* [PATCH 5.15 000/411] 5.15.210-rc1 review
@ 2026-06-16 14:53 Greg Kroah-Hartman
2026-06-16 14:58 ` [PATCH 5.15 259/411] arm64/mm: Enable batched TLB flush in unmap_hotplug_range() Greg Kroah-Hartman
2026-06-16 16:55 ` [PATCH 5.15 000/411] 5.15.210-rc1 review Brett A C Sheffield
0 siblings, 2 replies; 3+ messages in thread
From: Greg Kroah-Hartman @ 2026-06-16 14:53 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, linux-kernel, torvalds, akpm, linux,
shuah, patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill, sr
This is the start of the stable review cycle for the 5.15.210 release.
There are 411 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Thu, 18 Jun 2026 14:49:57 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.210-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Linux 5.15.210-rc1
Borislav Petkov (AMD) <bp@alien8.de>
x86/CPU/AMD: Move the Zen3 BTC_NO detection to the Zen3 init function
Ben Hutchings <benh@debian.org>
apparmor: validate default DFA states are in bounds
Ben Hutchings <benh@debian.org>
fbdev: vt8500lcdfb: Fix dma_free_coherent() cpu_addr parameter
Paolo Abeni <pabeni@redhat.com>
mptcp: close TOCTOU race while computing rcv_wnd
Will Deacon <will@kernel.org>
arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU
Shanker Donthineni <sdonthineni@nvidia.com>
arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU
Mark Rutland <mark.rutland@arm.com>
arm64: errata: Mitigate TLBI errata on various Arm CPUs
Mark Rutland <mark.rutland@arm.com>
arm64: cputype: Add C1-Premium definitions
Mark Rutland <mark.rutland@arm.com>
arm64: cputype: Add C1-Ultra definitions
Shanker Donthineni <sdonthineni@nvidia.com>
arm64: cputype: Add NVIDIA Olympus definitions
Christian Göttsche <cgzones@googlemail.com>
selinux: enable genfscon labeling for securityfs
Aaron Erhardt <aer@tuxedocomputers.com>
ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6
Jeff Layton <jlayton@kernel.org>
nfsd: fix heap overflow in NFSv4.0 LOCK replay cache
Eric Biggers <ebiggers@kernel.org>
ksmbd: Compare MACs in constant time
Pengpeng Hou <pengpeng@iscas.ac.cn>
net/ipv6: ioam6: prevent schema length wraparound in trace fill
Sven Eckelmann <sven@narfation.org>
batman-adv: tp_meter: fix tp_num leak on kmalloc failure
Jiexun Wang <wangjiexun2025@gmail.com>
batman-adv: stop tp_meter sessions during mesh teardown
Tejun Heo <tj@kernel.org>
blk-cgroup: Fix NULL deref caused by blkg_policy_data being installed before init
Julian Anastasov <ja@ssi.bg>
ipvs: skip ipv6 extension headers for csum checks
Yin Tirui <yintirui@huawei.com>
mm/huge_memory: update file PMD counter before folio_put()
Jason Gunthorpe <jgg@ziepe.ca>
RDMA/umem: Fix truncation for block sizes >= 4G
Leon Romanovsky <leon@kernel.org>
RDMA: Move DMA block iterator logic into dedicated files
Randy Dunlap <rdunlap@infradead.org>
RDMA/umem: fix kernel-doc warnings
Anton Leontev <leontyevantony@gmail.com>
hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf
Davide Ornaghi <d.ornaghi97@gmail.com>
netfilter: nft_fib: fix stale stack leak via the OIFNAME register
Michael Bommarito <michael.bommarito@gmail.com>
scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()
Prasanna S <prasanna.s@oss.qualcomm.com>
serial: qcom-geni: fix UART_RX_PAR_EN bit position
Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
tty: serial: qcom-geni-serial: align #define values
Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
tty: serial: qcom-geni-serial: remove unused symbols
Myeonghun Pak <mhun512@gmail.com>
serial: altera_jtaguart: handle uart_add_one_port() failures
Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
serial: altera_jtaguart: Use platform_get_irq_optional() to get the interrupt
Berkant Koc <me@berkoc.com>
drm/hyperv: validate resolution_count and fix WIN8 fallback
Michael Kelley <mikelley@microsoft.com>
drm/hyperv: Remove support for Hyper-V 2008 and 2008R2/Win7
Myrrh Periwinkle <myrrhperiwinkle@qtmlabs.xyz>
usb: typec: ucsi: Check if power role change actually happened before handling
Michael Bommarito <michael.bommarito@gmail.com>
scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf
Michael Bommarito <michael.bommarito@gmail.com>
thunderbolt: property: Cap recursion depth in __tb_property_parse_dir()
Guangshuo Li <lgs201920130244@gmail.com>
usb: gadget: f_hid: fix device reference leak in hidg_alloc()
John Keeping <john@metanate.com>
usb: gadget: f_hid: tidy error handling in hidg_alloc
Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
usb: dwc3: xilinx: fix error handling in zynqmp init error paths
Tudor Ambarus <tudor.ambarus@linaro.org>
tty: serial: samsung: Remove redundant port lock acquisition in rx helpers
Tudor Ambarus <tudor.ambarus@linaro.org>
tty: serial: samsung: use u32 for register interactions
Thomas Gleixner <tglx@linutronix.de>
serial: samsung_tty: Use port lock wrappers
Minh Nguyen <minhnguyen.080505@gmail.com>
net: skbuff: fix missing zerocopy reference in pskb_carve helpers
Peter Chen <peter.chen@cixtech.com>
usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure
Rodrigo Alencar <rodrigo.alencar@analog.com>
iio: dac: ad5686: fix ref bit initialization for single-channel parts
Antoniu Miclaus <antoniu.miclaus@analog.com>
iio: chemical: scd30: fix division by zero in write_raw
Jonathan Cameron <Jonathan.Cameron@huawei.com>
iio: chemical: scd30: Use guard(mutex) to allow early returns
Antoniu Miclaus <antoniu.miclaus@analog.com>
iio: gyro: adis16260: fix division by zero in write_raw
Siwei Zhang <oss@fourdim.xyz>
Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen()
Wayne Chang <waynec@nvidia.com>
phy: tegra: xusb: Fix per-pad high-speed termination calibration
Wayne Chang <waynec@nvidia.com>
phy: tegra: xusb: Disable trk clk when not in use
Zeng Heng <zengheng4@huawei.com>
arm64: tlb: Flush walk cache when unsharing PMD tables
Johan Hovold <johan@kernel.org>
spi: qup: fix error pointer deref after DMA setup failure
Yang Yingliang <yangyingliang@huawei.com>
spi: qup: switch to use modern name
Dawei Feng <dawei.feng@seu.edu.cn>
octeontx2-pf: avoid double free of pool->stack on AQ init failure
Sam Daly <sam@samdaly.ie>
octeontx2-af: CGX: add bounds check to cgx_speed_mbps index
Shardul Bankar <shardul.b@mpiricsoftware.com>
mptcp: do not drop partial packets
Matthieu Baerts (NGI0) <matttbe@kernel.org>
selftests: mptcp: drop nanoseconds width specifier
Li Xiasong <lixiasong1@huawei.com>
mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient
Al Viro <viro@zeniv.linux.org.uk>
use less confusing names for iov_iter direction initializers
Justin Iurman <justin.iurman@gmail.com>
ipv6: ioam: add NULL check for idev in ipv6_hop_ioam()
Eric Dumazet <edumazet@google.com>
ipv6/addrconf: annotate data-races around devconf fields (II)
Jose Ignacio Tornos Martinez <jtornosm@redhat.com>
ice: fix VF queue configuration with low MTU values
Michael Bommarito <michael.bommarito@gmail.com>
net: hsr: defer node table free until after RCU readers
Jiexun Wang <wangjiexun2025@gmail.com>
Bluetooth: serialize accept_q access
Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Bluetooth: Init sk_peer_* on bt_sock_alloc
Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Bluetooth: Consolidate code around sk_alloc into a helper function
Dawei Feng <dawei.feng@seu.edu.cn>
qed: fix double free in qed_cxt_tables_alloc()
Christophe JAILLET <christophe.jaillet@wanadoo.fr>
qed: Use the bitmap API to simplify some functions
Michael Bommarito <michael.bommarito@gmail.com>
Bluetooth: MGMT: validate Add Extended Advertising Data length
Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Bluetooth: hci_sync: Make use of hci_cmd_sync_queue set 2
Shuai Zhang <shuai.zhang@oss.qualcomm.com>
Bluetooth: hci_qca: Convert timeout from jiffies to ms
Safa Karakuş <safa.karakus@secunnix.com>
Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del()
Michael Bommarito <michael.bommarito@gmail.com>
smb: client: require net admin for CIFS SWN netlink
Ido Schimmel <idosch@nvidia.com>
genetlink: Use internal flags for multicast groups
Johan Hovold <johan@kernel.org>
spi: lantiq-ssc: fix controller deregistration
Johan Hovold <johan@kernel.org>
spi: st-ssc4: fix controller deregistration
Chao Yu <chao@kernel.org>
f2fs: fix false alarm of lockdep on cp_global_sem lock
Yongpeng Yang <yangyongpeng@xiaomi.com>
f2fs: fix incorrect file address mapping when inline inode is unwritten
Matthieu Baerts (NGI0) <matttbe@kernel.org>
mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker
Matthieu Baerts (NGI0) <matttbe@kernel.org>
mptcp: pm: ADD_ADDR rtx: fix potential data-race
Matthieu Baerts (NGI0) <matttbe@kernel.org>
mptcp: pm: prio: skip closed subflows
Piyush Sachdeva <s.piyush1024@gmail.com>
smb: client: Use FullSessionKey for AES-256 encryption key derivation
Filipe Manana <fdmanana@suse.com>
btrfs: fix missing last_unlink_trans update when removing a directory
Michael Bommarito <michael.bommarito@gmail.com>
smb: client: validate dacloffset before building DACL pointers
Ulf Hansson <ulf.hansson@linaro.org>
pmdomain: core: Fix detach procedure for virtual devices in genpd
Steven Rostedt <rostedt@goodmis.org>
tracing/probes: Limit size of event probe to 3K
Yochai Eisenrich <yochaie@sweet.security>
btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak
Johan Hovold <johan@kernel.org>
spi: topcliff-pch: fix controller deregistration
Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
spi: topcliff-pch: Convert to platform remove callback returning void
Thomas Zimmermann <tzimmermann@suse.de>
fbcon: Avoid OOB font access if console rotation fails
Sang-Heon Jeon <ekffu200098@gmail.com>
mm/hugetlb_cma: round up per_node before logging it
Johan Hovold <johan@kernel.org>
spi: uniphier: fix controller deregistration
Johan Hovold <johan@kernel.org>
spi: tegra20-sflash: fix controller deregistration
Johan Hovold <johan@kernel.org>
spi: tegra114: fix controller deregistration
Johan Hovold <johan@kernel.org>
spi: sun6i: fix controller deregistration
Johan Hovold <johan@kernel.org>
spi: zynq-qspi: fix controller deregistration
Johan Hovold <johan@kernel.org>
spi: ti-qspi: fix controller deregistration
Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
spi: spi-ti-qspi: Convert to platform remove callback returning void
Johan Hovold <johan@kernel.org>
spi: sun4i: fix controller deregistration
Johan Hovold <johan@kernel.org>
spi: syncuacer: fix controller deregistration
Michal Kosiorek <mkosiorek121@gmail.com>
xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete
Michael Bommarito <michael.bommarito@gmail.com>
xfrm: ah: account for ESN high bits in async callbacks
Eric Biggers <ebiggers@google.com>
net: ipv6: stop checking crypto_ahash_alignmask
Eric Biggers <ebiggers@google.com>
net: ipv4: stop checking crypto_ahash_alignmask
Selvarasu Ganesan <selvarasu.g@samsung.com>
usb: dwc3: Move GUID programming after PHY initialization
Marek Szyprowski <m.szyprowski@samsung.com>
wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task
Amit Sunil Dhamne <amitsd@google.com>
usb: typec: tcpm: reset internal port states on soft reset AMS
Michael Bommarito <michael.bommarito@gmail.com>
smb: client: validate the whole DACL before rewriting it in cifsacl
David Carlier <devnexen@gmail.com>
tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func()
Thorsten Blum <thorsten.blum@linux.dev>
crypto: caam - guard HMAC key hex dumps in hash_digest_key
Thorsten Blum <thorsten.blum@linux.dev>
printk: add print_hex_dump_devel()
Cássio Gabriel <cassiogabrielcontato@gmail.com>
ALSA: aloop: Fix peer runtime UAF during format-change stop
Yang Xiuwei <yangxiuwei@kylinos.cn>
scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails
Christoph Hellwig <hch@lst.de>
sd: rename the scsi_disk.dev field
Luis Chamberlain <mcgrof@kernel.org>
scsi: sd: Add error handling support for add_disk()
Bart Van Assche <bvanassche@acm.org>
scsi: core: pm: Rely on the device driver core for async power management
Max Kellermann <max.kellermann@ionos.com>
ceph: only d_add() negative dentries when they are unhashed
Junrui Luo <moonafterrain@outlook.com>
erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap()
Thorsten Blum <thorsten.blum@linux.dev>
crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx
Ard Biesheuvel <ardb@kernel.org>
crypto: nx - Migrate to scomp API
Gustavo A. R. Silva <gustavoars@kernel.org>
crypto: nx - Avoid -Wflex-array-member-not-at-end warning
Johan Hovold <johan@kernel.org>
can: ucan: fix devres lifetime
Julia Lawall <Julia.Lawall@inria.fr>
can: ucan: fix typos in comments
Shuvam Pandey <shuvampandey1@gmail.com>
Bluetooth: hci_event: fix potential UAF in SSP passkey handlers
Zilin Guan <zilin@seu.edu.cn>
hfsplus: fix held lock freed on hfsplus_fill_super()
Deepanshu Kartikey <kartikey406@gmail.com>
hfsplus: fix uninit-value by validating catalog record size
Seohyeon Maeng <bioloidgp@gmail.com>
udf: fix partition descriptor append bookkeeping
Sanjaikumar V S <sanjaikumar.vs@dicortech.com>
mtd: spi-nor: sst: Fix write enable before AAI sequence
Shawn Lin <shawn.lin@rock-chips.com>
mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration
Ryan Roberts <ryan.roberts@arm.com>
randomize_kstack: Maintain kstack_offset per task
Thomas Zimmermann <tzimmermann@suse.de>
fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info
Zhengchuan Liang <zcliangcn@gmail.com>
net: bridge: use a stable FDB dst snapshot in RCU readers
Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
net: qrtr: ns: Limit the total number of nodes
Yuan Zhaoming <yuanzm2@lenovo.com>
net: mctp: fix don't require received header reserved bits to be zero
Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
net: qrtr: ns: Free the node during ctrl_cmd_bye()
Vignesh Viswanathan <quic_viswanat@quicinc.com>
net: qrtr: ns: Change servers radix tree to xarray
Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
net: qrtr: ns: Limit the maximum number of lookups
Takashi Iwai <tiwai@suse.de>
ALSA: core: Fix potential data race at fasync handling
Joseph Salisbury <joseph.salisbury@oracle.com>
sched: Use u64 for bandwidth ratio calculations
Oliver Neukum <oneukum@suse.com>
media: rc: igorplugusb: heed coherency rules
Robert Beckett <bob.beckett@collabora.com>
nvme: respect NVME_QUIRK_DISABLE_WRITE_ZEROES when wzsl is set
Tom Yan <tom.ty89@gmail.com>
nvme: fix interpretation of DMRSL
Gao Xiang <hsiangkao@linux.alibaba.com>
erofs: fix the out-of-bounds nameoff handling for trailing dirents
Thorsten Blum <thorsten.blum@linux.dev>
ALSA: aoa: Skip devices with no codecs in i2sbus_resume()
Oliver Neukum <oneukum@suse.com>
media: rc: ttusbir: respect DMA coherency rules
Cássio Gabriel <cassiogabrielcontato@gmail.com>
ALSA: aoa: i2sbus: clear stale prepared state
Takashi Iwai <tiwai@suse.de>
ALSA: aoa: Use guard() for mutex locks
Daniel Hodges <git@danielhodges.dev>
wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup()
Rafael J. Wysocki <rafael.j.wysocki@intel.com>
thermal: core: Fix thermal zone governor cleanup issues
Fedor Pchelkin <pchelkin@ispras.ru>
wifi: rtw88: check for PCI upstream bridge existence
Jimmy Hon <honyuenkwun@gmail.com>
rtw88: 8821ce: Disable PCIe ASPM L1 for 8821CE using chip ID
Anshuman Khandual <anshuman.khandual@arm.com>
arm64/mm: Enable batched TLB flush in unmap_hotplug_range()
Bingquan Chen <patzilla007@gmail.com>
net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd()
Michael Bommarito <michael.bommarito@gmail.com>
ksmbd: require minimum ACE size in smb_check_perm_dacl()
Michael Bommarito <michael.bommarito@gmail.com>
smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path
Michael Bommarito <michael.bommarito@gmail.com>
smb: client: require a full NFS mode SID before reading mode bits
DaeMyung Kang <charsyam@gmail.com>
smb: server: fix max_connections off-by-one in tcp accept path
Michael Bommarito <michael.bommarito@gmail.com>
smb: server: fix active_num_conn leak on transport allocation failure
Yongpeng Yang <yangyongpeng@xiaomi.com>
f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io()
Chao Yu <chao@kernel.org>
f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally
Lukas Wunner <lukas@wunner.de>
lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl()
Eric Biggers <ebiggers@kernel.org>
net/tcp-md5: Fix MAC comparison to be constant-time
Longxuan Yu <ylong030@ucr.edu>
io_uring/poll: fix signed comparison in io_poll_get_ownership()
SeongJae Park <sj@kernel.org>
mm/damon/ops-common: call folio_test_lru() after folio_get()
Mingyu Wang <25181214217@stu.xidian.edu.cn>
fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling
Harry Wentland <harry.wentland@amd.com>
drm/amd/display: Use krealloc_array() in dal_vector_reserve()
Harry Wentland <harry.wentland@amd.com>
drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs
Harry Wentland <harry.wentland@amd.com>
drm/amd/display: Clamp VBIOS HDMI retimer register count to array size
Harry Wentland <harry.wentland@amd.com>
drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size
Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock
Michael Bommarito <michael.bommarito@gmail.com>
thunderbolt: Limit XDomain response copy to actual frame size
Michael Bommarito <michael.bommarito@gmail.com>
thunderbolt: Clamp XDomain response data copy to allocation size
Michael Bommarito <michael.bommarito@gmail.com>
thunderbolt: Bound root directory content to block size
Michael Bommarito <michael.bommarito@gmail.com>
thunderbolt: Reject zero-length property entries in validator
Wyatt Feng <bronzed_45_vested@icloud.com>
sctp: stream: fully roll back denied add-stream state
Zhao Zhang <zzhan461@ucr.edu>
sctp: diag: reject stale associations in dump_one path
Jisheng Zhang <jszhang@kernel.org>
mmc: sdhci: add signal voltage switch in sdhci_resume_host
Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC
Kamal Dasu <kamal.dasu@broadcom.com>
mmc: core: Fix host controller programming for fixed driver type
Yuqi Xu <xuyq21@lenovo.com>
net: rds: clear i_sends on setup unwind
Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
net: mv643xx: fix OF node refcount
ZhaoJinming <zhaojinming@uniontech.com>
net: bonding: fix NULL pointer dereference in bond_do_ioctl()
Junrui Luo <moonafterrain@outlook.com>
misc: fastrpc: fix DMA address corruption due to find_vma misuse
Anandu Krishnan E <anandu.e@oss.qualcomm.com>
misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context
Yilin Zhu <zylzyl2333@gmail.com>
ipc/shm: serialize orphan cleanup with shm_nattch updates
Cryolitia PukNgae <cryolitia.pukngae@linux.dev>
Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard
Zeyu WANG <zeyu.thomas.wang@gmail.com>
Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK)
Akhil R <akhilrajeev@nvidia.com>
i2c: tegra: Fix NOIRQ suspend/resume
Guillermo Rodríguez <guille.rodriguez@gmail.com>
i2c: stm32f7: fix timing computation ignoring i2c-analog-filter
Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
i2c: qcom-cci: Fix NULL pointer dereference in cci_remove()
Jann Horn <jannh@google.com>
fuse: reject fuse_notify() pagecache ops on directories
Christian Brauner <brauner@kernel.org>
pidfd: refuse access to tasks that have started exiting harder
Michael Bommarito <michael.bommarito@gmail.com>
IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN
Kyle Meyer <kyle.meyer@hpe.com>
bnxt_en: Fix NULL pointer dereference
Raf Dickson <rafdog35@gmail.com>
vsock/vmci: fix sk_ack_backlog leak on failed handshake
Matthieu Baerts (NGI0) <matttbe@kernel.org>
mptcp: sockopt: check timestamping ret value
Paolo Abeni <pabeni@redhat.com>
mptcp: fix retransmission loop when csum is enabled
Karl Mehltretter <kmehltretter@gmail.com>
ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O
Yuho Choi <dbgh9129@gmail.com>
ARM: socfpga: Fix OF node refcount leak in SMP setup
Michael Bommarito <michael.bommarito@gmail.com>
RDMA/srp: bound SRP_RSP sense copy by the received length
Harry Wentland <harry.wentland@amd.com>
drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info()
Takashi Iwai <tiwai@suse.de>
ALSA: timer: Fix UAF at snd_timer_user_params()
HyeongJun An <sammiee5311@gmail.com>
USB: serial: kl5kusb105: fix bulk-out buffer overflow
Jack Wu <jackbb_wu@compal.com>
USB: serial: option: add usb-id for Dell Wireless DW5826e-m
Adrian Korwel <adriank20047@gmail.com>
USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr()
Adrian Korwel <adriank20047@gmail.com>
USB: serial: io_ti: fix heap overflow in get_manuf_info()
Wyatt Feng <bronzed_45_vested@icloud.com>
xfrm: espintcp: do not reuse an in-progress partial send
Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
drm/i915/gem: Fix phys BO pread/pwrite with offset
Michael Bommarito <michael.bommarito@gmail.com>
Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig
Tristan Madani <tristan@talencesecurity.com>
netfilter: nft_tunnel: fix use-after-free on object destroy
Alexander A. Klimov <grandmaster@al2klimov.de>
drm/vc4: fix krealloc() memory leak
Til Kaiser <mail@tk154.de>
net: mvpp2: build skb from XDP-adjusted data on XDP_PASS
Til Kaiser <mail@tk154.de>
net: mvpp2: refill RX buffers before XDP or skb use
Lorenzo Bianconi <lorenzo@kernel.org>
net: mvpp2: Add metadata support for xdp mode
Til Kaiser <mail@tk154.de>
net: mvpp2: limit XDP frame size to the RX buffer
Til Kaiser <mail@tk154.de>
net: mvpp2: sync RX data at the hardware packet offset
Florian Westphal <fw@strlen.de>
netfilter: nft_exthdr: fix register tracking for F_PRESENT flag
Xiang Mei <xmei5@asu.edu>
netfilter: nf_log: validate MAC header was set before dumping it
Kyle Zeng <kylebot@openai.com>
netfilter: x_tables: avoid leaking percpu counter pointers
Breno Leitao <leitao@debian.org>
rds: mark snapshot pages dirty in rds_info_getsockopt()
Eric Dumazet <edumazet@google.com>
ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()
Weiming Shi <bestswngs@gmail.com>
net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion
Kyle Zeng <kylebot@openai.com>
net: guard timestamp cmsgs to real error queue skbs
Michael Bommarito <michael.bommarito@gmail.com>
sctp: fix uninit-value in __sctp_rcv_asconf_lookup()
Adrian Moreno <amorenoz@redhat.com>
net: openvswitch: fix possible kfree_skb of ERR_PTR
Kyle Zeng <kylebot@openai.com>
ipv6: sit: reload inner IPv6 header after GSO offloads
Mingyu Wang <25181214217@stu.xidian.edu.cn>
net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove
Chenguang Zhao <zhaochenguang@kylinos.cn>
netlabel: validate unlabeled address and mask attribute lengths
Sanghyun Park <sanghyun.park.cnu@gmail.com>
xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()
Mark Rutland <mark.rutland@arm.com>
arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI
Mark Rutland <mark.rutland@arm.com>
arm64: tlb: Allow XZR argument to TLBI ops
Marc Zyngier <maz@kernel.org>
KVM: arm64: Remove VPIPT I-cache handling
Weiming Shi <bestswngs@gmail.com>
tun: free page on build_skb failure in tun_xdp_one()
Weiming Shi <bestswngs@gmail.com>
tap: free page on error paths in tap_get_user_xdp()
Jeff Layton <jlayton@kernel.org>
nfsd: don't ignore the return code of svc_proc_register()
Edward Lo <loyuantsung@gmail.com>
fs/ntfs3: Return error for inconsistent extended attributes
Tejas Bharambe <tejas.bharambe@outlook.com>
ext4: validate p_idx bounds in ext4_ext_correct_indexes
Naveen Kumar Chaudhary <naveen.osdev@gmail.com>
time: Fix off-by-one in settimeofday() usec validation
Aleksandr Nogikh <nogikh@google.com>
signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads()
Xin Long <lucien.xin@gmail.com>
sctp: purge outqueue on stale COOKIE-ECHO handling
Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr
Eric Dumazet <edumazet@google.com>
ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()
Eric Dumazet <edumazet@google.com>
ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options
Bharath Reddy <kbreddy.rpbc@gmail.com>
Bluetooth: fix memory leak in error path of hci_alloc_dev()
Zhang Cen <rollkingzzc@gmail.com>
Bluetooth: bnep: reject short frames before parsing
Dudu Lu <phx0fer@gmail.com>
Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling
SeungJu Cheon <suunj1331@gmail.com>
Bluetooth: RFCOMM: validate skb length in MCC handlers
Zhang Cen <rollkingzzc@gmail.com>
Bluetooth: MGMT: validate advertising TLV before type checks
Zhang Cen <rollkingzzc@gmail.com>
Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()
David Thompson <davthompson@nvidia.com>
net: lan743x: permit VLAN-tagged packets up to configured MTU
Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
net: garp: fix unsigned integer underflow in garp_pdu_parse_attr
Oscar Maes <oscmaes92@gmail.com>
pcnet32: stop holding device spin lock during napi_complete_done
Yicong Hui <yiconghui@gmail.com>
drm/imx: Fix three kernel-doc warnings in dcss-scaler.c
Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
6lowpan: fix off-by-one in multicast context address compression
Jamal Hadi Salim <jhs@mojatatu.com>
net/sched: act_api: use RCU with deferred freeing for action lifecycle
Guangshuo Li <lgs201920130244@gmail.com>
dm cache policy smq: check allocation under invalidate lock
Yiming Qian <yimingqian591@gmail.com>
netfilter: bridge: make ebt_snat ARP rewrite writable
Florian Westphal <fw@strlen.de>
netfilter: conntrack_irc: fix possible out-of-bounds read
Fernando Fernandez Mancera <fmancera@suse.de>
netfilter: synproxy: add mutex to guard hook reference counting
Julian Anastasov <ja@ssi.bg>
ipvs: clear the svc scheduler ptr early on edit
Fernando Fernandez Mancera <fmancera@suse.de>
netfilter: xt_NFQUEUE: prefer raw_smp_processor_id
Amirreza Zarrabi <amirreza.zarrabi@oss.qualcomm.com>
tee: optee: prevent use-after-free when the client exits before the supplicant
Ido Schimmel <idosch@nvidia.com>
ipv6: mcast: Fix use-after-free when processing MLD queries
Mingyu Wang <25181214217@stu.xidian.edu.cn>
i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl
Nathan Chancellor <nathan@kernel.org>
Disable -Wattribute-alias for clang-23 and newer
Nathan Chancellor <nathan@kernel.org>
compiler-clang.h: Add __diag infrastructure for clang
Johan Hovold <johan@kernel.org>
USB: serial: mct_u232: fix memory corruption with small endpoint
Kuniyuki Iwashima <kuniyu@google.com>
bpf: Free reuseport cBPF prog after RCU grace period.
Michal Pecio <michal.pecio@gmail.com>
usb: core: Fix SuperSpeed root hub wMaxPacketSize
Maciej W. Rozycki <macro@orcam.me.uk>
serial: dz: Fix bootconsole handover lockup
Wei-Cheng Chen <weichengc@nvidia.com>
xhci: tegra: Fix ghost USB device on dual-role port unplug
Johan Hovold <johan@kernel.org>
USB: serial: digi_acceleport: fix memory corruption with small endpoints
Nathan Chancellor <nathan@kernel.org>
HID: core: Fix size_t specifier in hid_report_raw_event()
Benjamin Tissoires <bentiss@kernel.org>
HID: pass the buffer size to hid_report_raw_event
Vicki Pfau <vi@endrift.com>
HID: core: Add printk_ratelimited variants to hid_warn() etc
Johan Hovold <johan@kernel.org>
USB: serial: cypress_m8: fix memory corruption with small endpoint
Maciej W. Rozycki <macro@orcam.me.uk>
serial: zs: Switch to using channel reset
Maciej W. Rozycki <macro@orcam.me.uk>
serial: zs: Fix bootconsole handover lockup
Maciej W. Rozycki <macro@orcam.me.uk>
serial: dz: Fix bootconsole message clobbering at chip reset
Shitalkumar Gandhi <shital.gandhi45@gmail.com>
serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma
Maciej W. Rozycki <macro@orcam.me.uk>
serial: zs: Fix swapped RI/DSR modem line transition counting
Hongling Zeng <zenghongling@kylinos.cn>
serial: sh-sci: fix memory region release in error path
Berkant Koc <me@berkoc.com>
drm/hyperv: validate VMBus packet size in receive callback
Michael Bommarito <michael.bommarito@gmail.com>
scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32
Michael Bommarito <michael.bommarito@gmail.com>
scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker
Michael Bommarito <michael.bommarito@gmail.com>
thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow
Michael Bommarito <michael.bommarito@gmail.com>
thunderbolt: property: Reject u32 wrap in tb_property_entry_valid()
Michael Bommarito <michael.bommarito@gmail.com>
usb: gadget: f_fs: copy only received bytes on short ep0 read
Seungjin Bae <eeodqql09@gmail.com>
usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports
Guangshuo Li <lgs201920130244@gmail.com>
usb: gadget: net2280: Fix double free in probe error path
Johan Hovold <johan@kernel.org>
USB: serial: mct_u232: fix missing interrupt-in transfer sanity check
Johan Hovold <johan@kernel.org>
USB: serial: mxuport: fix memory corruption with small endpoint
Johan Hovold <johan@kernel.org>
USB: serial: keyspan: fix missing indat transfer sanity check
Zhang Cen <rollkingzzc@gmail.com>
USB: serial: cypress_m8: validate interrupt packet headers
Zhang Cen <rollkingzzc@gmail.com>
USB: serial: belkin_sa: validate interrupt status length
Wanquan Zhong <wanquan.zhong@fibocom.com>
USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL
Jan Volckaert <janvolck@gmail.com>
USB: serial: option: add MeiG SRM813Q
Heitor Alves de Siqueira <halves@igalia.com>
usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize
Heitor Alves de Siqueira <halves@igalia.com>
usb: usbtmc: check URB actual_length for interrupt-IN notifications
Michael Bommarito <michael.bommarito@gmail.com>
usbip: vudc: Fix use after free bug in vudc_remove due to race condition
Sam Burkels <sam@1a38.nl>
usb: storage: Add quirks for PNY Elite Portable SSD
Stephen J. Fuhry <fuhrysteve@gmail.com>
USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers
Michal Pecio <michal.pecio@gmail.com>
usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval
Xu Yang <xu.yang_2@nxp.com>
usb: chipidea: core: convert ci_role_switch to local variable
Zhaoyang Yu <2426767509@qq.com>
tty: serial: pch_uart: add check for dma_alloc_coherent()
Ian Abbott <abbotti@mev.co.uk>
comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest()
Ian Abbott <abbotti@mev.co.uk>
comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest()
Nicolás Bazaes <contacto@bazaes.cl>
Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490
Dmitry Torokhov <dmitry.torokhov@gmail.com>
Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem
Jingguo Tan <tanjingguo@huawei.com>
xfrm: esp: restore combined single-frag length gate
Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks
Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
ASoC: qcom: q6asm-dai: close stream only when running
Hamza Mahfooz <hamzamahfooz@linux.microsoft.com>
netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check
Michael Bommarito <michael.bommarito@gmail.com>
xfrm: ah: use skb_to_full_sk in async output callbacks
Maoyi Xie <maoyixie.tju@gmail.com>
xfrm: route MIGRATE notifications to caller's netns
Ashutosh Desai <ashutoshdesai993@gmail.com>
nfc: hci: fix out-of-bounds read in HCP header parsing
Arnd Bergmann <arnd@arndb.de>
iommu, debugobjects: avoid gcc-16.1 section mismatch warnings
Lee Jones <lee@kernel.org>
HID: wacom: Fix OOB write in wacom_hid_set_device_mode()
Kuniyuki Iwashima <kuniyu@google.com>
ip6: vti: Use ip6_tnl.net in vti6_changelink().
Zhengchuan Liang <zcliangcn@gmail.com>
xfrm: input: hold netns during deferred transport reinjection
Qi Tang <tpluszz77@gmail.com>
ipv6: validate extension header length before copying to cmsg
Maoyi Xie <maoyixie.tju@gmail.com>
ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().
Zhengchuan Liang <zcliangcn@gmail.com>
ipv6: exthdrs: refresh nh after handling HAO option
Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params
Justin Iurman <justin.iurman@gmail.com>
ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()
Junrui Luo <moonafterrain@outlook.com>
macsec: fix replay protection at XPN lower-PN wrap
Yuqi Xu <xuyq21@lenovo.com>
bpf: sockmap: fix tail fragment offset in bpf_msg_push_data
Dmitry Torokhov <dmitry.torokhov@gmail.com>
Input: elan_i2c - validate firmware size before use
Dan Carpenter <error27@gmail.com>
usb: dwc2: Fix use after free in debug code
Peter Chen <peter.chen@cixtech.com>
usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles
Yongchao Wu <yongchao.wu@autochips.com>
usb: cdns3: gadget: fix request skipping after clearing halt
Johan Hovold <johan@kernel.org>
USB: serial: omninet: fix memory corruption with small endpoint
Felix Gu <ustc.gu@gmail.com>
iio: buffer: hw-consumer: fix use-after-free in error path
Aldo Conte <aldocontelk@gmail.com>
iio: light: cm3323: fix reg_conf not being initialized correctly
Advait Dhamorikar <advaitd@mechasystems.com>
iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL
Salah Triki <salah.triki@gmail.com>
iio: temperature: tsys01: fix broken PROM checksum validation
Sanjay Chitroda <sanjayembeddedse@gmail.com>
iio: ssp_sensors: cancel delayed work_refresh on remove
David Carlier <devnexen@gmail.com>
iio: gyro: itg3200: fix i2c read into the wrong stack location
Salah Triki <salah.triki@gmail.com>
iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw
Jason A. Donenfeld <Jason@zx2c4.com>
wireguard: send: append trailer after expanding head
Rodrigo Alencar <rodrigo.alencar@analog.com>
iio: dac: ad5686: fix input raw value check
Salah Triki <salah.triki@gmail.com>
iio: dac: max5821: fix return value check in powerdown sync
Christofer Jonason <christofer.jonason@guidelinegeo.com>
iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux
Ben Hutchings <benh@debian.org>
parport: Fix race between port and client registration
Muhammad Bilal <meatuni001@gmail.com>
Bluetooth: HIDP: fix missing length checks in hidp_input_report()
Siwei Zhang <oss@fourdim.xyz>
Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn
Linpu Yu <linpu5433@gmail.com>
ipc: limit next_id allocation to the valid ID range
Mikulas Patocka <mpatocka@redhat.com>
hpfs: fix a crash if hpfs_map_dnode_bitmap fails
Shuai Zhang <shuai.zhang@oss.qualcomm.com>
Bluetooth: btusb: Allow firmware re-download when version matches
Thomas Fourier <fourier.thomas@gmail.com>
Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free()
Johan Hovold <johan@kernel.org>
USB: serial: safe_serial: fix memory corruption with small endpoint
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer()
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
usb: typec: altmodes/displayport: validate count before reading Status Update VDO
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
usb: typec: ucsi: ccg: reject firmware images without a ':' record header
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer
Stefan Metzmacher <metze@samba.org>
smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path
Horatiu Vultur <horatiu.vultur@microchip.com>
phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X
Harini Katakam <harini.katakam@amd.com>
phy: mscc: Use PHY_ID_MATCH_VENDOR to minimize PHY ID table
Jiasheng Jiang <jiashengjiangcool@gmail.com>
RDMA/rxe: Fix double free in rxe_srq_from_init
Ben Hutchings <benh@debian.org>
Revert "RDMA/rxe: Fix double free in rxe_srq_from_init"
Jouni Högander <jouni.hogander@intel.com>
drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used
Suraj Kandpal <suraj.kandpal@intel.com>
drm/dp: Add eDP 1.5 bit definition
Jouni Högander <jouni.hogander@intel.com>
drm/i915/psr: Read Intel DPCD workaround register
Jouni Högander <jouni.hogander@intel.com>
drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register
Duoming Zhou <duoming@zju.edu.cn>
wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work
Sven Eckelmann <sven@narfation.org>
batman-adv: bla: avoid double decrement of bla.num_requests
Sven Eckelmann <sven@narfation.org>
batman-adv: tt: avoid empty VLAN responses
Sven Eckelmann <sven@narfation.org>
batman-adv: tt: fix TOCTOU race for reported vlans
Sven Eckelmann <sven@narfation.org>
batman-adv: tp_meter: directly shut down timer on cleanup
Petr Machata <petrm@nvidia.com>
selftests: forwarding: lib: Add helpers for checksum handling
Sven Eckelmann <sven@narfation.org>
batman-adv: iv: recover OGM scheduling after forward packet error
Sven Eckelmann <sven@narfation.org>
batman-adv: tvlv: reject oversized TVLV packets
Sven Eckelmann <sven@narfation.org>
batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface
Sven Eckelmann <sven@narfation.org>
batman-adv: tvlv: abort OGM send on tvlv append failure
Sven Eckelmann <sven@narfation.org>
batman-adv: v: stop OGMv2 on disabled interface
Zhenghang Xiao <kipreyyy@gmail.com>
sctp: fix race between sctp_wait_for_connect and peeloff
Marco Scardovi <scardracs@disroot.org>
gpio: rockchip: convert bank->clk to devm_clk_get_enabled()
Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp
Zhenghang Xiao <kipreyyy@gmail.com>
Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success
Jamal Hadi Salim <jhs@mojatatu.com>
net/sched: Revert "net/sched: Restrict conditions for adding duplicating netems to qdisc tree"
Rahul Chandelkar <rc@rexion.ai>
ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()
Jakub Kicinski <kuba@kernel.org>
ethtool: eeprom: add more safeties to EEPROM Netlink fallback
Oliver Hartkopp <socketcan@hartkopp.net>
bonding: refuse to enslave CAN devices
Zhao Dongdong <zhaodongdong@kylinos.cn>
Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt()
Cássio Gabriel <cassiogabrielcontato@gmail.com>
ASoC: codecs: simple-mux: Fix enum control bounds check
Eric Dumazet <edumazet@google.com>
tunnels: do not assume transport header in iptunnel_pmtud_check_icmp()
Eric Dumazet <edumazet@google.com>
vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()
Eric Dumazet <edumazet@google.com>
tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]()
Cássio Gabriel <cassiogabrielcontato@gmail.com>
ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors
Eric Dumazet <edumazet@google.com>
ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()
Breno Leitao <leitao@debian.org>
net/iucv: fix locking in .getsockopt
Alexandra Winter <wintera@linux.ibm.com>
net/smc: Do not re-initialize smc hashtables
Ilya Maximets <i.maximets@ovn.org>
net: netlink: don't set nsid on local notifications
Ilya Maximets <i.maximets@ovn.org>
net: netlink: fix sending unassigned nsid after assigned one
Weiming Shi <bestswngs@gmail.com>
tun: free page on short-frame rejection in tun_xdp_one()
Florian Westphal <fw@strlen.de>
netfilter: ebtables: fix OOB read in compat_mtw_from_user
Florian Westphal <fw@strlen.de>
netfilter: xt_cpu: prefer raw_smp_processor_id
Chris Mason <clm@meta.com>
netfilter: synproxy: refresh tcphdr after skb_ensure_writable
Carl Lee <carl.lee@amd.com>
nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems
David Ahern <dahern@nvidia.com>
xfrm: Check for underflow in xfrm_state_mtu
Lee Jones <lee@kernel.org>
nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc()
Lee Jones <lee@kernel.org>
nfc: llcp: Fix use-after-free in llcp_sock_release()
Kevin Hao <haokexin@gmail.com>
net: cpsw_new: Fix potential unregister of netdev that has not been registered yet
Vinicius Costa Gomes <vinicius.gomes@intel.com>
dmaengine: idxd: Fix not releasing workqueue on .release()
Carlos Eduardo Gallo Filho <gcarlos@disroot.org>
drm: Remove plane hsub/vsub alignment requirement for core helpers
Victor Nogueria <victor@mojatatu.com>
net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked
Jeremy Kerr <jk@codeconstruct.com.au>
net: mctp: ensure our nlmsg responses are initialised
Davide Caratti <dcaratti@redhat.com>
net/sched: cls_fw: fix NULL dereference of "old" filters before change()
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size
-------------
Diffstat:
Documentation/arm64/silicon-errata.rst | 46 ++++++
Makefile | 4 +-
arch/arm/include/asm/io.h | 15 +-
arch/arm/mach-socfpga/platsmp.c | 1 +
arch/arm64/Kconfig | 50 ++++++
arch/arm64/include/asm/cputype.h | 6 +
arch/arm64/include/asm/kvm_mmu.h | 4 +-
arch/arm64/include/asm/tlb.h | 2 +-
arch/arm64/include/asm/tlbflush.h | 55 +++++--
arch/arm64/kernel/cpu_errata.c | 34 +++-
arch/arm64/kernel/sys_compat.c | 2 +-
arch/arm64/kvm/hyp/nvhe/tlb.c | 41 +----
arch/arm64/kvm/hyp/vhe/tlb.c | 19 +--
arch/arm64/mm/mmu.c | 36 +++--
arch/x86/kernel/cpu/amd.c | 18 ++-
arch/x86/kernel/cpu/microcode/intel.c | 4 +-
block/blk-cgroup.c | 32 ++--
crypto/testmgr.c | 4 +-
drivers/base/power/domain.c | 10 +-
drivers/block/drbd/drbd_main.c | 2 +-
drivers/block/drbd/drbd_receiver.c | 2 +-
drivers/block/loop.c | 14 +-
drivers/block/nbd.c | 10 +-
drivers/bluetooth/btusb.c | 8 +-
drivers/bluetooth/hci_qca.c | 33 ++--
drivers/char/random.c | 4 +-
drivers/comedi/drivers/comedi_test.c | 5 +-
drivers/crypto/caam/caamalg_qi2.c | 4 +-
drivers/crypto/caam/caamhash.c | 4 +-
drivers/crypto/nx/nx-842.c | 47 +++---
drivers/crypto/nx/nx-842.h | 24 +--
drivers/crypto/nx/nx-common-powernv.c | 31 ++--
drivers/crypto/nx/nx-common-pseries.c | 33 ++--
drivers/dma/idxd/init.c | 1 -
drivers/dma/idxd/sysfs.c | 1 +
drivers/fsi/fsi-sbefifo.c | 6 +-
drivers/gpio/gpio-rockchip.c | 6 +-
.../drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 5 +
drivers/gpu/drm/amd/display/dc/basics/vector.c | 4 +-
drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | 54 ++++---
.../gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c | 3 +-
drivers/gpu/drm/hyperv/hyperv_drm_proto.c | 136 ++++++++++++----
drivers/gpu/drm/i915/display/intel_display_types.h | 1 +
drivers/gpu/drm/i915/display/intel_dpcd.h | 15 ++
drivers/gpu/drm/i915/display/intel_psr.c | 34 +++-
drivers/gpu/drm/i915/gem/i915_gem_phys.c | 19 ++-
drivers/gpu/drm/imx/dcss/dcss-scaler.c | 3 +
drivers/gpu/drm/vc4/vc4_validate_shaders.c | 13 +-
drivers/hid/hid-core.c | 29 +++-
drivers/hid/hid-gfrm.c | 4 +-
drivers/hid/hid-logitech-hidpp.c | 2 +-
drivers/hid/hid-multitouch.c | 2 +-
drivers/hid/hid-primax.c | 2 +-
drivers/hid/hid-vivaldi.c | 2 +-
drivers/hid/wacom_sys.c | 19 ++-
drivers/hid/wacom_wac.h | 1 +
drivers/i2c/busses/i2c-qcom-cci.c | 2 +-
drivers/i2c/busses/i2c-stm32f7.c | 6 +-
drivers/i2c/busses/i2c-tegra.c | 53 +++---
drivers/i2c/i2c-dev.c | 9 +-
drivers/iio/adc/viperboard_adc.c | 4 +-
drivers/iio/adc/xilinx-xadc-core.c | 11 +-
drivers/iio/buffer/industrialio-hw-consumer.c | 4 +-
drivers/iio/chemical/scd30_core.c | 65 ++++----
drivers/iio/common/ssp_sensors/ssp_dev.c | 1 +
drivers/iio/dac/ad5686.c | 8 +-
drivers/iio/dac/ad5686.h | 1 +
drivers/iio/dac/max5821.c | 9 +-
drivers/iio/gyro/adis16260.c | 3 +
drivers/iio/gyro/itg3200_buffer.c | 2 +-
drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c | 2 +-
drivers/iio/light/cm3323.c | 5 +-
drivers/iio/magnetometer/st_magn_core.c | 13 +-
drivers/iio/temperature/tsys01.c | 2 +-
drivers/infiniband/core/Makefile | 2 +-
drivers/infiniband/core/iter.c | 43 +++++
drivers/infiniband/core/verbs.c | 38 -----
drivers/infiniband/hw/bnxt_re/qplib_res.c | 2 +-
drivers/infiniband/hw/cxgb4/mem.c | 2 +-
drivers/infiniband/hw/efa/efa_verbs.c | 2 +-
drivers/infiniband/hw/hns/hns_roce_alloc.c | 2 +-
drivers/infiniband/hw/irdma/main.h | 2 +-
drivers/infiniband/hw/mlx4/mr.c | 1 +
drivers/infiniband/hw/mlx5/mem.c | 1 +
drivers/infiniband/hw/mlx5/mr.c | 1 +
drivers/infiniband/hw/mthca/mthca_provider.c | 2 +-
drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 2 +-
drivers/infiniband/hw/qedr/verbs.c | 2 +-
drivers/infiniband/hw/vmw_pvrdma/pvrdma.h | 2 +-
drivers/infiniband/sw/rxe/rxe_srq.c | 3 -
drivers/infiniband/ulp/isert/ib_isert.c | 6 +
drivers/infiniband/ulp/rtrs/rtrs-clt.c | 2 +-
drivers/infiniband/ulp/srp/ib_srp.c | 30 +++-
drivers/input/keyboard/atkbd.c | 15 ++
drivers/input/misc/ims-pcu.c | 2 +-
drivers/input/mouse/elan_i2c_core.c | 5 +
drivers/input/mouse/synaptics.c | 1 +
drivers/input/touchscreen/atmel_mxt_ts.c | 2 +-
drivers/input/touchscreen/usbtouchscreen.c | 5 +
drivers/iommu/io-pgtable-arm-v7s.c | 18 ++-
drivers/isdn/mISDN/l1oip_core.c | 2 +-
drivers/md/dm-cache-policy-smq.c | 12 +-
drivers/media/rc/igorplugusb.c | 17 +-
drivers/media/rc/ttusbir.c | 13 +-
drivers/misc/fastrpc.c | 77 ++++++---
drivers/misc/vmw_vmci/vmci_queue_pair.c | 6 +-
drivers/mmc/core/mmc.c | 4 +-
drivers/mmc/host/renesas_sdhi_internal_dmac.c | 1 +
drivers/mmc/host/sdhci-of-dwcmshc.c | 17 +-
drivers/mmc/host/sdhci.c | 1 +
drivers/mtd/spi-nor/sst.c | 13 ++
drivers/net/bonding/bond_main.c | 10 +-
drivers/net/can/usb/ucan.c | 6 +-
drivers/net/ethernet/amd/pcnet32.c | 4 +-
drivers/net/ethernet/broadcom/bnxt/bnxt.c | 2 +-
drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c | 2 +-
drivers/net/ethernet/marvell/mv643xx_eth.c | 2 +-
drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 75 +++++----
drivers/net/ethernet/marvell/octeontx2/af/cgx.c | 5 +-
.../ethernet/marvell/octeontx2/nic/otx2_common.c | 2 +
drivers/net/ethernet/microchip/lan743x_main.c | 32 ++++
drivers/net/ethernet/microchip/lan743x_main.h | 1 +
drivers/net/ethernet/qlogic/qed/qed_cxt.c | 26 +--
drivers/net/ethernet/ti/cpsw_new.c | 4 +-
drivers/net/hyperv/netvsc.c | 19 ++-
drivers/net/macsec.c | 3 +-
drivers/net/phy/mscc/mscc.h | 9 +-
drivers/net/phy/mscc/mscc_main.c | 38 +----
drivers/net/ppp/ppp_generic.c | 2 +-
drivers/net/tap.c | 2 +
drivers/net/tun.c | 5 +-
drivers/net/vxlan/vxlan_core.c | 4 +-
drivers/net/wireguard/send.c | 20 +--
.../wireless/broadcom/brcm80211/brcmfmac/btcoex.c | 6 +-
.../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 4 +
drivers/net/wireless/marvell/mwifiex/init.c | 2 +-
drivers/net/wireless/realtek/rtw88/pci.c | 3 +-
drivers/nfc/nxp-nci/i2c.c | 21 ++-
drivers/nvme/host/core.c | 8 +-
drivers/nvme/host/nvme.h | 1 +
drivers/nvme/host/tcp.c | 4 +-
drivers/nvme/target/io-cmd-file.c | 4 +-
drivers/nvme/target/tcp.c | 2 +-
drivers/parport/share.c | 11 +-
drivers/phy/tegra/xusb-tegra186.c | 38 +++--
drivers/phy/tegra/xusb.h | 1 +
drivers/scsi/fcoe/fcoe_ctlr.c | 2 +-
drivers/scsi/hosts.c | 1 +
drivers/scsi/scsi.c | 8 -
drivers/scsi/scsi_pm.c | 44 +----
drivers/scsi/scsi_priv.h | 4 +-
drivers/scsi/scsi_scan.c | 17 ++
drivers/scsi/scsi_sysfs.c | 1 +
drivers/scsi/scsi_transport_fc.c | 77 ++++-----
drivers/scsi/sd.c | 30 ++--
drivers/scsi/sd.h | 9 +-
drivers/scsi/sg.c | 2 +-
drivers/slimbus/qcom-ngd-ctrl.c | 3 -
drivers/spi/spi-lantiq-ssc.c | 8 +-
drivers/spi/spi-qup.c | 165 +++++++++----------
drivers/spi/spi-st-ssc4.c | 8 +-
drivers/spi/spi-sun4i.c | 10 +-
drivers/spi/spi-sun6i.c | 9 +-
drivers/spi/spi-synquacer.c | 8 +-
drivers/spi/spi-tegra114.c | 8 +-
drivers/spi/spi-tegra20-sflash.c | 8 +-
drivers/spi/spi-ti-qspi.c | 15 +-
drivers/spi/spi-topcliff-pch.c | 11 +-
drivers/spi/spi-uniphier.c | 8 +-
drivers/spi/spi-zynq-qspi.c | 15 +-
drivers/staging/greybus/hid.c | 2 +-
drivers/target/iscsi/iscsi_target.c | 6 +-
drivers/target/iscsi/iscsi_target_nego.c | 7 +-
drivers/target/iscsi/iscsi_target_parameters.c | 62 +++++--
drivers/target/iscsi/iscsi_target_parameters.h | 2 +-
drivers/target/iscsi/iscsi_target_util.c | 4 +-
drivers/target/target_core_file.c | 2 +-
drivers/tee/optee/supp.c | 107 ++++++++----
drivers/thermal/thermal_core.c | 7 +-
drivers/thunderbolt/property.c | 38 +++--
drivers/thunderbolt/xdomain.c | 6 +-
drivers/tty/serial/altera_jtaguart.c | 18 ++-
drivers/tty/serial/dz.c | 58 ++++---
drivers/tty/serial/fsl_lpuart.c | 15 +-
drivers/tty/serial/pch_uart.c | 19 ++-
drivers/tty/serial/qcom_geni_serial.c | 75 ++++-----
drivers/tty/serial/samsung_tty.c | 88 +++++-----
drivers/tty/serial/sh-sci.c | 2 +-
drivers/tty/serial/zs.c | 40 ++---
drivers/tty/serial/zs.h | 2 +-
drivers/usb/cdns3/cdns3-gadget.c | 12 +-
drivers/usb/cdns3/cdns3-plat.c | 11 +-
drivers/usb/chipidea/core.c | 16 +-
drivers/usb/class/usbtmc.c | 14 ++
drivers/usb/core/config.c | 9 +-
drivers/usb/core/hcd.c | 4 +-
drivers/usb/core/quirks.c | 4 +
drivers/usb/dwc2/hcd.c | 4 +-
drivers/usb/dwc3/core.c | 12 +-
drivers/usb/dwc3/dwc3-xilinx.c | 20 +--
drivers/usb/gadget/function/f_fs.c | 2 +-
drivers/usb/gadget/function/f_hid.c | 20 +--
drivers/usb/gadget/udc/dummy_hcd.c | 4 +
drivers/usb/gadget/udc/net2280.c | 4 +-
drivers/usb/host/xhci-tegra.c | 76 +++++----
drivers/usb/serial/belkin_sa.c | 3 +
drivers/usb/serial/cypress_m8.c | 20 ++-
drivers/usb/serial/digi_acceleport.c | 23 ++-
drivers/usb/serial/io_ti.c | 11 ++
drivers/usb/serial/keyspan.c | 4 +
drivers/usb/serial/kl5kusb105.c | 4 +-
drivers/usb/serial/mct_u232.c | 26 +--
drivers/usb/serial/mxuport.c | 8 +
drivers/usb/serial/omninet.c | 9 +-
drivers/usb/serial/option.c | 12 +-
drivers/usb/serial/safe_serial.c | 11 ++
drivers/usb/storage/unusual_uas.h | 7 +
drivers/usb/typec/altmodes/displayport.c | 2 +
drivers/usb/typec/tcpm/tcpm.c | 2 +
drivers/usb/typec/tcpm/wcove.c | 13 +-
drivers/usb/typec/ucsi/displayport.c | 4 +
drivers/usb/typec/ucsi/ucsi.c | 7 +-
drivers/usb/typec/ucsi/ucsi_ccg.c | 5 +
drivers/usb/usbip/usbip_common.c | 2 +-
drivers/usb/usbip/vudc_dev.c | 1 +
drivers/usb/usbip/vudc_transfer.c | 3 +-
drivers/vhost/net.c | 6 +-
drivers/vhost/scsi.c | 10 +-
drivers/vhost/vhost.c | 6 +-
drivers/vhost/vringh.c | 4 +-
drivers/vhost/vsock.c | 4 +-
drivers/video/fbdev/core/fb_defio.c | 152 +++++++++++++++--
drivers/video/fbdev/core/fbcon_rotate.c | 5 +-
drivers/video/fbdev/vt8500lcdfb.c | 2 +-
drivers/xen/pvcalls-back.c | 8 +-
fs/9p/vfs_addr.c | 4 +-
fs/9p/vfs_dir.c | 2 +-
fs/9p/xattr.c | 4 +-
fs/afs/cmservice.c | 2 +-
fs/afs/dir.c | 2 +-
fs/afs/file.c | 4 +-
fs/afs/internal.h | 4 +-
fs/afs/rxrpc.c | 10 +-
fs/afs/write.c | 4 +-
fs/aio.c | 4 +-
fs/btrfs/inode.c | 2 +
fs/btrfs/ioctl.c | 5 +-
fs/ceph/addr.c | 2 +-
fs/ceph/dir.c | 6 +-
fs/ceph/file.c | 4 +-
fs/cifs/cifsacl.c | 129 +++++++++++++--
fs/cifs/connect.c | 6 +-
fs/cifs/file.c | 4 +-
fs/cifs/ioctl.c | 2 +-
fs/cifs/netlink.c | 6 +-
fs/cifs/smb2ops.c | 10 +-
fs/cifs/smb2transport.c | 36 +++--
fs/cifs/smbdirect.c | 4 +-
fs/cifs/transport.c | 6 +-
fs/erofs/decompressor.c | 1 +
fs/erofs/dir.c | 30 ++--
fs/ext4/extents.c | 15 ++
fs/f2fs/data.c | 4 +-
fs/f2fs/f2fs.h | 5 +-
fs/f2fs/inline.c | 13 +-
fs/f2fs/segment.c | 6 +-
fs/f2fs/super.c | 20 ++-
fs/fcntl.c | 8 +-
fs/fuse/dev.c | 9 +-
fs/fuse/ioctl.c | 4 +-
fs/hfsplus/bfind.c | 51 ++++++
fs/hfsplus/catalog.c | 4 +-
fs/hfsplus/dir.c | 2 +-
fs/hfsplus/hfsplus_fs.h | 9 ++
fs/hfsplus/super.c | 6 +-
fs/hpfs/alloc.c | 2 +-
fs/ksmbd/auth.c | 4 +-
fs/ksmbd/smb2pdu.c | 5 +-
fs/ksmbd/smbacl.c | 17 +-
fs/ksmbd/transport_tcp.c | 4 +-
fs/nfsd/nfs4xdr.c | 9 +-
fs/nfsd/nfsctl.c | 9 +-
fs/nfsd/state.h | 17 +-
fs/nfsd/stats.c | 4 +-
fs/nfsd/stats.h | 2 +-
fs/nfsd/vfs.c | 4 +-
fs/ntfs3/xattr.c | 1 +
fs/ocfs2/cluster/tcp.c | 2 +-
fs/orangefs/inode.c | 8 +-
fs/read_write.c | 12 +-
fs/seq_file.c | 2 +-
fs/splice.c | 10 +-
fs/udf/super.c | 4 +-
include/drm/drm_dp_helper.h | 1 +
include/drm/drm_fourcc.h | 5 +-
include/linux/compat.h | 4 +
include/linux/compiler-clang.h | 28 ++++
include/linux/compiler_attributes.h | 11 ++
include/linux/compiler_types.h | 4 +
include/linux/fb.h | 4 +-
include/linux/hid.h | 15 +-
include/linux/parport.h | 1 +
include/linux/printk.h | 13 ++
include/linux/randomize_kstack.h | 44 ++++-
include/linux/sched.h | 4 +
include/linux/syscalls.h | 4 +
include/linux/uio.h | 3 +
include/net/act_api.h | 1 +
include/net/bluetooth/bluetooth.h | 3 +
include/net/bluetooth/l2cap.h | 1 +
include/net/genetlink.h | 9 +-
include/net/ip_vs.h | 3 +-
include/net/mctp.h | 3 +
include/net/sock.h | 1 +
include/net/xfrm.h | 3 +-
include/rdma/ib_umem.h | 36 +----
include/rdma/ib_verbs.h | 48 ------
include/rdma/iter.h | 88 ++++++++++
init/main.c | 1 -
io_uring/io_uring.c | 2 +-
ipc/shm.c | 10 +-
ipc/util.c | 2 +-
kernel/fork.c | 2 +
kernel/pid.c | 8 +-
kernel/sched/core.c | 2 +-
kernel/sched/rt.c | 2 +-
kernel/sched/sched.h | 2 +-
kernel/signal.c | 1 +
kernel/time/time.c | 2 +-
kernel/trace/trace_probe.c | 6 +
kernel/trace/trace_probe.h | 4 +-
kernel/tracepoint.c | 2 +
lib/debugobjects.c | 2 +-
lib/mpi/mpicoder.c | 2 +-
mm/damon/vaddr.c | 4 +-
mm/huge_memory.c | 2 +
mm/hugetlb.c | 1 +
mm/madvise.c | 2 +-
mm/page_io.c | 2 +-
mm/process_vm_access.c | 2 +-
net/6lowpan/iphc.c | 4 +-
net/802/garp.c | 2 +-
net/802/mrp.c | 9 ++
net/9p/client.c | 2 +-
net/batman-adv/bat_iv_ogm.c | 82 ++++++++--
net/batman-adv/bat_v_ogm.c | 59 ++++---
net/batman-adv/bridge_loop_avoidance.c | 57 ++++---
net/batman-adv/main.c | 1 +
net/batman-adv/soft-interface.c | 1 +
net/batman-adv/tp_meter.c | 109 +++++++++----
net/batman-adv/tp_meter.h | 1 +
net/batman-adv/translation-table.c | 35 +++-
net/batman-adv/tvlv.c | 28 +++-
net/batman-adv/tvlv.h | 2 +-
net/batman-adv/types.h | 46 +++++-
net/bluetooth/6lowpan.c | 4 +-
net/bluetooth/a2mp.c | 2 +-
net/bluetooth/af_bluetooth.c | 144 ++++++++++++++---
net/bluetooth/bnep/core.c | 50 ++++--
net/bluetooth/bnep/sock.c | 10 +-
net/bluetooth/hci_event.c | 18 ++-
net/bluetooth/hci_sock.c | 10 +-
net/bluetooth/hci_sysfs.c | 6 +-
net/bluetooth/hidp/core.c | 23 ++-
net/bluetooth/hidp/sock.c | 10 +-
net/bluetooth/l2cap_core.c | 87 +++++++++-
net/bluetooth/l2cap_sock.c | 86 +++++-----
net/bluetooth/mgmt.c | 20 ++-
net/bluetooth/rfcomm/core.c | 69 +++++---
net/bluetooth/rfcomm/sock.c | 48 ++++--
net/bluetooth/sco.c | 19 ++-
net/bluetooth/smp.c | 2 +-
net/bridge/br_arp_nd_proxy.c | 8 +-
net/bridge/br_fdb.c | 28 ++--
net/bridge/netfilter/ebt_snat.c | 3 +
net/bridge/netfilter/ebtables.c | 30 ++++
net/ceph/messenger_v1.c | 4 +-
net/ceph/messenger_v2.c | 14 +-
net/compat.c | 2 +-
net/core/drop_monitor.c | 2 +-
net/core/filter.c | 17 +-
net/core/skbuff.c | 10 +-
net/ethtool/eeprom.c | 5 +-
net/hsr/hsr_framereg.c | 6 +-
net/ieee802154/6lowpan/tx.c | 5 +
net/ipv4/ah4.c | 31 ++--
net/ipv4/esp4.c | 4 +-
net/ipv4/ip_options.c | 4 +
net/ipv4/ip_tunnel_core.c | 22 ++-
net/ipv4/netfilter/arp_tables.c | 15 +-
net/ipv4/netfilter/ip_tables.c | 15 +-
net/ipv4/netfilter/nft_fib_ipv4.c | 2 +-
net/ipv4/sysctl_net_ipv4.c | 2 +-
net/ipv4/tcp.c | 4 +-
net/ipv4/tcp_ipv4.c | 5 +-
net/ipv6/addrconf.c | 47 +++---
net/ipv6/ah6.c | 29 ++--
net/ipv6/datagram.c | 54 ++++++-
net/ipv6/esp6.c | 4 +-
net/ipv6/exthdrs.c | 28 +++-
net/ipv6/ioam6.c | 12 +-
net/ipv6/ip6_input.c | 2 +-
net/ipv6/ip6_vti.c | 25 ++-
net/ipv6/mcast.c | 22 +--
net/ipv6/ndisc.c | 12 +-
net/ipv6/netfilter/ip6_tables.c | 15 +-
net/ipv6/netfilter/nft_fib_ipv6.c | 2 +-
net/ipv6/seg6_hmac.c | 8 +-
net/ipv6/sit.c | 1 +
net/ipv6/tcp_ipv6.c | 5 +-
net/iucv/af_iucv.c | 20 ++-
net/key/af_key.c | 6 +-
net/mctp/device.c | 1 +
net/mctp/neigh.c | 1 +
net/mctp/route.c | 9 +-
net/mptcp/options.c | 29 ++--
net/mptcp/pm.c | 34 +++-
net/mptcp/pm_netlink.c | 31 +++-
net/mptcp/protocol.c | 26 ++-
net/mptcp/sockopt.c | 8 +-
net/netfilter/ipvs/ip_vs_ctl.c | 13 +-
net/netfilter/ipvs/ip_vs_proto_sctp.c | 18 +--
net/netfilter/ipvs/ip_vs_proto_tcp.c | 21 +--
net/netfilter/ipvs/ip_vs_proto_udp.c | 20 +--
net/netfilter/ipvs/ip_vs_sched.c | 14 +-
net/netfilter/ipvs/ip_vs_sync.c | 2 +-
net/netfilter/nf_conntrack_irc.c | 4 +-
net/netfilter/nf_conntrack_proto_tcp.c | 3 +-
net/netfilter/nf_log_syslog.c | 4 +-
net/netfilter/nf_synproxy_core.c | 26 ++-
net/netfilter/nft_exthdr.c | 3 +
net/netfilter/nft_fib.c | 6 +
net/netfilter/nft_tunnel.c | 2 +-
net/netfilter/xt_NFQUEUE.c | 2 +-
net/netfilter/xt_cpu.c | 2 +-
net/netlabel/netlabel_unlabeled.c | 30 ++--
net/netlink/af_netlink.c | 11 +-
net/netlink/genetlink.c | 4 +-
net/nfc/hci/core.c | 10 ++
net/nfc/llcp_core.c | 11 ++
net/nfc/llcp_sock.c | 2 +
net/nfc/nci/hci.c | 10 ++
net/openvswitch/datapath.c | 1 +
net/packet/af_packet.c | 25 +--
net/psample/psample.c | 2 +-
net/qrtr/af_qrtr.c | 4 +-
net/qrtr/ns.c | 180 ++++++++-------------
net/rds/ib_cm.c | 1 +
net/rds/ib_send.c | 2 +
net/rds/info.c | 2 +-
net/sched/act_api.c | 7 +-
net/sched/cls_fw.c | 6 +-
net/sched/sch_netem.c | 40 -----
net/sched/sch_sfb.c | 2 +-
net/sctp/diag.c | 17 +-
net/sctp/input.c | 8 +
net/sctp/sm_statefuns.c | 6 +-
net/sctp/socket.c | 2 +
net/sctp/stream.c | 6 +-
net/smc/af_smc.c | 4 +-
net/smc/smc_clc.c | 6 +-
net/socket.c | 23 +--
net/sunrpc/socklib.c | 6 +-
net/sunrpc/svcsock.c | 4 +-
net/sunrpc/xprtsock.c | 6 +-
net/tipc/topsrv.c | 2 +-
net/tls/tls_device.c | 4 +-
net/vmw_vsock/vmci_transport.c | 4 +-
net/xfrm/espintcp.c | 6 +-
net/xfrm/xfrm_input.c | 16 +-
net/xfrm/xfrm_policy.c | 15 +-
net/xfrm/xfrm_state.c | 35 ++--
net/xfrm/xfrm_user.c | 5 +-
security/apparmor/policy_unpack.c | 27 ++--
security/keys/keyctl.c | 4 +-
security/selinux/hooks.c | 3 +-
sound/aoa/codecs/onyx.c | 104 ++++--------
sound/aoa/codecs/tas.c | 113 +++++--------
sound/aoa/core/gpio-feature.c | 20 +--
sound/aoa/core/gpio-pmf.c | 26 ++-
sound/aoa/soundbus/i2sbus/core.c | 3 +
sound/aoa/soundbus/i2sbus/pcm.c | 143 ++++++++--------
sound/core/misc.c | 14 +-
sound/core/timer.c | 1 +
sound/drivers/aloop.c | 40 +++--
sound/pci/hda/patch_hdmi.c | 1 +
sound/soc/codecs/simple-mux.c | 2 +-
sound/soc/intel/boards/bytcht_es8316.c | 29 +++-
sound/soc/qcom/qdsp6/q6asm-dai.c | 43 ++---
tools/testing/selftests/net/forwarding/lib.sh | 56 +++++++
tools/testing/selftests/net/mptcp/mptcp_connect.sh | 6 +-
491 files changed, 4845 insertions(+), 2652 deletions(-)
^ permalink raw reply [flat|nested] 3+ messages in thread* [PATCH 5.15 259/411] arm64/mm: Enable batched TLB flush in unmap_hotplug_range() 2026-06-16 14:53 [PATCH 5.15 000/411] 5.15.210-rc1 review Greg Kroah-Hartman @ 2026-06-16 14:58 ` Greg Kroah-Hartman 2026-06-16 16:55 ` [PATCH 5.15 000/411] 5.15.210-rc1 review Brett A C Sheffield 1 sibling, 0 replies; 3+ messages in thread From: Greg Kroah-Hartman @ 2026-06-16 14:58 UTC (permalink / raw) To: stable Cc: Greg Kroah-Hartman, patches, Will Deacon, linux-arm-kernel, linux-kernel, David Hildenbrand (Arm), Ryan Roberts, Anshuman Khandual, Catalin Marinas, Sasha Levin 5.15-stable review patch. If anyone has any objections, please let me know. ------------------ From: Anshuman Khandual <anshuman.khandual@arm.com> [ Upstream commit 48478b9f791376b4b89018d7afdfd06865498f65 ] During a memory hot remove operation, both linear and vmemmap mappings for the memory range being removed, get unmapped via unmap_hotplug_range() but mapped pages get freed only for vmemmap mapping. This is just a sequential operation where each table entry gets cleared, followed by a leaf specific TLB flush, and then followed by memory free operation when applicable. This approach was simple and uniform both for vmemmap and linear mappings. But linear mapping might contain CONT marked block memory where it becomes necessary to first clear out all entire in the range before a TLB flush. This is as per the architecture requirement. Hence batch all TLB flushes during the table tear down walk and finally do it in unmap_hotplug_range(). Prior to this fix, it was hypothetically possible for a speculative access to a higher address in the contiguous block to fill the TLB with shattered entries for the entire contiguous range after a lower address had already been cleared and invalidated. Due to the table entries being shattered, the subsequent TLB invalidation for the higher address would not then clear the TLB entries for the lower address, meaning stale TLB entries could persist. Besides it also helps in improving the performance via TLBI range operation along with reduced synchronization instructions. The time spent executing unmap_hotplug_range() improved 97% measured over a 2GB memory hot removal in KVM guest. This scheme is not applicable during vmemmap mapping tear down where memory needs to be freed and hence a TLB flush is required after clearing out page table entry. Cc: Will Deacon <will@kernel.org> Cc: linux-arm-kernel@lists.infradead.org Cc: linux-kernel@vger.kernel.org Closes: https://lore.kernel.org/all/aWZYXhrT6D2M-7-N@willie-the-truck/ Fixes: bbd6ec605c0f ("arm64/mm: Enable memory hot remove") Cc: stable@vger.kernel.org Reviewed-by: David Hildenbrand (Arm) <david@kernel.org> Reviewed-by: Ryan Roberts <ryan.roberts@arm.com> Signed-off-by: Ryan Roberts <ryan.roberts@arm.com> Signed-off-by: Anshuman Khandual <anshuman.khandual@arm.com> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com> [ replaced `__pte_clear()` with `pte_clear()` ] Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> --- arch/arm64/mm/mmu.c | 36 ++++++++++++++++++++---------------- 1 file changed, 20 insertions(+), 16 deletions(-) --- a/arch/arm64/mm/mmu.c +++ b/arch/arm64/mm/mmu.c @@ -886,10 +886,14 @@ static void unmap_hotplug_pte_range(pmd_ WARN_ON(!pte_present(pte)); pte_clear(&init_mm, addr, ptep); - flush_tlb_kernel_range(addr, addr + PAGE_SIZE); - if (free_mapped) + if (free_mapped) { + /* CONT blocks are not supported in the vmemmap */ + WARN_ON(pte_cont(pte)); + flush_tlb_kernel_range(addr, addr + PAGE_SIZE); free_hotplug_page_range(pte_page(pte), PAGE_SIZE, altmap); + } + /* unmap_hotplug_range() flushes TLB for !free_mapped */ } while (addr += PAGE_SIZE, addr < end); } @@ -910,15 +914,14 @@ static void unmap_hotplug_pmd_range(pud_ WARN_ON(!pmd_present(pmd)); if (pmd_sect(pmd)) { pmd_clear(pmdp); - - /* - * One TLBI should be sufficient here as the PMD_SIZE - * range is mapped with a single block entry. - */ - flush_tlb_kernel_range(addr, addr + PAGE_SIZE); - if (free_mapped) + if (free_mapped) { + /* CONT blocks are not supported in the vmemmap */ + WARN_ON(pmd_cont(pmd)); + flush_tlb_kernel_range(addr, addr + PMD_SIZE); free_hotplug_page_range(pmd_page(pmd), PMD_SIZE, altmap); + } + /* unmap_hotplug_range() flushes TLB for !free_mapped */ continue; } WARN_ON(!pmd_table(pmd)); @@ -943,15 +946,12 @@ static void unmap_hotplug_pud_range(p4d_ WARN_ON(!pud_present(pud)); if (pud_sect(pud)) { pud_clear(pudp); - - /* - * One TLBI should be sufficient here as the PUD_SIZE - * range is mapped with a single block entry. - */ - flush_tlb_kernel_range(addr, addr + PAGE_SIZE); - if (free_mapped) + if (free_mapped) { + flush_tlb_kernel_range(addr, addr + PUD_SIZE); free_hotplug_page_range(pud_page(pud), PUD_SIZE, altmap); + } + /* unmap_hotplug_range() flushes TLB for !free_mapped */ continue; } WARN_ON(!pud_table(pud)); @@ -981,6 +981,7 @@ static void unmap_hotplug_p4d_range(pgd_ static void unmap_hotplug_range(unsigned long addr, unsigned long end, bool free_mapped, struct vmem_altmap *altmap) { + unsigned long start = addr; unsigned long next; pgd_t *pgdp, pgd; @@ -1002,6 +1003,9 @@ static void unmap_hotplug_range(unsigned WARN_ON(!pgd_present(pgd)); unmap_hotplug_p4d_range(pgdp, addr, next, free_mapped, altmap); } while (addr = next, addr < end); + + if (!free_mapped) + flush_tlb_kernel_range(start, end); } static void free_empty_pte_table(pmd_t *pmdp, unsigned long addr, ^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH 5.15 000/411] 5.15.210-rc1 review 2026-06-16 14:53 [PATCH 5.15 000/411] 5.15.210-rc1 review Greg Kroah-Hartman 2026-06-16 14:58 ` [PATCH 5.15 259/411] arm64/mm: Enable batched TLB flush in unmap_hotplug_range() Greg Kroah-Hartman @ 2026-06-16 16:55 ` Brett A C Sheffield 1 sibling, 0 replies; 3+ messages in thread From: Brett A C Sheffield @ 2026-06-16 16:55 UTC (permalink / raw) To: gregkh Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah, patches, lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill, sr, Brett A C Sheffield # Librecast Test Results 020/020 [ OK ] liblcrq 010/010 [ OK ] libmld 120/120 [ OK ] liblibrecast CPU/kernel: Linux auntie 5.15.210-rc1-01182-g1447d275e58b #1 SMP Tue Jun 16 15:49:14 -00 2026 x86_64 AMD Ryzen 9 9950X 16-Core Processor AuthenticAMD GNU/Linux Tested-by: Brett A C Sheffield <bacs@librecast.net> ^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-06-16 18:29 UTC | newest] Thread overview: 3+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2026-06-16 14:53 [PATCH 5.15 000/411] 5.15.210-rc1 review Greg Kroah-Hartman 2026-06-16 14:58 ` [PATCH 5.15 259/411] arm64/mm: Enable batched TLB flush in unmap_hotplug_range() Greg Kroah-Hartman 2026-06-16 16:55 ` [PATCH 5.15 000/411] 5.15.210-rc1 review Brett A C Sheffield
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox