zhangheng@kylinos.cn>
> ALSA: hda/realtek: Fix speaker output on ASUS ROG Strix G615LP
>
> Jingguo Tan <tanjingguo@huawei.com>
> xfrm: esp: restore combined single-frag length gate
>
> Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
> ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks
>
> Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
> ASoC: qcom: q6asm-dai: close stream only when running
>
> Hamza Mahfooz <hamzamahfooz@linux.microsoft.com>
> netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check
>
> Cássio Gabriel <cassiogabrielcontato@gmail.com>
> ALSA: firewire-motu: Protect register DSP event queue positions
>
> Geoffrey D. Bennett <g@b4.vu>
> ALSA: scarlett2: Fix 2i2 Gen 4 direct monitor gain on firmware 2417
>
> Michael Bommarito <michael.bommarito@gmail.com>
> xfrm: ah: use skb_to_full_sk in async output callbacks
>
> Herbert Xu <herbert@gondor.apana.org.au>
> xfrm: ipcomp: Free destination pages on acomp errors
>
> Maoyi Xie <maoyixie.tju@gmail.com>
> xfrm: route MIGRATE notifications to caller's netns
>
> Ashutosh Desai <ashutoshdesai993@gmail.com>
> nfc: hci: fix out-of-bounds read in HCP header parsing
>
> Arnd Bergmann <arnd@arndb.de>
> iommu, debugobjects: avoid gcc-16.1 section mismatch warnings
>
> Lee Jones <lee@kernel.org>
> HID: wacom: Fix OOB write in wacom_hid_set_device_mode()
>
> Santhosh Kumar K <s-k6@ti.com>
> spi: spi-mem: avoid mutating op template in spi_mem_supports_op()
>
> Minh Nguyen <minhnguyen.080505@gmail.com>
> net: skbuff: fix missing zerocopy reference in pskb_carve helpers
>
> Kuniyuki Iwashima <kuniyu@google.com>
> ip6: vti: Use ip6_tnl.net in vti6_changelink().
>
> Michael Bommarito <michael.bommarito@gmail.com>
> l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname
>
> Zhengchuan Liang <zcliangcn@gmail.com>
> xfrm: input: hold netns during deferred transport reinjection
>
> Qi Tang <tpluszz77@gmail.com>
> ipv6: validate extension header length before copying to cmsg
>
> Maoyi Xie <maoyixie.tju@gmail.com>
> ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().
>
> Zhengchuan Liang <zcliangcn@gmail.com>
> ipv6: exthdrs: refresh nh after handling HAO option
>
> Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
> ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params
>
> Justin Iurman <justin.iurman@gmail.com>
> ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()
>
> Junrui Luo <moonafterrain@outlook.com>
> macsec: fix replay protection at XPN lower-PN wrap
>
> Yuqi Xu <xuyq21@lenovo.com>
> bpf: sockmap: fix tail fragment offset in bpf_msg_push_data
>
> Jason A. Donenfeld <Jason@zx2c4.com>
> wireguard: send: append trailer after expanding head
>
> Alexis Lothoré (eBPF Foundation) <alexis.lothore@bootlin.com>
> x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines
>
> Chaitanya Sabnis <chaitanya.msabnis@gmail.com>
> i2c: davinci: fix division by zero on missing clock-frequency
>
> Dmitry Torokhov <dmitry.torokhov@gmail.com>
> Input: elan_i2c - validate firmware size before use
>
> Dan Carpenter <error27@gmail.com>
> usb: dwc2: Fix use after free in debug code
>
> Peter Chen <peter.chen@cixtech.com>
> usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles
>
> Peter Chen <peter.chen@cixtech.com>
> usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure
>
> Yongchao Wu <yongchao.wu@autochips.com>
> usb: cdns3: gadget: fix request skipping after clearing halt
>
> Johan Hovold <johan@kernel.org>
> USB: serial: omninet: fix memory corruption with small endpoint
>
> Benoît Monin <benoit.monin@bootlin.com>
> iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf()
>
> Felix Gu <ustc.gu@gmail.com>
> iio: buffer: hw-consumer: fix use-after-free in error path
>
> Aldo Conte <aldocontelk@gmail.com>
> iio: light: cm3323: fix reg_conf not being initialized correctly
>
> Antoniu Miclaus <antoniu.miclaus@analog.com>
> iio: chemical: scd30: fix division by zero in write_raw
>
> Pengpeng Hou <pengpeng@iscas.ac.cn>
> iio: chemical: mhz19b: reject oversized serial replies
>
> Svyatoslav Ryhel <clamor95@gmail.com>
> iio: Fix iio_multiply_value use in iio_read_channel_processed_scale
>
> Felix Gu <ustc.gu@gmail.com>
> iio: light: veml6070: Fix resource leak in probe error path
>
> Advait Dhamorikar <advaitd@mechasystems.com>
> iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL
>
> Salah Triki <salah.triki@gmail.com>
> iio: temperature: tsys01: fix broken PROM checksum validation
>
> Sanjay Chitroda <sanjayembeddedse@gmail.com>
> iio: ssp_sensors: cancel delayed work_refresh on remove
>
> Antoniu Miclaus <antoniu.miclaus@analog.com>
> iio: gyro: adis16260: fix division by zero in write_raw
>
> David Carlier <devnexen@gmail.com>
> iio: gyro: itg3200: fix i2c read into the wrong stack location
>
> Radu Sabau <radu.sabau@analog.com>
> iio: adc: ad4695: Fix call ordering in offload buffer postenable
>
> Salah Triki <salah.triki@gmail.com>
> iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw
>
> Salah Triki <salah.triki@gmail.com>
> iio: adc: mt6359: fix unchecked return value in mt6358_read_imp
>
> Rodrigo Alencar <rodrigo.alencar@analog.com>
> iio: dac: ad5686: fix powerdown control on dual-channel devices
>
> Rodrigo Alencar <rodrigo.alencar@analog.com>
> iio: dac: ad5686: acquire lock when doing powerdown control
>
> Rodrigo Alencar <rodrigo.alencar@analog.com>
> iio: dac: ad5686: fix input raw value check
>
> Rodrigo Alencar <rodrigo.alencar@analog.com>
> iio: dac: ad5686: fix ref bit initialization for single-channel parts
>
> Salah Triki <salah.triki@gmail.com>
> iio: dac: max5821: fix return value check in powerdown sync
>
> Kim Seer Paller <kimseer.paller@analog.com>
> iio: dac: ad3530r: Fix AD3531/AD3531R powerdown mode strings
>
> David Carlier <devnexen@gmail.com>
> iio: adc: npcm: fix unbalanced clk_disable_unprepare()
>
> Christofer Jonason <christofer.jonason@guidelinegeo.com>
> iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux
>
> Nathan Chancellor <nathan@kernel.org>
> Disable -Wattribute-alias for clang-23 and newer
>
> Sean Christopherson <seanjc@google.com>
> KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc()
>
> Sean Christopherson <seanjc@google.com>
> KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer
>
> Sean Christopherson <seanjc@google.com>
> KVM: SEV: Check PSC request indices against the actual size of the buffer
>
> Sean Christopherson <seanjc@google.com>
> KVM: SEV: Compute the correct max length of the in-GHCB scratch area
>
> Sean Christopherson <seanjc@google.com>
> KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0
>
> Sean Christopherson <seanjc@google.com>
> KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests
>
> Sean Christopherson <seanjc@google.com>
> KVM: SEV: Ignore Port I/O requests of length '0'
>
> Michael Roth <michael.roth@amd.com>
> KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use
>
> Sean Christopherson <seanjc@google.com>
> KVM: SVM: Flush the current TLB when transitioning from xAVIC => x2AVIC
>
> Qiang Ma <maqianga@uniontech.com>
> KVM: arm64: PMU: Preserve AArch32 counter low bits
>
> Mark Brown <broonie@kernel.org>
> KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor
>
> Wentao Guan <guanwentao@uniontech.com>
> USB: cdc-acm: Fix bit overlap and move quirk definitions to header
>
> Alice Ryhl <aliceryhl@google.com>
> rust_binder: avoid calling pending_oneway_finished() on TF_UPDATE_TXN
>
> Matthew Maurer <mmaurer@google.com>
> rust_binder: Avoid holding lock when dropping delivered_death
>
> Ben Hutchings <benh@debian.org>
> parport: Fix race between port and client registration
>
> Dmitry Torokhov <dmitry.torokhov@gmail.com>
> Input: xpad - fix out-of-bounds access for Share button
>
> Doruk Tan Ozturk <doruk@0sec.ai>
> Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync
>
> Shuai Zhang <shuai.zhang@oss.qualcomm.com>
> Bluetooth: hci_qca: Use 100 ms SSR delay for rampatch and NVM loading
>
> Pavitra Jha <jhapavitra98@gmail.com>
> Bluetooth: hci_conn: Fix memory leak in hci_le_big_terminate()
>
> Muhammad Bilal <meatuni001@gmail.com>
> Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock
>
> Muhammad Bilal <meatuni001@gmail.com>
> Bluetooth: ISO: fix UAF in iso_recv_frame
>
> Muhammad Bilal <meatuni001@gmail.com>
> Bluetooth: HIDP: fix missing length checks in hidp_input_report()
>
> Siwei Zhang <oss@fourdim.xyz>
> Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn
>
> Siwei Zhang <oss@fourdim.xyz>
> Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen()
>
> Steve French <stfrench@microsoft.com>
> smb: client: fix uninitialized variable in smb2_writev_callback
>
> Stepan Ionichev <sozdayvek@gmail.com>
> auxdisplay: line-display: fix OOB read on zero-length message_store()
>
> Dev Jain <dev.jain@arm.com>
> mm/rmap: initialize nr_pages to 1 at loop start in try_to_unmap_one
>
> Pratyush Yadav (Google) <pratyush@kernel.org>
> memfd: deny writeable mappings when implying SEAL_WRITE
>
> Alexandre Ghiti <alex@ghiti.fr>
> mm: memcontrol: propagate NMI slab stats to memcg vmstats
>
> Linpu Yu <linpu5433@gmail.com>
> ipc: limit next_id allocation to the valid ID range
>
> SeongJae Park <sj@kernel.org>
> mm/damon/sysfs-schemes: delete tried region in regions_rmdirs()
>
> Mikulas Patocka <mpatocka@redhat.com>
> hpfs: fix a crash if hpfs_map_dnode_bitmap fails
>
> Shuai Zhang <shuai.zhang@oss.qualcomm.com>
> Bluetooth: btusb: Allow firmware re-download when version matches
>
> hlleng <a909204013@gmail.com>
> HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse
>
> Thomas Fourier <fourier.thomas@gmail.com>
> Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free()
>
> Henri A <contact@henrialfonso.com>
> media: rc: igorplugusb: fix control request setup packet
>
> Johan Hovold <johan@kernel.org>
> USB: serial: safe_serial: fix memory corruption with small endpoint
>
> Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> usb: typec: ucsi: validate connector number in ucsi_connector_change()
>
> Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT
>
> Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer()
>
> Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> usb: typec: altmodes/displayport: validate count before reading Status Update VDO
>
> Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO
>
> Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes()
>
> Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers
>
> Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> usb: typec: ucsi: ccg: reject firmware images without a ':' record header
>
> Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> iio: pressure: bmp280: fix stack leak in bmp580 trigger handler
>
> Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> iio: imu: adis16550: fix stack leak in trigger handler
>
> Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer
>
> Horatiu Vultur <horatiu.vultur@microchip.com>
> phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X
>
> Jouni Högander <jouni.hogander@intel.com>
> drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used
>
> Jouni Högander <jouni.hogander@intel.com>
> drm/i915/psr: Read Intel DPCD workaround register
>
> Jouni Högander <jouni.hogander@intel.com>
> drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register
>
> Peter Oberparleiter <oberpar@linux.ibm.com>
> s390/cio: Restore GFP_DMA for CHSC allocation
>
> Andrei Vagin <avagin@google.com>
> Revert "x86/fpu: Refine and simplify the magic number check during signal return"
>
> Michael Bommarito <michael.bommarito@gmail.com>
> smb: client: validate the whole DACL before rewriting it in cifsacl
>
> Oliver Neukum <oneukum@suse.com>
> media: rc: ttusbir: fix inverted error logic
>
> Sean Young <sean@mess.org>
> media: rc: fix race between unregister and urb/irq callbacks
>
> Pavel Begunkov <asml.silence@gmail.com>
> net: skbuff: fix pskb_carve leaking zcopy pages
>
> Jiayuan Chen <jiayuan.chen@linux.dev>
> ipv6: fix possible infinite loop in fib6_select_path()
>
> Jiayuan Chen <jiayuan.chen@linux.dev>
> ipv6: fix possible infinite loop in rt6_fill_node()
>
> Jingguo Tan <tanjingguo@huawei.com>
> vsock/virtio: bind uarg before filling zerocopy skb
>
> Zhenghang Xiao <kipreyyy@gmail.com>
> sctp: fix race between sctp_wait_for_connect and peeloff
>
> Dipayaan Roy <dipayanroy@linux.microsoft.com>
> net: mana: Skip redundant detach on already-detached port
>
> Dipayaan Roy <dipayanroy@linux.microsoft.com>
> net: mana: Add NULL guards in teardown path to prevent panic on attach failure
>
> Marco Scardovi <scardracs@disroot.org>
> gpio: rockchip: teardown bugs and resource leaks
>
> Marco Scardovi <scardracs@disroot.org>
> gpio: rockchip: convert bank->clk to devm_clk_get_enabled()
>
> Dan Carpenter <error27@gmail.com>
> gpio: virtuser: Fix uninitialized data bug in gpio_virtuser_direction_do_write()
>
> Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
> gpio: adnp: fix flow control regression caused by scoped_guard()
>
> Heitor Alves de Siqueira <halves@igalia.com>
> Bluetooth: hci_sync: Reset device counters in hci_dev_close_sync()
>
> Heitor Alves de Siqueira <halves@igalia.com>
> Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close
>
> Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp
>
> Zhenghang Xiao <kipreyyy@gmail.com>
> Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success
>
> Chuck Lever <chuck.lever@oracle.com>
> net/handshake: Pass negative errno through handshake_complete()
>
> Chuck Lever <chuck.lever@oracle.com>
> nvme-tcp: store negative errno in queue->tls_err
>
> Chuck Lever <chuck.lever@oracle.com>
> net/handshake: Use spin_lock_bh for hn_lock
>
> Jijie Shao <shaojijie@huawei.com>
> net: hibmcge: disable Relaxed Ordering to fix RX packet corruption
>
> Jamal Hadi Salim <jhs@mojatatu.com>
> net/sched: Revert "net/sched: Restrict conditions for adding duplicating netems to qdisc tree"
>
> Rahul Chandelkar <rc@rexion.ai>
> ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()
>
> Jakub Kicinski <kuba@kernel.org>
> ethtool: eeprom: add more safeties to EEPROM Netlink fallback
>
> Jakub Kicinski <kuba@kernel.org>
> ethtool: eeprom: add missing ethnl_ops_begin() / _complete() during fallback
>
> Jakub Kicinski <kuba@kernel.org>
> ethtool: strset: fix header attribute index in ethnl_req_get_phydev()
>
> Jakub Kicinski <kuba@kernel.org>
> ethtool: tsinfo: don't pass ERR_PTR to genlmsg_cancel on prepare failure
>
> Jakub Kicinski <kuba@kernel.org>
> ethtool: tsinfo: fix uninitialized stats on the by-PHC path
>
> Jakub Kicinski <kuba@kernel.org>
> ethtool: tsconfig: fix missing ethnl_ops_complete()
>
> Jakub Kicinski <kuba@kernel.org>
> ethtool: pse-pd: fix missing ethnl_ops_complete()
>
> Jakub Kicinski <kuba@kernel.org>
> ethtool: linkstate: fix unbalanced ethnl_ops_complete() on PHY lookup error
>
> Jakub Kicinski <kuba@kernel.org>
> ethtool: tsconfig: fix reply error handling
>
> Jakub Kicinski <kuba@kernel.org>
> ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES
>
> Ido Schimmel <idosch@nvidia.com>
> bridge: Fix sleep in atomic context in sysfs path
>
> Ido Schimmel <idosch@nvidia.com>
> bridge: Fix sleep in atomic context in netlink path
>
> Oliver Hartkopp <socketcan@hartkopp.net>
> bonding: refuse to enslave CAN devices
>
> Zhao Dongdong <zhaodongdong@kylinos.cn>
> Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt()
>
> Balasubramani Vivekanandan <balasubramani.vivekanandan@intel.com>
> drm/xe: Restore IDLEDLY regiter on engine reset
>
> Cássio Gabriel <cassiogabrielcontato@gmail.com>
> ASoC: codecs: simple-mux: Fix enum control bounds check
>
> Sean Shen <grayhat@foxmail.com>
> ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE
>
> Eric Dumazet <edumazet@google.com>
> tunnels: do not assume transport header in iptunnel_pmtud_check_icmp()
>
> Eric Dumazet <edumazet@google.com>
> vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()
>
> Eric Dumazet <edumazet@google.com>
> tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]()
>
> Li Ming <ming.li@zohomail.com>
> cxl/test: Update mock dev array before calling platform_device_add()
>
> Jakub Kicinski <kuba@kernel.org>
> ethtool: cmis: validate fw->size against start_cmd_payload_size
>
> Jakub Kicinski <kuba@kernel.org>
> ethtool: cmis: validate start_cmd_payload_size from module
>
> Jakub Kicinski <kuba@kernel.org>
> ethtool: cmis: fix u16-to-u8 truncation of msleep_pre_rpl
>
> Jakub Kicinski <kuba@kernel.org>
> ethtool: cmis: require exact CDB reply length
>
> Jakub Kicinski <kuba@kernel.org>
> ethtool: module: fix cleanup if socket used for flashing multiple devices
>
> Jakub Kicinski <kuba@kernel.org>
> ethtool: module: check fw_flash_in_progress under rtnl_lock
>
> Jakub Kicinski <kuba@kernel.org>
> ethtool: module: avoid racy updates to dev->ethtool bitfield
>
> Jakub Kicinski <kuba@kernel.org>
> ethtool: module: avoid leaking a netdev ref on module flash errors
>
> Jakub Kicinski <kuba@kernel.org>
> ethtool: module: call ethnl_ops_complete() on module flash errors
>
> Jakub Kicinski <kuba@kernel.org>
> ethtool: rss: avoid device context leak on reply-build failure
>
> Jakub Kicinski <kuba@kernel.org>
> ethtool: rss: fix hkey leak when indir_size is 0
>
> Jakub Kicinski <kuba@kernel.org>
> ethtool: rss: fix indir_table and hkey leak on get_rxfh failure
>
> Jakub Kicinski <kuba@kernel.org>
> ethtool: rss: fix falsely ignoring indir table updates
>
> Jakub Kicinski <kuba@kernel.org>
> ethtool: rss: add missing errno on RSS context delete
>
> Jakub Kicinski <kuba@kernel.org>
> ethtool: rss: avoid modifying the RSS context response
>
> Björn Töpel <bjorn@kernel.org>
> net: Avoid checksumming unreadable skb tail on trim
>
> Weiming Shi <bestswngs@gmail.com>
> net: team: fix NULL pointer dereference in team_xmit during mode change
>
> Marc Harvey <marcharvey@google.com>
> net: team: Rename port_disabled team mode op to port_tx_disabled
>
> Marc Harvey <marcharvey@google.com>
> net: team: Remove unused team_mode_op, port_enabled
>
> Alexander Stein <alexander.stein@ew.tq-group.com>
> gpio: mxc: fix irq_high handling
>
> Luka Gejak <luka.gejak@linux.dev>
> net: hsr: fix potential OOB access in supervision frame handling
>
> Prathamesh Deshpande <prathameshdeshpande7@gmail.com>
> net/mlx5: HWS: Reject unsupported remove-header action
>
> Cássio Gabriel <cassiogabrielcontato@gmail.com>
> ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors
>
> Cássio Gabriel <cassiogabrielcontato@gmail.com>
> ALSA: pcm: oss: Fix setup list UAF on proc write error
>
> Eric Dumazet <edumazet@google.com>
> ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()
>
> David Jeffery <djeffery@redhat.com>
> scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues
>
> Breno Leitao <leitao@debian.org>
> net/iucv: fix locking in .getsockopt
>
> Alexandra Winter <wintera@linux.ibm.com>
> net/smc: Do not re-initialize smc hashtables
>
> Ilya Maximets <i.maximets@ovn.org>
> net: netlink: don't set nsid on local notifications
>
> Ilya Maximets <i.maximets@ovn.org>
> net: netlink: fix sending unassigned nsid after assigned one
>
> Ziyu Zhang <ziyuzhang201@gmail.com>
> vsock: keep poll shutdown state consistent
>
> Weiming Shi <bestswngs@gmail.com>
> tun: free page on build_skb failure in tun_xdp_one()
>
> Weiming Shi <bestswngs@gmail.com>
> tun: free page on short-frame rejection in tun_xdp_one()
>
> Fernando Fernandez Mancera <fmancera@suse.de>
> netfilter: nf_tables: fix dst corruption in same register operation
>
> Florian Westphal <fw@strlen.de>
> netfilter: ebtables: fix OOB read in compat_mtw_from_user
>
> Florian Westphal <fw@strlen.de>
> netfilter: xt_cpu: prefer raw_smp_processor_id
>
> Chris Mason <clm@meta.com>
> netfilter: synproxy: refresh tcphdr after skb_ensure_writable
>
> Deepanshu Kartikey <kartikey406@gmail.com>
> kernel/fork: validate exit_signal in kernel_clone()
>
> Dhabaleshwar Das <dhabal123@gmail.com>
> accel/rocket: fix UAF via dangling GEM handle in create_bo
>
> Florian Schmaus <florian.schmaus@codasip.com>
> kunit: fix use-after-free in debugfs when using kunit.filter
>
> Liu Kai <lukace97@outlook.com>
> HID: remove duplicate hid_warn_ratelimited definition
>
> Hongtao Lee <lihongtao@kylinos.cn>
> tools/bootconfig: Fix buf leaks in apply_xbc
>
> Carl Lee <carl.lee@amd.com>
> nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems
>
> David Ahern <dahern@nvidia.com>
> xfrm: Check for underflow in xfrm_state_mtu
>
> Lee Jones <lee@kernel.org>
> nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc()
>
> Lee Jones <lee@kernel.org>
> nfc: llcp: Fix use-after-free in llcp_sock_release()
>
> Mingzhe Zou <mingzhe.zou@easystack.cn>
> bcache: fix uninitialized closure object
>
> Victor Nogueria <victor@mojatatu.com>
> net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked
>
> Usama Arif <usama.arif@linux.dev>
> xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit
>
> Jeremy Kerr <jk@codeconstruct.com.au>
> net: mctp: ensure our nlmsg responses are initialised
>
> Davide Caratti <dcaratti@redhat.com>
> net/sched: cls_fw: fix NULL dereference of "old" filters before change()
>
> Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size
>
>
> -------------
>
> Diffstat:
>
> Documentation/netlink/specs/handshake.yaml | 8 +
> Makefile | 4 +-
> arch/arm64/include/asm/kvm_host.h | 2 +-
> arch/arm64/include/asm/tlb.h | 2 +-
> arch/arm64/kvm/hyp/include/hyp/switch.h | 16 +-
> arch/arm64/kvm/nested.c | 5 +
> arch/arm64/kvm/pmu-emul.c | 4 +-
> arch/arm64/kvm/sys_regs.c | 11 +-
> arch/mips/dec/platform.c | 109 ++++++++++-
> arch/riscv/include/asm/syscall_wrapper.h | 4 +
> arch/x86/kernel/cpu/cpuid-deps.c | 1 +
> arch/x86/kernel/fpu/signal.c | 11 +-
> arch/x86/kernel/ftrace.c | 7 +
> arch/x86/kvm/svm/avic.c | 35 +++-
> arch/x86/kvm/svm/sev.c | 76 ++++---
> drivers/accel/rocket/rocket_gem.c | 17 +-
> drivers/android/binder/allocation.rs | 8 +
> drivers/android/binder/process.rs | 7 +-
> drivers/android/binder/transaction.rs | 11 +-
> drivers/auxdisplay/line-display.c | 2 +-
> drivers/bluetooth/btusb.c | 8 +-
> drivers/bluetooth/hci_qca.c | 42 ++--
> drivers/comedi/drivers/comedi_test.c | 5 +-
> drivers/counter/counter-core.c | 3 +-
> drivers/cpufreq/intel_pstate.c | 13 +-
> drivers/gpio/gpio-adnp.c | 4 +-
> drivers/gpio/gpio-mxc.c | 2 +-
> drivers/gpio/gpio-rockchip.c | 23 ++-
> drivers/gpio/gpio-virtuser.c | 4 +-
> drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 11 +-
> drivers/gpu/drm/amd/amdgpu/amdgpu_hmm.c | 1 +
> drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 7 +-
> drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 10 +-
> .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 8 +-
> drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 3 +
> drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 4 +
> drivers/gpu/drm/bridge/sil-sii8620.c | 1 +
> drivers/gpu/drm/drm_gem.c | 2 +
> drivers/gpu/drm/hyperv/hyperv_drm_proto.c | 113 +++++++++--
> drivers/gpu/drm/i915/display/intel_display_core.h | 1 +
> drivers/gpu/drm/i915/display/intel_display_irq.c | 8 +-
> drivers/gpu/drm/i915/display/intel_display_types.h | 3 +
> drivers/gpu/drm/i915/display/intel_dpcd.h | 15 ++
> drivers/gpu/drm/i915/display/intel_psr.c | 60 ++++--
> drivers/gpu/drm/i915/gem/i915_gem_ttm.c | 28 +--
> drivers/gpu/drm/xe/xe_guc_ads.c | 5 +
> drivers/hid/hid-ids.h | 1 +
> drivers/hid/hid-picolcd_cir.c | 1 +
> drivers/hid/hid-quirks.c | 1 +
> drivers/hid/wacom_sys.c | 13 +-
> drivers/hid/wacom_wac.h | 1 +
> drivers/hwmon/pmbus/adm1266.c | 7 +
> drivers/hwmon/pmbus/pmbus.h | 5 +
> drivers/hwmon/pmbus/pmbus_core.c | 8 +
> drivers/i2c/busses/i2c-davinci.c | 2 +-
> drivers/iio/adc/ad4695.c | 23 +--
> drivers/iio/adc/mt6359-auxadc.c | 1 +
> drivers/iio/adc/npcm_adc.c | 25 +--
> drivers/iio/adc/viperboard_adc.c | 4 +-
> drivers/iio/adc/xilinx-xadc-core.c | 11 +-
> drivers/iio/buffer/industrialio-hw-consumer.c | 4 +-
> drivers/iio/chemical/mhz19b.c | 17 ++
> drivers/iio/chemical/scd30_core.c | 2 +-
> drivers/iio/common/ssp_sensors/ssp_dev.c | 1 +
> drivers/iio/dac/ad3530r.c | 54 +++--
> drivers/iio/dac/ad5686.c | 56 ++++--
> drivers/iio/dac/ad5686.h | 1 +
> drivers/iio/dac/max5821.c | 9 +-
> drivers/iio/gyro/adis16260.c | 3 +
> drivers/iio/gyro/itg3200_buffer.c | 2 +-
> drivers/iio/imu/adis16550.c | 2 +-
> drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c | 2 +-
> drivers/iio/industrialio-buffer.c | 1 +
> drivers/iio/inkern.c | 6 +-
> drivers/iio/light/cm3323.c | 5 +-
> drivers/iio/light/veml6070.c | 14 +-
> drivers/iio/magnetometer/st_magn_core.c | 13 +-
> drivers/iio/pressure/bmp280-core.c | 2 +-
> drivers/iio/temperature/tsys01.c | 2 +-
> drivers/input/joystick/xpad.c | 14 +-
> drivers/input/misc/ims-pcu.c | 2 +-
> drivers/input/mouse/elan_i2c_core.c | 5 +
> drivers/input/mouse/synaptics.c | 1 +
> drivers/input/touchscreen/atmel_mxt_ts.c | 2 +-
> drivers/input/touchscreen/usbtouchscreen.c | 5 +
> drivers/iommu/io-pgtable-arm-v7s.c | 18 +-
> drivers/mailbox/mailbox.c | 15 +-
> drivers/mailbox/tegra-hsp.c | 2 +-
> drivers/md/bcache/super.c | 3 +-
> drivers/media/cec/core/cec-core.c | 2 +-
> drivers/media/common/siano/smsir.c | 1 +
> drivers/media/i2c/ir-kbd-i2c.c | 2 +
> drivers/media/pci/bt8xx/bttv-input.c | 3 +-
> drivers/media/pci/cx23885/cx23885-input.c | 1 +
> drivers/media/pci/cx88/cx88-input.c | 3 +-
> drivers/media/pci/dm1105/dm1105.c | 1 +
> drivers/media/pci/mantis/mantis_input.c | 1 +
> drivers/media/pci/saa7134/saa7134-input.c | 1 +
> drivers/media/pci/smipcie/smipcie-ir.c | 1 +
> drivers/media/pci/ttpci/budget-ci.c | 1 +
> drivers/media/rc/ati_remote.c | 6 +-
> drivers/media/rc/ene_ir.c | 2 +-
> drivers/media/rc/fintek-cir.c | 3 +-
> drivers/media/rc/igorplugusb.c | 3 +-
> drivers/media/rc/iguanair.c | 1 +
> drivers/media/rc/img-ir/img-ir-hw.c | 3 +-
> drivers/media/rc/img-ir/img-ir-raw.c | 3 +-
> drivers/media/rc/imon.c | 3 +-
> drivers/media/rc/ir-hix5hd2.c | 2 +-
> drivers/media/rc/ir_toy.c | 1 +
> drivers/media/rc/ite-cir.c | 2 +-
> drivers/media/rc/mceusb.c | 1 +
> drivers/media/rc/rc-ir-raw.c | 5 -
> drivers/media/rc/rc-loopback.c | 1 +
> drivers/media/rc/rc-main.c | 6 +-
> drivers/media/rc/redrat3.c | 4 +-
> drivers/media/rc/st_rc.c | 2 +-
> drivers/media/rc/streamzap.c | 7 +-
> drivers/media/rc/sunxi-cir.c | 1 +
> drivers/media/rc/ttusbir.c | 4 +-
> drivers/media/rc/winbond-cir.c | 2 +-
> drivers/media/rc/xbox_remote.c | 5 +-
> drivers/media/usb/au0828/au0828-input.c | 1 +
> drivers/media/usb/dvb-usb-v2/dvb_usb_core.c | 1 +
> drivers/media/usb/dvb-usb/dvb-usb-remote.c | 6 +-
> drivers/media/usb/em28xx/em28xx-input.c | 1 +
> drivers/misc/rp1/rp1_pci.c | 1 +
> drivers/net/bonding/bond_main.c | 6 +
> drivers/net/ethernet/hisilicon/hibmcge/hbg_main.c | 3 +
> .../ethernet/marvell/octeontx2/nic/otx2_common.c | 2 +
> .../mellanox/mlx5/core/steering/hws/fs_hws.c | 4 +-
> drivers/net/ethernet/microsoft/mana/mana_en.c | 78 +++++---
> drivers/net/macsec.c | 3 +-
> drivers/net/phy/micrel.c | 15 +-
> drivers/net/phy/mscc/mscc.h | 8 +-
> drivers/net/phy/mscc/mscc_main.c | 23 +--
> drivers/net/team/team_core.c | 51 +++--
> drivers/net/team/team_mode_loadbalance.c | 4 +-
> drivers/net/tun.c | 5 +-
> drivers/net/vxlan/vxlan_core.c | 4 +-
> drivers/net/wireguard/send.c | 20 +-
> drivers/nfc/nxp-nci/i2c.c | 21 +-
> drivers/nvme/host/tcp.c | 2 +-
> drivers/parport/share.c | 11 +-
> drivers/platform/x86/intel/vsec.c | 91 ++++-----
> drivers/s390/cio/chsc.c | 4 +-
> drivers/s390/cio/chsc_sch.c | 20 +-
> drivers/s390/cio/scm.c | 2 +-
> drivers/scsi/fcoe/fcoe_ctlr.c | 2 +-
> drivers/scsi/scsi_lib.c | 27 ++-
> drivers/scsi/scsi_transport_fc.c | 77 ++++----
> drivers/spi/spi-mem.c | 15 +-
> drivers/staging/gpib/cb7210/cb7210.c | 10 +-
> drivers/staging/media/av7110/av7110_ir.c | 1 +
> drivers/target/iscsi/iscsi_target.c | 5 +-
> drivers/target/iscsi/iscsi_target_auth.c | 19 +-
> drivers/target/iscsi/iscsi_target_nego.c | 7 +-
> drivers/target/iscsi/iscsi_target_parameters.c | 62 ++++--
> drivers/target/iscsi/iscsi_target_parameters.h | 2 +-
> drivers/thunderbolt/property.c | 32 ++-
> drivers/tty/serdev/core.c | 21 ++
> drivers/tty/serial/8250/8250_dw.c | 2 +-
> drivers/tty/serial/8250/8250_port.c | 7 +-
> drivers/tty/serial/altera_jtaguart.c | 7 +-
> drivers/tty/serial/dz.c | 171 ++++++++--------
> drivers/tty/serial/fsl_lpuart.c | 15 +-
> drivers/tty/serial/pch_uart.c | 19 +-
> drivers/tty/serial/qcom_geni_serial.c | 16 +-
> drivers/tty/serial/samsung_tty.c | 8 -
> drivers/tty/serial/sh-sci.c | 2 +-
> drivers/tty/serial/zs.c | 218 ++++++++-------------
> drivers/tty/serial/zs.h | 1 -
> drivers/usb/cdns3/cdns3-gadget.c | 12 +-
> drivers/usb/cdns3/cdns3-plat.c | 11 +-
> drivers/usb/chipidea/core.c | 16 +-
> drivers/usb/class/cdc-acm.c | 2 -
> drivers/usb/class/cdc-acm.h | 2 +
> drivers/usb/class/usbtmc.c | 14 ++
> drivers/usb/core/config.c | 9 +-
> drivers/usb/core/quirks.c | 4 +
> drivers/usb/dwc2/hcd.c | 4 +-
> drivers/usb/dwc3/dwc3-xilinx.c | 27 +--
> drivers/usb/gadget/composite.c | 5 +-
> drivers/usb/gadget/function/f_fs.c | 26 ++-
> drivers/usb/gadget/function/f_hid.c | 3 +-
> drivers/usb/gadget/function/f_uvc.c | 28 ++-
> drivers/usb/gadget/udc/dummy_hcd.c | 4 +
> drivers/usb/gadget/udc/net2280.c | 4 +-
> drivers/usb/host/xhci-tegra.c | 77 ++++----
> drivers/usb/musb/omap2430.c | 3 +-
> drivers/usb/serial/belkin_sa.c | 3 +
> drivers/usb/serial/cypress_m8.c | 20 +-
> drivers/usb/serial/digi_acceleport.c | 23 ++-
> drivers/usb/serial/keyspan.c | 4 +
> drivers/usb/serial/mct_u232.c | 26 ++-
> drivers/usb/serial/mxuport.c | 8 +
> drivers/usb/serial/omninet.c | 9 +-
> drivers/usb/serial/option.c | 9 +-
> drivers/usb/serial/safe_serial.c | 11 ++
> drivers/usb/storage/unusual_uas.h | 7 +
> drivers/usb/typec/altmodes/displayport.c | 2 +
> drivers/usb/typec/tcpm/tcpci_maxim_core.c | 9 +
> drivers/usb/typec/tcpm/tcpm.c | 117 ++++++-----
> drivers/usb/typec/tcpm/wcove.c | 13 +-
> drivers/usb/typec/tipd/core.c | 1 +
> drivers/usb/typec/ucsi/displayport.c | 4 +
> drivers/usb/typec/ucsi/ucsi.c | 24 ++-
> drivers/usb/typec/ucsi/ucsi_ccg.c | 5 +
> drivers/usb/usbip/vudc_dev.c | 1 +
> drivers/usb/usbip/vudc_transfer.c | 3 +-
> fs/hpfs/alloc.c | 2 +-
> fs/smb/client/cifsacl.c | 116 ++++++++---
> fs/smb/client/smb2pdu.c | 2 +-
> fs/smb/server/smb2pdu.c | 11 ++
> fs/smb/server/smbacl.c | 8 +-
> include/kunit/test.h | 1 +
> include/linux/compat.h | 4 +
> include/linux/compiler-clang.h | 6 +
> include/linux/compiler_attributes.h | 11 ++
> include/linux/compiler_types.h | 4 +
> include/linux/hid.h | 2 -
> include/linux/if_team.h | 3 +-
> include/linux/intel_vsec.h | 4 +-
> include/linux/mailbox_controller.h | 3 +
> include/linux/parport.h | 1 +
> include/linux/serdev.h | 1 +
> include/linux/serial_core.h | 12 ++
> include/linux/syscalls.h | 4 +
> include/media/rc-core.h | 2 -
> include/net/netfilter/nf_tables.h | 7 +
> include/net/xfrm.h | 3 +-
> ipc/util.c | 2 +-
> kernel/fork.c | 11 +-
> lib/debugobjects.c | 2 +-
> lib/kunit/executor.c | 19 +-
> lib/kunit/test.c | 1 +
> mm/damon/sysfs-schemes.c | 8 +-
> mm/memcontrol.c | 6 +
> mm/memfd.c | 12 +-
> mm/rmap.c | 2 +
> mm/slab_common.c | 2 +
> mm/slub.c | 1 +
> net/bluetooth/6lowpan.c | 2 +
> net/bluetooth/hci_conn.c | 4 +-
> net/bluetooth/hci_sync.c | 16 +-
> net/bluetooth/hidp/core.c | 23 ++-
> net/bluetooth/iso.c | 12 +-
> net/bluetooth/l2cap_core.c | 41 +++-
> net/bluetooth/l2cap_sock.c | 16 +-
> net/bridge/br_netlink.c | 17 +-
> net/bridge/br_switchdev.c | 1 -
> net/bridge/br_sysfs_if.c | 30 ++-
> net/bridge/netfilter/ebtables.c | 30 +++
> net/core/devmem.c | 11 ++
> net/core/filter.c | 2 +-
> net/core/skbuff.c | 45 ++++-
> net/ethtool/cmis.h | 4 +-
> net/ethtool/cmis_cdb.c | 9 +-
> net/ethtool/cmis_fw_update.c | 44 +++--
> net/ethtool/coalesce.c | 6 +
> net/ethtool/eeprom.c | 10 +-
> net/ethtool/linkstate.c | 6 +-
> net/ethtool/module.c | 41 ++--
> net/ethtool/netlink.c | 4 +-
> net/ethtool/netlink.h | 4 +-
> net/ethtool/pse-pd.c | 10 +-
> net/ethtool/rss.c | 37 ++--
> net/ethtool/strset.c | 2 +-
> net/ethtool/tsconfig.c | 15 +-
> net/ethtool/tsinfo.c | 19 +-
> net/handshake/genl.c | 3 +-
> net/handshake/genl.h | 1 +
> net/handshake/handshake-test.c | 2 +-
> net/handshake/handshake.h | 4 +-
> net/handshake/netlink.c | 6 +-
> net/handshake/request.c | 16 +-
> net/handshake/tlshd.c | 6 +-
> net/hsr/hsr_forward.c | 4 +-
> net/ipv4/ah4.c | 2 +-
> net/ipv4/esp4.c | 4 +-
> net/ipv4/ip_tunnel_core.c | 22 ++-
> net/ipv4/sysctl_net_ipv4.c | 2 +-
> net/ipv6/ah6.c | 2 +-
> net/ipv6/datagram.c | 54 ++++-
> net/ipv6/esp6.c | 4 +-
> net/ipv6/exthdrs.c | 6 +-
> net/ipv6/ip6_vti.c | 23 ++-
> net/ipv6/route.c | 5 +
> net/iucv/af_iucv.c | 20 +-
> net/key/af_key.c | 6 +-
> net/l2tp/l2tp_core.c | 11 +-
> net/mctp/device.c | 1 +
> net/mctp/neigh.c | 1 +
> net/mctp/route.c | 1 +
> net/mptcp/fastopen.c | 4 +-
> net/mptcp/mib.c | 1 -
> net/mptcp/mib.h | 1 -
> net/mptcp/protocol.c | 65 ++++--
> net/mptcp/protocol.h | 31 ++-
> net/mptcp/subflow.c | 8 +-
> net/netfilter/nf_conntrack_proto_tcp.c | 3 +-
> net/netfilter/nf_synproxy_core.c | 2 +
> net/netfilter/nft_bitwise.c | 18 +-
> net/netfilter/nft_byteorder.c | 13 +-
> net/netfilter/xt_cpu.c | 2 +-
> net/netlink/af_netlink.c | 11 +-
> net/nfc/hci/core.c | 10 +
> net/nfc/llcp_core.c | 11 ++
> net/nfc/llcp_sock.c | 2 +
> net/nfc/nci/hci.c | 10 +
> net/rxrpc/ar-internal.h | 14 +-
> net/rxrpc/call_event.c | 22 +--
> net/rxrpc/call_object.c | 2 +
> net/rxrpc/conn_event.c | 30 ++-
> net/rxrpc/insecure.c | 8 +-
> net/rxrpc/recvmsg.c | 68 +++++--
> net/rxrpc/rxgk.c | 147 ++++++--------
> net/rxrpc/rxgk_app.c | 46 ++---
> net/rxrpc/rxgk_common.h | 66 +++----
> net/rxrpc/rxkad.c | 115 ++++-------
> net/sched/cls_fw.c | 6 +-
> net/sched/sch_netem.c | 40 ----
> net/sched/sch_sfb.c | 2 +-
> net/sctp/socket.c | 2 +
> net/smc/af_smc.c | 4 +-
> net/vmw_vsock/af_vsock.c | 49 +++--
> net/vmw_vsock/hyperv_transport.c | 9 +-
> net/vmw_vsock/virtio_transport_common.c | 26 ++-
> net/vmw_vsock/vmci_transport.c | 8 +-
> net/xfrm/xfrm_input.c | 16 +-
> net/xfrm/xfrm_ipcomp.c | 12 +-
> net/xfrm/xfrm_iptfs.c | 29 ++-
> net/xfrm/xfrm_policy.c | 17 +-
> net/xfrm/xfrm_state.c | 23 ++-
> net/xfrm/xfrm_user.c | 5 +-
> sound/core/oss/pcm_oss.c | 18 +-
> .../motu/motu-register-dsp-message-parser.c | 11 +-
> sound/hda/codecs/realtek/alc269.c | 1 +
> sound/soc/codecs/simple-mux.c | 2 +-
> sound/soc/intel/boards/bytcht_es8316.c | 29 ++-
> sound/soc/qcom/qdsp6/q6asm-dai.c | 43 ++--
> sound/usb/mixer_scarlett2.c | 33 +++-
> tools/bootconfig/main.c | 4 +-
> tools/testing/cxl/test/cxl.c | 105 ++++------
> tools/testing/selftests/net/mptcp/mptcp_connect.sh | 6 +-
> tools/testing/selftests/net/mptcp/mptcp_lib.sh | 10 +-
> 346 files changed, 3284 insertions(+), 1733 deletions(-)
>
>
--
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH 6.18 000/315] 6.18.35-rc1 review
2026-06-07 9:56 [PATCH 6.18 000/315] 6.18.35-rc1 review Greg Kroah-Hartman
2026-06-07 16:58 ` Pavel Machek
@ 2026-06-07 17:04 ` Miguel Ojeda
2026-06-07 20:40 ` Peter Schneider
` (3 subsequent siblings)
5 siblings, 0 replies; 9+ messages in thread
From: Miguel Ojeda @ 2026-06-07 17:04 UTC (permalink / raw)
To: gregkh
Cc: achill, akpm, broonie, conor, f.fainelli, hargar, jonathanh,
linux-kernel, linux, lkft-triage, patches, patches, pavel,
rwarsow, shuah, sr, stable, sudipm.mukherjee, torvalds,
Miguel Ojeda, Marc Zyngier, Joey Gouly, Suzuki K Poulose,
Oliver Upton, Zenghui Yu, Fuad Tabba, Will Deacon,
Catalin Marinas, Steffen Eiden, Mark Rutland, kvmarm,
linux-arm-kernel, kvm
On Sun, 07 Jun 2026 11:56:27 +0200 Greg Kroah-Hartman <gregkh@linuxfoundation.org> wrote:
>
> This is the start of the stable review cycle for the 6.18.35 release.
> There are 315 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Tue, 09 Jun 2026 09:56:45 +0000.
> Anything received after that time might be too late.
Boot-tested under QEMU for Rust x86_64, arm64 and riscv64; built-tested
for loongarch64:
Tested-by: Miguel Ojeda <ojeda@kernel.org>
arm32 builds fine too.
However, on arm64 I am seeing:
arch/arm64/kvm/nested.c:1776:2: error: use of undeclared identifier 'resx'
1776 | resx.res0 = ZCR_ELx_RES0 | GENMASK_ULL(8, 4);
| ^
arch/arm64/kvm/nested.c:1777:2: error: use of undeclared identifier 'resx'
1777 | resx.res1 = ZCR_ELx_RES1;
| ^
arch/arm64/kvm/nested.c:1778:33: error: use of undeclared identifier 'resx'
1778 | set_sysreg_masks(kvm, ZCR_EL2, resx);
| ^
Due to commit 10206eaad1b9 ("KVM: arm64: Correctly cap ZCR_EL2 provided
by a guest hypervisor") here.
`resx` indeed doesn't exist, and it seems like it was added by commits
0879478913dd ("KVM: arm64: Introduce data structure tracking both RES0
and RES1 bits") etc., which are in 7.0, from this series:
https://lore.kernel.org/all/20260202184329.2724080-1-maz@kernel.org/
So either we make a targeted backport or backport some commits, no?
I hope that help!
Cc: Mark Brown <broonie@kernel.org>
Cc: Marc Zyngier <maz@kernel.org>
Cc: Joey Gouly <joey.gouly@arm.com>
Cc: Suzuki K Poulose <suzuki.poulose@arm.com>
Cc: Oliver Upton <oupton@kernel.org>
Cc: Zenghui Yu <yuzenghui@huawei.com>
Cc: Fuad Tabba <tabba@google.com>
Cc: Will Deacon <will@kernel.org>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Steffen Eiden <seiden@linux.ibm.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: kvmarm@lists.linux.dev
Cc: linux-arm-kernel@lists.infradead.org
Cc: kvm@vger.kernel.org
Cheers,
Miguel
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH 6.18 000/315] 6.18.35-rc1 review
2026-06-07 9:56 [PATCH 6.18 000/315] 6.18.35-rc1 review Greg Kroah-Hartman
2026-06-07 16:58 ` Pavel Machek
2026-06-07 17:04 ` Miguel Ojeda
@ 2026-06-07 20:40 ` Peter Schneider
2026-06-08 4:03 ` Wentao Guan
` (2 subsequent siblings)
5 siblings, 0 replies; 9+ messages in thread
From: Peter Schneider @ 2026-06-07 20:40 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee,
rwarsow, conor, hargar, broonie, achill, sr
Am 07.06.2026 um 11:56 schrieb Greg Kroah-Hartman:
> This is the start of the stable review cycle for the 6.18.35 release.
> There are 315 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
Builds, boots and works on my 2-socket Ivy Bridge Xeon E5-2697 v2 server. No dmesg oddities or regressions found.
Tested-by: Peter Schneider <pschneider1968@googlemail.com>
Beste Grüße,
Peter Schneider
--
Climb the mountain not to plant your flag, but to embrace the challenge,
enjoy the air and behold the view. Climb it so you can see the world,
not so the world can see you. -- David McCullough Jr.
OpenPGP: 0xA3828BD796CCE11A8CADE8866E3A92C92C3FF244
Download: https://www.peters-netzplatz.de/download/pschneider1968_pub.asc
https://keys.mailvelope.com/pks/lookup?op=get&search=pschneider1968@googlemail.com
https://keys.mailvelope.com/pks/lookup?op=get&search=pschneider1968@gmail.com
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH 6.18 000/315] 6.18.35-rc1 review
2026-06-07 9:56 [PATCH 6.18 000/315] 6.18.35-rc1 review Greg Kroah-Hartman
` (2 preceding siblings ...)
2026-06-07 20:40 ` Peter Schneider
@ 2026-06-08 4:03 ` Wentao Guan
2026-06-08 6:46 ` Ron Economos
2026-06-08 10:57 ` Florian Fainelli
5 siblings, 0 replies; 9+ messages in thread
From: Wentao Guan @ 2026-06-08 4:03 UTC (permalink / raw)
To: gregkh
Cc: achill, akpm, broonie, conor, f.fainelli, hargar, jonathanh,
linux-kernel, linux, lkft-triage, patches, patches, pavel,
rwarsow, shuah, sr, stable, sudipm.mukherjee, torvalds,
Wentao Guan
Build tested in our x86,loongarch,riscv config successfully without error.
Tested-by: Wentao Guan <guanwentao@uniontech.com>
NOTE: Revert "KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor" which reported by
Marc Zyngier <maz@kernel.org> applied and arm64 built ok.
Link: https://lore.kernel.org/stable/87y0gq8cov.wl-maz@kernel.org/
BRs
Wentao Guan
defconfigs:
https://gist.github.com/opsiff/a840ae9e3d6857f5b7bacb9cdc49f8e9
Log:
Linux version 6.18.35-rc1-g24a2e29b003c (guanwentao@uos-PC) (aarch64-linux-gnu-gcc-12 (Deepin 12.3.0-17deepin8) 12.3.0, GNU ld (GNU Binutils for Deepin) 2.41) # SMP PREEMPT_DYNAMIC
Linux version 6.18.35-rc1-g24a2e29b003c (guanwentao@uos-PC) (aarch64-linux-gnu-gcc-12 (Deepin 12.3.0-17deepin8) 12.3.0, GNU ld (GNU Binutils for Deepin) 2.41) #2 SMP PREEMPT_DYNAMIC Mon Jun 8 09:47:30 CST 2026
Linux version 6.18.35-rc1-ga392253fde81 (guanwentao@uos-PC) (loongarch64-linux-gnu-gcc-12 (Deepin 12.3.0-17deepin8) 12.3.0, GNU ld (GNU Binutils for Deepin) 2.41) # SMP PREEMPT_DYNAMIC
Linux version 6.18.35-rc1-ga392253fde81 (guanwentao@uos-PC) (loongarch64-linux-gnu-gcc-12 (Deepin 12.3.0-17deepin8) 12.3.0, GNU ld (GNU Binutils for Deepin) 2.41) #5 SMP PREEMPT_DYNAMIC Mon Jun 8 11:23:18 CST 2026
Linux version 6.18.35-rc1+ (guanwentao@uos-PC) (riscv64-linux-gnu-gcc-12 (Deepin 12.3.0-17deepin8) 12.3.0, GNU ld (GNU Binutils for Deepin) 2.41) # SMP PREEMPT
Linux version 6.18.35-rc1+ (guanwentao@uos-PC) (riscv64-linux-gnu-gcc-12 (Deepin 12.3.0-17deepin8) 12.3.0, GNU ld (GNU Binutils for Deepin) 2.41) #4 SMP PREEMPT Mon Jun 8 10:20:57 CST 2026
Linux version 6.18.35-rc1-ga392253fde81 (guanwentao@uos-PC) (gcc (Deepin 12.3.0-17deepin15) 12.3.0, GNU ld (GNU Binutils for Deepin) 2.41) # SMP PREEMPT_DYNAMIC
Linux version 6.18.35-rc1-ga392253fde81 (guanwentao@uos-PC) (gcc (Deepin 12.3.0-17deepin15) 12.3.0, GNU ld (GNU Binutils for Deepin) 2.41) #1 SMP PREEMPT_DYNAMIC Mon Jun 8 01:26:28 CST 2026
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH 6.18 000/315] 6.18.35-rc1 review
2026-06-07 9:56 [PATCH 6.18 000/315] 6.18.35-rc1 review Greg Kroah-Hartman
` (3 preceding siblings ...)
2026-06-08 4:03 ` Wentao Guan
@ 2026-06-08 6:46 ` Ron Economos
2026-06-08 10:57 ` Florian Fainelli
5 siblings, 0 replies; 9+ messages in thread
From: Ron Economos @ 2026-06-08 6:46 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee,
rwarsow, conor, hargar, broonie, achill, sr
On 6/7/26 02:56, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.18.35 release.
> There are 315 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Tue, 09 Jun 2026 09:56:45 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.35-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
Built and booted successfully on RISC-V RV64 (HiFive Unmatched).
Tested-by: Ron Economos <re@w6rz.net>
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH 6.18 000/315] 6.18.35-rc1 review
2026-06-07 9:56 [PATCH 6.18 000/315] 6.18.35-rc1 review Greg Kroah-Hartman
` (4 preceding siblings ...)
2026-06-08 6:46 ` Ron Economos
@ 2026-06-08 10:57 ` Florian Fainelli
5 siblings, 0 replies; 9+ messages in thread
From: Florian Fainelli @ 2026-06-08 10:57 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, sudipm.mukherjee, rwarsow, conor,
hargar, broonie, achill, sr
On 6/7/2026 2:56 AM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.18.35 release.
> There are 315 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Tue, 09 Jun 2026 09:56:45 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.35-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels, build tested on
BMIPS_GENERIC:
Tested-by: Florian Fainelli <florian.fainelli@broadcom.com>
--
Florian
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH 6.18 000/315] 6.18.35-rc1 review
2026-06-07 16:58 ` Pavel Machek
@ 2026-06-08 12:13 ` Jon Hunter
2026-06-08 13:30 ` Pavel Machek
0 siblings, 1 reply; 9+ messages in thread
From: Jon Hunter @ 2026-06-08 12:13 UTC (permalink / raw)
To: Pavel Machek, Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, f.fainelli, sudipm.mukherjee, rwarsow,
conor, hargar, broonie, achill, sr, linux-tegra@vger.kernel.org
On 07/06/2026 17:58, Pavel Machek wrote:
> Hi!
>
>> This is the start of the stable review cycle for the 6.18.35 release.
>> There are 315 patches in this series, all will be posted as a response
>> to this one. If anyone has any issues with these being applied, please
>> let me know.
>
> We see build problem here:
>
> https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/jobs/14732223960
> https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/pipelines/2582906697
>
> Best regards,
> Pavel
>
>
>
> arch/arm64/kvm/nested.c: In function 'kvm_init_nv_sysregs':
> 1807
> 12:45:08
> arch/arm64/kvm/nested.c:1776:9: error: 'resx' undeclared (first use in this function); did you mean 'res1'?
> 1808
> 12:45:08
> 1776 | resx.res0 = ZCR_ELx_RES0 | GENMASK_ULL(8, 4);
> 1809
> 12:45:08
> | ^~~~
> 1810
> 12:45:08
> | res1
> 1811
> 12:45:08
> arch/arm64/kvm/nested.c:1776:9: note: each undeclared identifier is reported only once for each function it appears in
> 1812
> 12:45:08
> arch/arm64/kvm/nested.c:1778:9: error: too few arguments to function 'set_sysreg_masks'
> 1813
> 12:45:08
> 1778 | set_sysreg_masks(kvm, ZCR_EL2, resx);
> 1814
> 12:45:08
> | ^~~~~~~~~~~~~~~~
> 1815
> 12:45:08
> arch/arm64/kvm/nested.c:1641:29: note: declared here
> 1816
> 12:45:08
> 1641 | static __always_inline void set_sysreg_masks(struct kvm *kvm, int sr, u64 res0, u64 res1)
> 1817
> 12:45:08
> | ^~~~~~~~~~~~~~~~
> 1818
> 12:45:08
> CC block/holder.o
> 1819
> 12:45:08
> CC drivers/irqchip/irq-ls-scfg-msi.o
> 1820
> 12:45:09
> make[4]: *** [scripts/Makefile.build:287: arch/arm64/kvm/nested.o]
> Error 1
I am seeing the same build error for ARM64.
Jon
--
nvpublic
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH 6.18 000/315] 6.18.35-rc1 review
2026-06-08 12:13 ` Jon Hunter
@ 2026-06-08 13:30 ` Pavel Machek
0 siblings, 0 replies; 9+ messages in thread
From: Pavel Machek @ 2026-06-08 13:30 UTC (permalink / raw)
To: Jon Hunter
Cc: Pavel Machek, Greg Kroah-Hartman, stable, patches, linux-kernel,
torvalds, akpm, linux, shuah, patches, lkft-triage, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill, sr,
linux-tegra@vger.kernel.org
[-- Attachment #1: Type: text/plain, Size: 679 bytes --]
Hi!
> > > This is the start of the stable review cycle for the 6.18.35 release.
> > > There are 315 patches in this series, all will be posted as a response
> > > to this one. If anyone has any issues with these being applied, please
> > > let me know.
> >
> > We see build problem here:
> >
> > https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/jobs/14732223960
> > https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/pipelines/2582906697
>
> I am seeing the same build error for ARM64.
Thanks for confirmation.
There are more details in Message-ID:
<20260607170440.90814-1-ojeda@kernel.org> .
Best regards,
Pavel
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]
^ permalink raw reply [flat|nested] 9+ messages in thread
end of thread, other threads:[~2026-06-08 13:30 UTC | newest]
Thread overview: 9+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-06-07 9:56 [PATCH 6.18 000/315] 6.18.35-rc1 review Greg Kroah-Hartman
2026-06-07 16:58 ` Pavel Machek
2026-06-08 12:13 ` Jon Hunter
2026-06-08 13:30 ` Pavel Machek
2026-06-07 17:04 ` Miguel Ojeda
2026-06-07 20:40 ` Peter Schneider
2026-06-08 4:03 ` Wentao Guan
2026-06-08 6:46 ` Ron Economos
2026-06-08 10:57 ` Florian Fainelli
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox