* [PATCH 6.1 000/522] 6.1.176-rc1 review
@ 2026-06-16 14:52 Greg Kroah-Hartman
2026-06-16 14:58 ` [PATCH 6.1 337/522] arm64/mm: Enable batched TLB flush in unmap_hotplug_range() Greg Kroah-Hartman
2026-06-16 16:55 ` [PATCH 6.1 000/522] 6.1.176-rc1 review Brett A C Sheffield
0 siblings, 2 replies; 3+ messages in thread
From: Greg Kroah-Hartman @ 2026-06-16 14:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, linux-kernel, torvalds, akpm, linux,
shuah, patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill, sr
This is the start of the stable review cycle for the 6.1.176 release.
There are 522 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Thu, 18 Jun 2026 14:49:57 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.176-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Linux 6.1.176-rc1
Borislav Petkov (AMD) <bp@alien8.de>
x86/CPU/AMD: Move the Zen3 BTC_NO detection to the Zen3 init function
Ben Hutchings <benh@debian.org>
apparmor: validate default DFA states are in bounds
Ben Hutchings <benh@debian.org>
fbdev: vt8500lcdfb: Fix dma_free_coherent() cpu_addr parameter
Petr Machata <petrm@nvidia.com>
Revert "selftest/ptp: update ptp selftest to exercise the gettimex options"
Will Deacon <will@kernel.org>
arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU
Shanker Donthineni <sdonthineni@nvidia.com>
arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU
Mark Rutland <mark.rutland@arm.com>
arm64: errata: Mitigate TLBI errata on various Arm CPUs
Mark Rutland <mark.rutland@arm.com>
arm64: cputype: Add C1-Premium definitions
Mark Rutland <mark.rutland@arm.com>
arm64: cputype: Add C1-Ultra definitions
Shanker Donthineni <sdonthineni@nvidia.com>
arm64: cputype: Add NVIDIA Olympus definitions
Ashutosh Desai <ashutoshdesai993@gmail.com>
drm/v3d: Reject empty multisync extension to prevent infinite loop
SeongJae Park <sj@kernel.org>
mm/damon/reclaim: detect and use fresh enabled and kdamond_pid values
SeongJae Park <sj@kernel.org>
mm/damon/lru_sort: detect and use fresh enabled and kdamond_pid values
SeongJae Park <sj@kernel.org>
mm/damon/core: implement damon_kdamond_pid()
Corey Minyard <corey@minyard.net>
ipmi:ssif: NULL thread on error
Corey Minyard <corey@minyard.net>
ipmi:ssif: Remove unnecessary indention
Lukas Wunner <lukas@wunner.de>
lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl()
Amit Sunil Dhamne <amitsd@google.com>
usb: typec: tcpm: reset internal port states on soft reset AMS
SeongJae Park <sj@kernel.org>
mm/damon/core: disallow time-quota setting zero esz
SeongJae Park <sj@kernel.org>
mm/damon/core: use time_in_range_open() for damos quota window start
Corey Minyard <corey@minyard.net>
ipmi:ssif: Clean up kthread on errors
Corey Minyard <corey@minyard.net>
ipmi:ssif: Fix a shutdown race
Marc Zyngier <maz@kernel.org>
KVM: arm64: Wake-up from WFI when iqrchip is in userspace
Arnaldo Carvalho de Melo <acme@redhat.com>
perf build: Remove -Wno-unused-but-set-variable from the flex flags when building with clang < 13.0.0
Arnaldo Carvalho de Melo <acme@redhat.com>
tools build: Add 3-component logical version comparators
Ian Rogers <irogers@google.com>
perf build: Disable fewer bison warnings
Ian Rogers <irogers@google.com>
perf parse-events: Make YYDEBUG dependent on doing a debug build
Ian Rogers <irogers@google.com>
perf build: Conditionally define NDEBUG
Aaron Erhardt <aer@tuxedocomputers.com>
ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6
Sven Eckelmann <sven@narfation.org>
batman-adv: tp_meter: fix tp_num leak on kmalloc failure
Jiexun Wang <wangjiexun2025@gmail.com>
batman-adv: stop tp_meter sessions during mesh teardown
Tejun Heo <tj@kernel.org>
blk-cgroup: Fix NULL deref caused by blkg_policy_data being installed before init
Julian Anastasov <ja@ssi.bg>
ipvs: skip ipv6 extension headers for csum checks
Jason Gunthorpe <jgg@ziepe.ca>
RDMA/umem: Fix truncation for block sizes >= 4G
Leon Romanovsky <leon@kernel.org>
RDMA: Move DMA block iterator logic into dedicated files
Randy Dunlap <rdunlap@infradead.org>
RDMA/umem: fix kernel-doc warnings
Wupeng Ma <mawupeng1@huawei.com>
mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison
Jane Chu <jane.chu@oracle.com>
mm/memory-failure: fix missing ->mf_stats count in hugetlb poison
David Hildenbrand <david@redhat.com>
mm/hugetlb: rename folio_putback_active_hugetlb() to folio_putback_hugetlb()
David Hildenbrand <david@redhat.com>
mm/migrate: don't call folio_putback_active_hugetlb() on dst hugetlb folio
David Hildenbrand <david@redhat.com>
mm/hugetlb: rename isolate_hugetlb() to folio_isolate_hugetlb()
Anton Leontev <leontyevantony@gmail.com>
hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf
Davide Ornaghi <d.ornaghi97@gmail.com>
netfilter: nft_fib: fix stale stack leak via the OIFNAME register
Myrrh Periwinkle <myrrhperiwinkle@qtmlabs.xyz>
usb: typec: ucsi: Don't update power_supply on power role change if not connected
Michael Bommarito <michael.bommarito@gmail.com>
scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()
Prasanna S <prasanna.s@oss.qualcomm.com>
serial: qcom-geni: fix UART_RX_PAR_EN bit position
Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
tty: serial: qcom-geni-serial: align #define values
Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
tty: serial: qcom-geni-serial: remove unused symbols
Michael Bommarito <michael.bommarito@gmail.com>
thunderbolt: property: Cap recursion depth in __tb_property_parse_dir()
Myrrh Periwinkle <myrrhperiwinkle@qtmlabs.xyz>
usb: typec: ucsi: Check if power role change actually happened before handling
Guangshuo Li <lgs201920130244@gmail.com>
usb: gadget: f_hid: fix device reference leak in hidg_alloc()
John Keeping <john@metanate.com>
usb: gadget: f_hid: tidy error handling in hidg_alloc
Wentao Liang <vulab@iscas.ac.cn>
usb: musb: omap2430: Fix use-after-free in omap2430_probe()
Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
usb: dwc3: xilinx: fix error handling in zynqmp init error paths
Tudor Ambarus <tudor.ambarus@linaro.org>
tty: serial: samsung: Remove redundant port lock acquisition in rx helpers
Tudor Ambarus <tudor.ambarus@linaro.org>
tty: serial: samsung: use u32 for register interactions
Thomas Gleixner <tglx@linutronix.de>
serial: samsung_tty: Use port lock wrappers
Cássio Gabriel <cassiogabrielcontato@gmail.com>
ALSA: firewire-motu: Protect register DSP event queue positions
Rodrigo Alencar <rodrigo.alencar@analog.com>
iio: dac: ad5686: fix ref bit initialization for single-channel parts
Peter Chen <peter.chen@cixtech.com>
usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure
Antoniu Miclaus <antoniu.miclaus@analog.com>
iio: chemical: scd30: fix division by zero in write_raw
Jonathan Cameron <Jonathan.Cameron@huawei.com>
iio: chemical: scd30: Use guard(mutex) to allow early returns
Antoniu Miclaus <antoniu.miclaus@analog.com>
iio: gyro: adis16260: fix division by zero in write_raw
David Carlier <devnexen@gmail.com>
iio: adc: npcm: fix unbalanced clk_disable_unprepare()
Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
iio: adc: npcm: Convert to platform remove callback returning void
Ruan Jinjie <ruanjinjie@huawei.com>
iio: adc: fix the return value handle for platform_get_irq()
Wayne Chang <waynec@nvidia.com>
phy: tegra: xusb: Fix per-pad high-speed termination calibration
Wayne Chang <waynec@nvidia.com>
phy: tegra: xusb: Disable trk clk when not in use
Zeng Heng <zengheng4@huawei.com>
arm64: tlb: Flush walk cache when unsharing PMD tables
Johan Hovold <johan@kernel.org>
spi: qup: fix error pointer deref after DMA setup failure
Yang Yingliang <yangyingliang@huawei.com>
spi: qup: switch to use modern name
Dawei Feng <dawei.feng@seu.edu.cn>
octeontx2-pf: avoid double free of pool->stack on AQ init failure
Lukas Wunner <lukas@wunner.de>
platform/x86/intel/vsec: Fix enable_cnt imbalance on PCIe error recovery
David E. Box <david.e.box@linux.intel.com>
platform/x86/intel/vsec: Make driver_data info const
David E. Box <david.e.box@linux.intel.com>
platform/x86/intel/vsec: Create wrapper to walk PCI config space
David E. Box <david.e.box@linux.intel.com>
platform/x86/intel/vsec: Add private data for per-device data
Shardul Bankar <shardul.b@mpiricsoftware.com>
mptcp: do not drop partial packets
Paolo Abeni <pabeni@redhat.com>
mptcp: reset rcv wnd on disconnect
Sam Daly <sam@samdaly.ie>
octeontx2-af: CGX: add bounds check to cgx_speed_mbps index
Justin Stitt <justinstitt@google.com>
octeontx2-af: replace deprecated strncpy with strscpy
Matthieu Baerts (NGI0) <matttbe@kernel.org>
selftests: mptcp: drop nanoseconds width specifier
Li Xiasong <lixiasong1@huawei.com>
mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient
Jose Ignacio Tornos Martinez <jtornosm@redhat.com>
ice: fix VF queue configuration with low MTU values
Justin Iurman <justin.iurman@gmail.com>
ipv6: ioam: add NULL check for idev in ipv6_hop_ioam()
Michael Bommarito <michael.bommarito@gmail.com>
net: hsr: defer node table free until after RCU readers
Jiexun Wang <wangjiexun2025@gmail.com>
Bluetooth: serialize accept_q access
Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Bluetooth: Init sk_peer_* on bt_sock_alloc
Alistair Popple <apopple@nvidia.com>
mm/memory: fix spurious warning when unmapping device-private/exclusive pages
Shuai Zhang <shuai.zhang@oss.qualcomm.com>
Bluetooth: hci_qca: Convert timeout from jiffies to ms
Michael Bommarito <michael.bommarito@gmail.com>
smb: client: require net admin for CIFS SWN netlink
Ido Schimmel <idosch@nvidia.com>
genetlink: Use internal flags for multicast groups
Guopeng Zhang <zhangguopeng@kylinos.cn>
cgroup/cpuset: Reset DL migration state on can_attach() failure
Johan Hovold <johan@kernel.org>
spi: lantiq-ssc: fix controller deregistration
Johan Hovold <johan@kernel.org>
spi: st-ssc4: fix controller deregistration
Yang Yingliang <yangyingliang@huawei.com>
spi: st-ssc4: switch to use modern name
Chao Yu <chao@kernel.org>
f2fs: fix false alarm of lockdep on cp_global_sem lock
Yongpeng Yang <yangyongpeng@xiaomi.com>
f2fs: fix incorrect file address mapping when inline inode is unwritten
Matthieu Baerts (NGI0) <matttbe@kernel.org>
mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker
Matthieu Baerts (NGI0) <matttbe@kernel.org>
mptcp: pm: ADD_ADDR rtx: fix potential data-race
Matthieu Baerts (NGI0) <matttbe@kernel.org>
mptcp: pm: ADD_ADDR rtx: allow ID 0
Matthieu Baerts (NGI0) <matttbe@kernel.org>
mptcp: pm: kernel: correctly retransmit ADD_ADDR ID 0
Matthieu Baerts (NGI0) <matttbe@kernel.org>
mptcp: pm: prio: skip closed subflows
Matthieu Baerts (NGI0) <matttbe@kernel.org>
mptcp: fastclose msk when linger time is 0
Filipe Manana <fdmanana@suse.com>
btrfs: fix missing last_unlink_trans update when removing a directory
Piyush Sachdeva <s.piyush1024@gmail.com>
smb: client: Use FullSessionKey for AES-256 encryption key derivation
Michael Bommarito <michael.bommarito@gmail.com>
smb: client: validate dacloffset before building DACL pointers
Ulf Hansson <ulf.hansson@linaro.org>
pmdomain: core: Fix detach procedure for virtual devices in genpd
Guangshuo Li <lgs201920130244@gmail.com>
btrfs: fix double free in create_space_info_sub_group() error path
Filipe Manana <fdmanana@suse.com>
btrfs: remove fs_info argument from btrfs_sysfs_add_space_info_type()
Steven Rostedt <rostedt@goodmis.org>
tracing/probes: Limit size of event probe to 3K
Yochai Eisenrich <yochaie@sweet.security>
btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak
Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
spi: topcliff-pch: Convert to platform remove callback returning void
Thomas Zimmermann <tzimmermann@suse.de>
fbcon: Avoid OOB font access if console rotation fails
Johan Hovold <johan@kernel.org>
spi: microchip-core-qspi: fix controller deregistration
Li Zetao <lizetao1@huawei.com>
spi: microchip-core-qspi: Use helper function devm_clk_get_enabled()
Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
spi: microchip-core-qspi: Convert to platform remove callback returning void
Pavitra Jha <jhapavitra98@gmail.com>
net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler
Sang-Heon Jeon <ekffu200098@gmail.com>
mm/hugetlb_cma: round up per_node before logging it
Johan Hovold <johan@kernel.org>
spi: uniphier: fix controller deregistration
Pei Xiao <xiaopei01@kylinos.cn>
spi: uniphier: Simplify clock handling with devm_clk_get_enabled()
Yang Yingliang <yangyingliang@huawei.com>
spi: uniphier: switch to use modern name
Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
spi: uniphier: Convert to platform remove callback returning void
Johan Hovold <johan@kernel.org>
spi: tegra20-sflash: fix controller deregistration
Johan Hovold <johan@kernel.org>
spi: tegra114: fix controller deregistration
Tudor Ambarus <tudor.ambarus@linaro.org>
mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show()
Zeng Heng <zengheng4@huawei.com>
mtd: spi-nor: core: fix implicit declaration warning
Johan Hovold <johan@kernel.org>
spi: s3c64xx: fix NULL-deref on driver unbind
Andi Shyti <andi.shyti@kernel.org>
spi: s3c64xx: Use devm_clk_get_enabled()
Johan Hovold <johan@kernel.org>
spi: sun6i: fix controller deregistration
Johan Hovold <johan@kernel.org>
spi: zynq-qspi: fix controller deregistration
Pei Xiao <xiaopei01@kylinos.cn>
spi: zynq-qspi: Simplify clock handling with devm_clk_get_enabled()
Yang Yingliang <yangyingliang@huawei.com>
spi: zynq-qspi: switch to use modern name
Ruan Jinjie <ruanjinjie@huawei.com>
spi: spi-zynq: Do not check for 0 return after calling platform_get_irq()
Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
spi: zynq-qspi: Convert to platform remove callback returning void
Johan Hovold <johan@kernel.org>
spi: ti-qspi: fix controller deregistration
Yang Yingliang <yangyingliang@huawei.com>
spi: spi-ti-qspi: switch to use modern name
Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
spi: spi-ti-qspi: Convert to platform remove callback returning void
Andy Shevchenko <andriy.shevchenko@linux.intel.com>
spi: Convert to SPI_CONTROLLER_HALF_DUPLEX
Johan Hovold <johan@kernel.org>
spi: sun4i: fix controller deregistration
Yang Yingliang <yangyingliang@huawei.com>
spi: sun4i: switch to use modern name
Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
spi: sun4i: Convert to platform remove callback returning void
Johan Hovold <johan@kernel.org>
spi: syncuacer: fix controller deregistration
Yang Yingliang <yangyingliang@huawei.com>
spi: synquacer: switch to use modern name
Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
spi: synquacer: Convert to platform remove callback returning void
Michal Kosiorek <mkosiorek121@gmail.com>
xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete
Michael Bommarito <michael.bommarito@gmail.com>
xfrm: ah: account for ESN high bits in async callbacks
Eric Biggers <ebiggers@google.com>
net: ipv6: stop checking crypto_ahash_alignmask
Eric Biggers <ebiggers@google.com>
net: ipv4: stop checking crypto_ahash_alignmask
Selvarasu Ganesan <selvarasu.g@samsung.com>
usb: dwc3: Move GUID programming after PHY initialization
Marek Szyprowski <m.szyprowski@samsung.com>
wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task
Johannes Berg <johannes.berg@intel.com>
wifi: mac80211: remove station if connection prep fails
David Carlier <devnexen@gmail.com>
tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func()
Sam Edwards <cfsworks@gmail.com>
net: stmmac: Prevent NULL deref when RX memory exhausted
Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY()
Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
net: stmmac: avoid shadowing global buf_sz
Thorsten Blum <thorsten.blum@linux.dev>
crypto: caam - guard HMAC key hex dumps in hash_digest_key
Thorsten Blum <thorsten.blum@linux.dev>
printk: add print_hex_dump_devel()
Max Kellermann <max.kellermann@ionos.com>
ceph: only d_add() negative dentries when they are unhashed
Junrui Luo <moonafterrain@outlook.com>
erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap()
Thorsten Blum <thorsten.blum@linux.dev>
crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx
Ard Biesheuvel <ardb@kernel.org>
crypto: nx - Migrate to scomp API
Gustavo A. R. Silva <gustavoars@kernel.org>
crypto: nx - Avoid -Wflex-array-member-not-at-end warning
Zilin Guan <zilin@seu.edu.cn>
hfsplus: fix held lock freed on hfsplus_fill_super()
Deepanshu Kartikey <kartikey406@gmail.com>
hfsplus: fix uninit-value by validating catalog record size
Seohyeon Maeng <bioloidgp@gmail.com>
udf: fix partition descriptor append bookkeeping
Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
xfs: fix a resource leak in xfs_alloc_buftarg()
Thomas Zimmermann <tzimmermann@suse.de>
fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info
Johan Hovold <johan@kernel.org>
spi: fix resource leaks on device setup failure
Zhengchuan Liang <zcliangcn@gmail.com>
net: bridge: use a stable FDB dst snapshot in RCU readers
Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
net: qrtr: ns: Limit the total number of nodes
Yuan Zhaoming <yuanzm2@lenovo.com>
net: mctp: fix don't require received header reserved bits to be zero
Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
net: qrtr: ns: Free the node during ctrl_cmd_bye()
Vignesh Viswanathan <quic_viswanat@quicinc.com>
net: qrtr: ns: Change servers radix tree to xarray
Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
net: qrtr: ns: Limit the maximum number of lookups
Joseph Salisbury <joseph.salisbury@oracle.com>
sched: Use u64 for bandwidth ratio calculations
Oliver Neukum <oneukum@suse.com>
media: rc: igorplugusb: heed coherency rules
Thorsten Blum <thorsten.blum@linux.dev>
ALSA: aoa: Skip devices with no codecs in i2sbus_resume()
Oliver Neukum <oneukum@suse.com>
media: rc: ttusbir: respect DMA coherency rules
Cássio Gabriel <cassiogabrielcontato@gmail.com>
ALSA: aoa: i2sbus: clear stale prepared state
Takashi Iwai <tiwai@suse.de>
ALSA: aoa: Use guard() for mutex locks
Rafael J. Wysocki <rafael.j.wysocki@intel.com>
thermal: core: Fix thermal zone governor cleanup issues
Johan Hovold <johan@kernel.org>
spi: imx: fix use-after-free on unbind
Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
spi: imx: Convert to platform remove callback returning void
Daniel Hodges <git@danielhodges.dev>
wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup()
Alistair Popple <apopple@nvidia.com>
lib: test_hmm: evict device pages on file close to avoid use-after-free
Anshuman Khandual <anshuman.khandual@arm.com>
arm64/mm: Enable batched TLB flush in unmap_hotplug_range()
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
LoongArch: Add spectre boundry for syscall dispatch table
Michael Bommarito <michael.bommarito@gmail.com>
smb: client: validate the whole DACL before rewriting it in cifsacl
Michael Bommarito <michael.bommarito@gmail.com>
ksmbd: require minimum ACE size in smb_check_perm_dacl()
Yongpeng Yang <yangyongpeng@xiaomi.com>
f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io()
Chao Yu <chao@kernel.org>
f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally
Jiazi Li <jqqlijiazi@gmail.com>
f2fs: use kfree() instead of kvfree() to free some memory
Yin Tirui <yintirui@huawei.com>
mm/huge_memory: update file PMD counter before folio_put()
SeongJae Park <sj@kernel.org>
mm/damon/ops-common: call folio_test_lru() after folio_get()
Lorenzo Stoakes <ljs@kernel.org>
mm/hugetlb: avoid false positive lockdep assertion
Mingyu Wang <25181214217@stu.xidian.edu.cn>
fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling
Harry Wentland <harry.wentland@amd.com>
drm/amd/display: Use krealloc_array() in dal_vector_reserve()
Harry Wentland <harry.wentland@amd.com>
drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs
Harry Wentland <harry.wentland@amd.com>
drm/amd/display: Clamp VBIOS HDMI retimer register count to array size
Harry Wentland <harry.wentland@amd.com>
drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size
Christian König <christian.koenig@amd.com>
drm/amdgpu: restart the CS if some parts of the VM are still invalidated
Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock
Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
slimbus: qcom-ngd-ctrl: fix OF node refcount
Michael Bommarito <michael.bommarito@gmail.com>
thunderbolt: Limit XDomain response copy to actual frame size
Michael Bommarito <michael.bommarito@gmail.com>
thunderbolt: Validate XDomain request packet size before type cast
Michael Bommarito <michael.bommarito@gmail.com>
thunderbolt: Clamp XDomain response data copy to allocation size
Michael Bommarito <michael.bommarito@gmail.com>
thunderbolt: Bound root directory content to block size
Michael Bommarito <michael.bommarito@gmail.com>
thunderbolt: Reject zero-length property entries in validator
Wyatt Feng <bronzed_45_vested@icloud.com>
sctp: stream: fully roll back denied add-stream state
Zhao Zhang <zzhan461@ucr.edu>
sctp: diag: reject stale associations in dump_one path
Jisheng Zhang <jszhang@kernel.org>
mmc: sdhci: add signal voltage switch in sdhci_resume_host
Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC
Inochi Amaoto <inochiama@gmail.com>
mmc: litex_mmc: Set mandatory idle clocks before CMD0
Kamal Dasu <kamal.dasu@broadcom.com>
mmc: core: Fix host controller programming for fixed driver type
Dawei Feng <dawei.feng@seu.edu.cn>
octeontx2-af: fix memory leak in rvu_setup_hw_resources()
Yuqi Xu <xuyq21@lenovo.com>
net: rds: clear i_sends on setup unwind
Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
net: mv643xx: fix OF node refcount
ZhaoJinming <zhaojinming@uniontech.com>
net: bonding: fix NULL pointer dereference in bond_do_ioctl()
Nikolay Kuratov <kniv@yandex-team.ru>
net/mlx5: Reorder completion before putting command entry in cmd_work_handler
Junrui Luo <moonafterrain@outlook.com>
misc: fastrpc: fix DMA address corruption due to find_vma misuse
Zhenghang Xiao <kipreyyy@gmail.com>
misc: fastrpc: fix use-after-free race in fastrpc_map_create
Anandu Krishnan E <anandu.e@oss.qualcomm.com>
misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context
Yilin Zhu <zylzyl2333@gmail.com>
ipc/shm: serialize orphan cleanup with shm_nattch updates
Cryolitia PukNgae <cryolitia.pukngae@linux.dev>
Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard
Zeyu WANG <zeyu.thomas.wang@gmail.com>
Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK)
Akhil R <akhilrajeev@nvidia.com>
i2c: tegra: Fix NOIRQ suspend/resume
Guillermo Rodríguez <guille.rodriguez@gmail.com>
i2c: stm32f7: fix timing computation ignoring i2c-analog-filter
Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
i2c: qcom-cci: Fix NULL pointer dereference in cci_remove()
Jann Horn <jannh@google.com>
fuse: reject fuse_notify() pagecache ops on directories
Christian Brauner <brauner@kernel.org>
pidfd: refuse access to tasks that have started exiting harder
Michael Bommarito <michael.bommarito@gmail.com>
IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN
Kyle Meyer <kyle.meyer@hpe.com>
bnxt_en: Fix NULL pointer dereference
Raf Dickson <rafdog35@gmail.com>
vsock/vmci: fix sk_ack_backlog leak on failed handshake
Yuqi Xu <xuyuqiabc@gmail.com>
wifi: nl80211: reject oversized EMA RNR lists
Matthieu Baerts (NGI0) <matttbe@kernel.org>
mptcp: sockopt: check timestamping ret value
Paolo Abeni <pabeni@redhat.com>
mptcp: allow subflow rcv wnd to shrink
Paolo Abeni <pabeni@redhat.com>
mptcp: close TOCTOU race while computing rcv_wnd
Paolo Abeni <pabeni@redhat.com>
mptcp: fix retransmission loop when csum is enabled
Karl Mehltretter <kmehltretter@gmail.com>
ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow
Karl Mehltretter <kmehltretter@gmail.com>
ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O
Yuho Choi <dbgh9129@gmail.com>
ARM: socfpga: Fix OF node refcount leak in SMP setup
Sechang Lim <rhkrqnwk98@gmail.com>
udp: clear skb->dev before running a sockmap verdict
Michael Bommarito <michael.bommarito@gmail.com>
RDMA/srp: bound SRP_RSP sense copy by the received length
Harry Wentland <harry.wentland@amd.com>
drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info()
Takashi Iwai <tiwai@suse.de>
ALSA: timer: Fix UAF at snd_timer_user_params()
HyeongJun An <sammiee5311@gmail.com>
USB: serial: kl5kusb105: fix bulk-out buffer overflow
Jack Wu <jackbb_wu@compal.com>
USB: serial: option: add usb-id for Dell Wireless DW5826e-m
Adrian Korwel <adriank20047@gmail.com>
USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr()
Adrian Korwel <adriank20047@gmail.com>
USB: serial: io_ti: fix heap overflow in get_manuf_info()
Wyatt Feng <bronzed_45_vested@icloud.com>
xfrm: espintcp: do not reuse an in-progress partial send
Gil Portnoy <dddhkts1@gmail.com>
ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL
Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
drm/i915/gem: Fix phys BO pread/pwrite with offset
Inochi Amaoto <inochiama@gmail.com>
mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation
Michael Bommarito <michael.bommarito@gmail.com>
Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig
Yuqi Xu <xuyq21@lenovo.com>
Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend
Tristan Madani <tristan@talencesecurity.com>
netfilter: nft_tunnel: fix use-after-free on object destroy
Alexander A. Klimov <grandmaster@al2klimov.de>
drm/vc4: fix krealloc() memory leak
Pablo Neira Ayuso <pablo@netfilter.org>
netfilter: ctnetlink: ensure safe access to master conntrack
Til Kaiser <mail@tk154.de>
net: mvpp2: build skb from XDP-adjusted data on XDP_PASS
Til Kaiser <mail@tk154.de>
net: mvpp2: refill RX buffers before XDP or skb use
Lorenzo Bianconi <lorenzo@kernel.org>
net: mvpp2: Add metadata support for xdp mode
Til Kaiser <mail@tk154.de>
net: mvpp2: limit XDP frame size to the RX buffer
Til Kaiser <mail@tk154.de>
net: mvpp2: sync RX data at the hardware packet offset
Florian Westphal <fw@strlen.de>
netfilter: nft_exthdr: fix register tracking for F_PRESENT flag
Xiang Mei <xmei5@asu.edu>
netfilter: nf_log: validate MAC header was set before dumping it
Kyle Zeng <kylebot@openai.com>
netfilter: x_tables: avoid leaking percpu counter pointers
Weiming Shi <bestswngs@gmail.com>
netfilter: nf_conntrack: destroy stale expectfn expectations on unregister
Breno Leitao <leitao@debian.org>
rds: mark snapshot pages dirty in rds_info_getsockopt()
Eric Dumazet <edumazet@google.com>
ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()
Weiming Shi <bestswngs@gmail.com>
net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion
Kyle Zeng <kylebot@openai.com>
net: guard timestamp cmsgs to real error queue skbs
Michael Bommarito <michael.bommarito@gmail.com>
sctp: fix uninit-value in __sctp_rcv_asconf_lookup()
Chih Kai Hsu <hsu.chih.kai@realtek.com>
r8152: handle the return value of usb_reset_device()
Douglas Anderson <dianders@chromium.org>
r8152: Block future register access if register access fails
Hayes Wang <hayeswang@realtek.com>
r8152: reduce the control transfer of rtl8152_get_version()
Adrian Moreno <amorenoz@redhat.com>
net: openvswitch: fix possible kfree_skb of ERR_PTR
Kyle Zeng <kylebot@openai.com>
ipv6: sit: reload inner IPv6 header after GSO offloads
Mingyu Wang <25181214217@stu.xidian.edu.cn>
net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove
Yao Sang <sangyao@kylinos.cn>
net/mlx4: avoid GCC 10 __bad_copy_from() false positive
Eric Dumazet <edumazet@google.com>
tcp: restrict SO_ATTACH_FILTER to priv users
Richard Fitzgerald <rf@opensource.cirrus.com>
ASoC: wm_adsp: Fix NULL dereference when removing firmware controls
Chenguang Zhao <zhaochenguang@kylinos.cn>
netlabel: validate unlabeled address and mask attribute lengths
Sanghyun Park <sanghyun.park.cnu@gmail.com>
xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()
Brian Foster <bfoster@redhat.com>
iomap: don't revert iov_iter on partially completed buffered writes
Mark Rutland <mark.rutland@arm.com>
arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI
Mark Rutland <mark.rutland@arm.com>
arm64: tlb: Allow XZR argument to TLBI ops
Marc Zyngier <maz@kernel.org>
KVM: arm64: Remove VPIPT I-cache handling
Weiming Shi <bestswngs@gmail.com>
tap: free page on error paths in tap_get_user_xdp()
Minh Nguyen <minhnguyen.080505@gmail.com>
net: skbuff: fix missing zerocopy reference in pskb_carve helpers
Kuen-Han Tsai <khtsai@google.com>
usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo
Kuen-Han Tsai <khtsai@google.com>
usb: gadget: f_ncm: Fix net_device lifecycle with device_move
Edward Lo <loyuantsung@gmail.com>
fs/ntfs3: Return error for inconsistent extended attributes
Ji'an Zhou <eilaimemedsnaimel@gmail.com>
ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams
Naveen Kumar Chaudhary <naveen.osdev@gmail.com>
time: Fix off-by-one in settimeofday() usec validation
Aleksandr Nogikh <nogikh@google.com>
signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads()
Rui Qi <qirui.001@bytedance.com>
ipmi: Fix rcu_read_unlock to srcu_read_unlock in handle_read_event_rsp
Xin Long <lucien.xin@gmail.com>
sctp: purge outqueue on stale COOKIE-ECHO handling
Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr
Eric Dumazet <edumazet@google.com>
ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()
Andy Roulin <aroulin@nvidia.com>
vxlan: vnifilter: fix spurious notification on VNI update
Andy Roulin <aroulin@nvidia.com>
vxlan: vnifilter: send notification on VNI add
Nithin Dabilpuram <ndabilpuram@marvell.com>
octeontx2-af: npc: Fix CPT channel mask in npc_install_flow
Kurt Kanzenbach <kurt@linutronix.de>
ptp: vclock: Switch from RCU to SRCU
Eric Dumazet <edumazet@google.com>
ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options
Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Bluetooth: MGMT: Fix backward compatibility with userspace
Bharath Reddy <kbreddy.rpbc@gmail.com>
Bluetooth: fix memory leak in error path of hci_alloc_dev()
Zhang Cen <rollkingzzc@gmail.com>
Bluetooth: bnep: reject short frames before parsing
Dudu Lu <phx0fer@gmail.com>
Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling
SeungJu Cheon <suunj1331@gmail.com>
Bluetooth: RFCOMM: validate skb length in MCC handlers
Zhang Cen <rollkingzzc@gmail.com>
Bluetooth: MGMT: validate advertising TLV before type checks
Zhang Cen <rollkingzzc@gmail.com>
Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()
Tapio Reijonen <tapio.reijonen@vaisala.com>
net: fec: fix pinctrl default state restore order on resume
David Thompson <davthompson@nvidia.com>
net: lan743x: permit VLAN-tagged packets up to configured MTU
Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
net: garp: fix unsigned integer underflow in garp_pdu_parse_attr
Kuniyuki Iwashima <kuniyu@google.com>
net: Annotate sk->sk_write_space() for UDP SOCKMAP.
Oscar Maes <oscmaes92@gmail.com>
pcnet32: stop holding device spin lock during napi_complete_done
Yicong Hui <yiconghui@gmail.com>
drm/imx: Fix three kernel-doc warnings in dcss-scaler.c
Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
6lowpan: fix off-by-one in multicast context address compression
Jamal Hadi Salim <jhs@mojatatu.com>
net/sched: act_api: use RCU with deferred freeing for action lifecycle
Guangshuo Li <lgs201920130244@gmail.com>
dm cache policy smq: check allocation under invalidate lock
Yiming Qian <yimingqian591@gmail.com>
netfilter: bridge: make ebt_snat ARP rewrite writable
Florian Westphal <fw@strlen.de>
netfilter: conntrack_irc: fix possible out-of-bounds read
Fernando Fernandez Mancera <fmancera@suse.de>
netfilter: synproxy: add mutex to guard hook reference counting
Julian Anastasov <ja@ssi.bg>
ipvs: clear the svc scheduler ptr early on edit
Fernando Fernandez Mancera <fmancera@suse.de>
netfilter: xt_NFQUEUE: prefer raw_smp_processor_id
Amirreza Zarrabi <amirreza.zarrabi@oss.qualcomm.com>
tee: optee: prevent use-after-free when the client exits before the supplicant
Nicolò Coccia <n.coccia96@gmail.com>
net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS
Ido Schimmel <idosch@nvidia.com>
ipv6: mcast: Fix use-after-free when processing MLD queries
Mingyu Wang <25181214217@stu.xidian.edu.cn>
i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl
Nathan Chancellor <nathan@kernel.org>
Disable -Wattribute-alias for clang-23 and newer
Vinicius Costa Gomes <vinicius.gomes@intel.com>
dmaengine: idxd: Fix not releasing workqueue on .release()
Johan Hovold <johan@kernel.org>
USB: serial: mct_u232: fix memory corruption with small endpoint
Kuniyuki Iwashima <kuniyu@google.com>
bpf: Free reuseport cBPF prog after RCU grace period.
Michal Pecio <michal.pecio@gmail.com>
usb: core: Fix SuperSpeed root hub wMaxPacketSize
Jiayuan Chen <jiayuan.chen@shopee.com>
bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded
Maciej W. Rozycki <macro@orcam.me.uk>
serial: dz: Fix bootconsole handover lockup
Johan Hovold <johan@kernel.org>
USB: serial: cypress_m8: fix memory corruption with small endpoint
Pablo Neira Ayuso <pablo@netfilter.org>
netfilter: nf_tables: restore set elements when delete set fails
Wei-Cheng Chen <weichengc@nvidia.com>
xhci: tegra: Fix ghost USB device on dual-role port unplug
Johan Hovold <johan@kernel.org>
USB: serial: digi_acceleport: fix memory corruption with small endpoints
Vladislav Nikolaev <vlad102nikolaev@gmail.com>
RDMA/rxe: Complete the rxe_cleanup_task backport
Nathan Chancellor <nathan@kernel.org>
HID: core: Fix size_t specifier in hid_report_raw_event()
Benjamin Tissoires <bentiss@kernel.org>
HID: pass the buffer size to hid_report_raw_event
Vicki Pfau <vi@endrift.com>
HID: core: Add printk_ratelimited variants to hid_warn() etc
Maciej W. Rozycki <macro@orcam.me.uk>
serial: zs: Switch to using channel reset
Maciej W. Rozycki <macro@orcam.me.uk>
serial: zs: Fix bootconsole handover lockup
Maciej W. Rozycki <macro@orcam.me.uk>
serial: dz: Fix bootconsole message clobbering at chip reset
David Francis <David.Francis@amd.com>
drm/amdkfd: Check for pdd drm file first in CRIU restore path
Eric Huang <jinhuieric.huang@amd.com>
drm/amdkfd: fix NULL pointer bug in svm_range_set_attr
Shitalkumar Gandhi <shital.gandhi45@gmail.com>
serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma
Maciej W. Rozycki <macro@orcam.me.uk>
serial: zs: Fix swapped RI/DSR modem line transition counting
Hongling Zeng <zenghongling@kylinos.cn>
serial: sh-sci: fix memory region release in error path
Myeonghun Pak <mhun512@gmail.com>
serial: altera_jtaguart: handle uart_add_one_port() failures
Timur Kristóf <timur.kristof@gmail.com>
drm/amd/pm/si: Disregard vblank time when no displays are connected
Janusz Krzysztofik <janusz.krzysztofik@linux.intel.com>
drm/i915: Fix potential UAF in TTM object purge
Berkant Koc <me@berkoc.com>
drm/hyperv: validate VMBus packet size in receive callback
Berkant Koc <me@berkoc.com>
drm/hyperv: validate resolution_count and fix WIN8 fallback
Alexandru Hossu <hossu.alexandru@gmail.com>
scsi: target: iscsi: Validate CHAP_R length before base64 decode
Michael Bommarito <michael.bommarito@gmail.com>
scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf
Michael Bommarito <michael.bommarito@gmail.com>
scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32
Michael Bommarito <michael.bommarito@gmail.com>
scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker
Michael Bommarito <michael.bommarito@gmail.com>
thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow
Michael Bommarito <michael.bommarito@gmail.com>
thunderbolt: property: Reject u32 wrap in tb_property_entry_valid()
Michael Bommarito <michael.bommarito@gmail.com>
usb: gadget: f_fs: copy only received bytes on short ep0 read
Seungjin Bae <eeodqql09@gmail.com>
usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports
Guangshuo Li <lgs201920130244@gmail.com>
usb: gadget: net2280: Fix double free in probe error path
Johan Hovold <johan@kernel.org>
USB: serial: mct_u232: fix missing interrupt-in transfer sanity check
Johan Hovold <johan@kernel.org>
USB: serial: mxuport: fix memory corruption with small endpoint
Johan Hovold <johan@kernel.org>
USB: serial: keyspan: fix missing indat transfer sanity check
Zhang Cen <rollkingzzc@gmail.com>
USB: serial: cypress_m8: validate interrupt packet headers
Zhang Cen <rollkingzzc@gmail.com>
USB: serial: belkin_sa: validate interrupt status length
Wanquan Zhong <wanquan.zhong@fibocom.com>
USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL
Jan Volckaert <janvolck@gmail.com>
USB: serial: option: add MeiG SRM813Q
Heitor Alves de Siqueira <halves@igalia.com>
usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize
Heitor Alves de Siqueira <halves@igalia.com>
usb: usbtmc: check URB actual_length for interrupt-IN notifications
Michael Bommarito <michael.bommarito@gmail.com>
usbip: vudc: Fix use after free bug in vudc_remove due to race condition
Sam Burkels <sam@1a38.nl>
usb: storage: Add quirks for PNY Elite Portable SSD
Stephen J. Fuhry <fuhrysteve@gmail.com>
USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers
Michal Pecio <michal.pecio@gmail.com>
usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval
Xu Yang <xu.yang_2@nxp.com>
usb: chipidea: core: convert ci_role_switch to local variable
Zhaoyang Yu <2426767509@qq.com>
tty: serial: pch_uart: add check for dma_alloc_coherent()
Guangshuo Li <lgs201920130244@gmail.com>
counter: Fix refcount leak in counter_alloc() error path
Ian Abbott <abbotti@mev.co.uk>
comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest()
Ian Abbott <abbotti@mev.co.uk>
comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest()
Nicolás Bazaes <contacto@bazaes.cl>
Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490
Dmitry Torokhov <dmitry.torokhov@gmail.com>
Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem
Jingguo Tan <tanjingguo@huawei.com>
xfrm: esp: restore combined single-frag length gate
Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks
Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
ASoC: qcom: q6asm-dai: close stream only when running
Hamza Mahfooz <hamzamahfooz@linux.microsoft.com>
netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check
Michael Bommarito <michael.bommarito@gmail.com>
xfrm: ah: use skb_to_full_sk in async output callbacks
Maoyi Xie <maoyixie.tju@gmail.com>
xfrm: route MIGRATE notifications to caller's netns
Ashutosh Desai <ashutoshdesai993@gmail.com>
nfc: hci: fix out-of-bounds read in HCP header parsing
Arnd Bergmann <arnd@arndb.de>
iommu, debugobjects: avoid gcc-16.1 section mismatch warnings
Lee Jones <lee@kernel.org>
HID: wacom: Fix OOB write in wacom_hid_set_device_mode()
Kuniyuki Iwashima <kuniyu@google.com>
ip6: vti: Use ip6_tnl.net in vti6_changelink().
Zhengchuan Liang <zcliangcn@gmail.com>
xfrm: input: hold netns during deferred transport reinjection
Qi Tang <tpluszz77@gmail.com>
ipv6: validate extension header length before copying to cmsg
Maoyi Xie <maoyixie.tju@gmail.com>
ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().
Zhengchuan Liang <zcliangcn@gmail.com>
ipv6: exthdrs: refresh nh after handling HAO option
Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params
Justin Iurman <justin.iurman@gmail.com>
ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()
Junrui Luo <moonafterrain@outlook.com>
macsec: fix replay protection at XPN lower-PN wrap
Yuqi Xu <xuyq21@lenovo.com>
bpf: sockmap: fix tail fragment offset in bpf_msg_push_data
Dmitry Torokhov <dmitry.torokhov@gmail.com>
Input: elan_i2c - validate firmware size before use
Dan Carpenter <error27@gmail.com>
usb: dwc2: Fix use after free in debug code
Peter Chen <peter.chen@cixtech.com>
usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles
Yongchao Wu <yongchao.wu@autochips.com>
usb: cdns3: gadget: fix request skipping after clearing halt
Johan Hovold <johan@kernel.org>
USB: serial: omninet: fix memory corruption with small endpoint
Felix Gu <ustc.gu@gmail.com>
iio: buffer: hw-consumer: fix use-after-free in error path
Aldo Conte <aldocontelk@gmail.com>
iio: light: cm3323: fix reg_conf not being initialized correctly
Advait Dhamorikar <advaitd@mechasystems.com>
iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL
Salah Triki <salah.triki@gmail.com>
iio: temperature: tsys01: fix broken PROM checksum validation
Sanjay Chitroda <sanjayembeddedse@gmail.com>
iio: ssp_sensors: cancel delayed work_refresh on remove
David Carlier <devnexen@gmail.com>
iio: gyro: itg3200: fix i2c read into the wrong stack location
Salah Triki <salah.triki@gmail.com>
iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw
Rodrigo Alencar <rodrigo.alencar@analog.com>
iio: dac: ad5686: acquire lock when doing powerdown control
Rodrigo Alencar <rodrigo.alencar@analog.com>
iio: dac: ad5686: fix input raw value check
Salah Triki <salah.triki@gmail.com>
iio: dac: max5821: fix return value check in powerdown sync
Christofer Jonason <christofer.jonason@guidelinegeo.com>
iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux
Jason A. Donenfeld <Jason@zx2c4.com>
wireguard: send: append trailer after expanding head
Wentao Guan <guanwentao@uniontech.com>
USB: cdc-acm: Fix bit overlap and move quirk definitions to header
Ben Hutchings <benh@debian.org>
parport: Fix race between port and client registration
Muhammad Bilal <meatuni001@gmail.com>
Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock
Muhammad Bilal <meatuni001@gmail.com>
Bluetooth: ISO: fix UAF in iso_recv_frame
Muhammad Bilal <meatuni001@gmail.com>
Bluetooth: HIDP: fix missing length checks in hidp_input_report()
Siwei Zhang <oss@fourdim.xyz>
Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn
Siwei Zhang <oss@fourdim.xyz>
Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen()
Stepan Ionichev <sozdayvek@gmail.com>
auxdisplay: line-display: fix OOB read on zero-length message_store()
Linpu Yu <linpu5433@gmail.com>
ipc: limit next_id allocation to the valid ID range
Mikulas Patocka <mpatocka@redhat.com>
hpfs: fix a crash if hpfs_map_dnode_bitmap fails
Shuai Zhang <shuai.zhang@oss.qualcomm.com>
Bluetooth: btusb: Allow firmware re-download when version matches
hlleng <a909204013@gmail.com>
HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse
Thomas Fourier <fourier.thomas@gmail.com>
Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free()
Johan Hovold <johan@kernel.org>
USB: serial: safe_serial: fix memory corruption with small endpoint
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
usb: typec: ucsi: validate connector number in ucsi_connector_change()
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer()
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
usb: typec: altmodes/displayport: validate count before reading Status Update VDO
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
usb: typec: ucsi: ccg: reject firmware images without a ':' record header
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer
Abdurrahman Hussain <abdurrahman@nexthop.ai>
hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock
Abdurrahman Hussain <abdurrahman@nexthop.ai>
hwmon: (pmbus/adm1266) serialize sequencer_state debugfs read with pmbus_lock
Abdurrahman Hussain <abdurrahman@nexthop.ai>
hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock
Horatiu Vultur <horatiu.vultur@microchip.com>
phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X
Harini Katakam <harini.katakam@amd.com>
phy: mscc: Use PHY_ID_MATCH_VENDOR to minimize PHY ID table
Sabrina Dubroca <sd@queasysnail.net>
net: gro: don't merge zcopy skbs
Jiasheng Jiang <jiashengjiangcool@gmail.com>
RDMA/rxe: Fix double free in rxe_srq_from_init
Ben Hutchings <benh@debian.org>
Revert "RDMA/rxe: Fix double free in rxe_srq_from_init"
Jouni Högander <jouni.hogander@intel.com>
drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used
Jouni Högander <jouni.hogander@intel.com>
drm/i915/psr: Read Intel DPCD workaround register
Suraj Kandpal <suraj.kandpal@intel.com>
drm/dp: Add eDP 1.5 bit definition
Jouni Högander <jouni.hogander@intel.com>
drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register
Bingquan Chen <patzilla007@gmail.com>
net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd()
Eric Dumazet <edumazet@google.com>
net/packet: convert po->running to an atomic flag
Eric Dumazet <edumazet@google.com>
net/packet: convert po->has_vnet_hdr to an atomic flag
Eric Dumazet <edumazet@google.com>
net/packet: convert po->tp_loss to an atomic flag
Eric Dumazet <edumazet@google.com>
net/packet: convert po->tp_tx_has_off to an atomic flag
Martin KaFai Lau <martin.lau@kernel.org>
selftests/bpf: S/iptables/iptables-legacy/ in the bpf_nf and xdp_synproxy test
Daniel Borkmann <daniel@iogearbox.net>
selftests/bpf: Fix ARG_PTR_TO_LONG {half-,}uninitialized test
Paul Chaignon <paul.chaignon@gmail.com>
Revert "selftests/bpf: Add a cgroup prog bpf_get_ns_current_pid_tgid() test"
Andrii Nakryiko <andrii@kernel.org>
selftests/bpf: enhance align selftest's expected log matching
Stanislav Fomichev <sdf@google.com>
selftests/bpf: Update bpf_clone_redirect expected return code
Yonghong Song <yonghong.song@linux.dev>
bpf: Fix a few selftest failures due to llvm18 change
Jiri Olsa <jolsa@kernel.org>
selftests/bpf: Add read_build_id function
Paul Chaignon <paul.chaignon@gmail.com>
Revert "selftests/bpf: Add tests for _opts variants of bpf_*_get_fd_by_id()"
Paul Chaignon <paul.chaignon@gmail.com>
Revert "selftests/bpf: Workaround strict bpf_lsm return value check."
Andrii Nakryiko <andrii@kernel.org>
selftests/bpf: Convert test_global_funcs test to test_loader framework
Andrii Nakryiko <andrii@kernel.org>
selftests/bpf: add generic BPF program tester-loader
Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com>
mm/page_alloc: clear page->private in free_pages_prepare()
Sven Eckelmann <sven@narfation.org>
batman-adv: bla: avoid double decrement of bla.num_requests
Sven Eckelmann <sven@narfation.org>
batman-adv: tt: avoid empty VLAN responses
Sven Eckelmann <sven@narfation.org>
batman-adv: tt: fix TOCTOU race for reported vlans
Sven Eckelmann <sven@narfation.org>
batman-adv: tp_meter: directly shut down timer on cleanup
Petr Machata <petrm@nvidia.com>
selftests: forwarding: lib: Add helpers for checksum handling
Sven Eckelmann <sven@narfation.org>
batman-adv: iv: recover OGM scheduling after forward packet error
Sven Eckelmann <sven@narfation.org>
batman-adv: tvlv: reject oversized TVLV packets
Sven Eckelmann <sven@narfation.org>
batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface
Sven Eckelmann <sven@narfation.org>
batman-adv: tt: reject oversized local TVLV buffers
Sven Eckelmann <sven@narfation.org>
batman-adv: tvlv: abort OGM send on tvlv append failure
Sven Eckelmann <sven@narfation.org>
batman-adv: v: stop OGMv2 on disabled interface
Pavel Begunkov <asml.silence@gmail.com>
net: skbuff: fix pskb_carve leaking zcopy pages
Jiayuan Chen <jiayuan.chen@linux.dev>
ipv6: fix possible infinite loop in fib6_select_path()
Jiayuan Chen <jiayuan.chen@linux.dev>
ipv6: fix possible infinite loop in rt6_fill_node()
Zhenghang Xiao <kipreyyy@gmail.com>
sctp: fix race between sctp_wait_for_connect and peeloff
Dipayaan Roy <dipayanroy@linux.microsoft.com>
net: mana: Add NULL guards in teardown path to prevent panic on attach failure
Marco Scardovi <scardracs@disroot.org>
gpio: rockchip: convert bank->clk to devm_clk_get_enabled()
Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp
Zhenghang Xiao <kipreyyy@gmail.com>
Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success
Jamal Hadi Salim <jhs@mojatatu.com>
net/sched: Revert "net/sched: Restrict conditions for adding duplicating netems to qdisc tree"
Rahul Chandelkar <rc@rexion.ai>
ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()
Jakub Kicinski <kuba@kernel.org>
ethtool: eeprom: add more safeties to EEPROM Netlink fallback
Oliver Hartkopp <socketcan@hartkopp.net>
bonding: refuse to enslave CAN devices
Zhao Dongdong <zhaodongdong@kylinos.cn>
Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt()
Cássio Gabriel <cassiogabrielcontato@gmail.com>
ASoC: codecs: simple-mux: Fix enum control bounds check
Eric Dumazet <edumazet@google.com>
tunnels: do not assume transport header in iptunnel_pmtud_check_icmp()
Eric Dumazet <edumazet@google.com>
vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()
Eric Dumazet <edumazet@google.com>
tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]()
Luka Gejak <luka.gejak@linux.dev>
net: hsr: fix potential OOB access in supervision frame handling
Cássio Gabriel <cassiogabrielcontato@gmail.com>
ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors
Eric Dumazet <edumazet@google.com>
ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()
Breno Leitao <leitao@debian.org>
net/iucv: fix locking in .getsockopt
Alexandra Winter <wintera@linux.ibm.com>
net/smc: Do not re-initialize smc hashtables
Ilya Maximets <i.maximets@ovn.org>
net: netlink: don't set nsid on local notifications
Ilya Maximets <i.maximets@ovn.org>
net: netlink: fix sending unassigned nsid after assigned one
Weiming Shi <bestswngs@gmail.com>
tun: free page on build_skb failure in tun_xdp_one()
Weiming Shi <bestswngs@gmail.com>
tun: free page on short-frame rejection in tun_xdp_one()
Florian Westphal <fw@strlen.de>
netfilter: ebtables: fix OOB read in compat_mtw_from_user
Florian Westphal <fw@strlen.de>
netfilter: xt_cpu: prefer raw_smp_processor_id
Chris Mason <clm@meta.com>
netfilter: synproxy: refresh tcphdr after skb_ensure_writable
Hongtao Lee <lihongtao@kylinos.cn>
tools/bootconfig: Fix buf leaks in apply_xbc
Masami Hiramatsu (Google) <mhiramat@kernel.org>
tools/bootconfig: Cleanup bootconfig footer size calculations
Carl Lee <carl.lee@amd.com>
nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems
David Ahern <dahern@nvidia.com>
xfrm: Check for underflow in xfrm_state_mtu
Lee Jones <lee@kernel.org>
nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc()
Lee Jones <lee@kernel.org>
nfc: llcp: Fix use-after-free in llcp_sock_release()
Kevin Hao <haokexin@gmail.com>
net: cpsw_new: Fix potential unregister of netdev that has not been registered yet
Carlos Eduardo Gallo Filho <gcarlos@disroot.org>
drm: Remove plane hsub/vsub alignment requirement for core helpers
Victor Nogueria <victor@mojatatu.com>
net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked
Jeremy Kerr <jk@codeconstruct.com.au>
net: mctp: ensure our nlmsg responses are initialised
Davide Caratti <dcaratti@redhat.com>
net/sched: cls_fw: fix NULL dereference of "old" filters before change()
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size
-------------
Diffstat:
Documentation/arm64/silicon-errata.rst | 46 ++++
Makefile | 4 +-
arch/arm/include/asm/io.h | 15 +-
arch/arm/kernel/entry-armv.S | 2 +-
arch/arm/mach-socfpga/platsmp.c | 1 +
arch/arm64/Kconfig | 50 +++++
arch/arm64/include/asm/cputype.h | 6 +
arch/arm64/include/asm/kvm_mmu.h | 4 +-
arch/arm64/include/asm/tlb.h | 2 +-
arch/arm64/include/asm/tlbflush.h | 52 +++--
arch/arm64/kernel/cpu_errata.c | 34 ++-
arch/arm64/kernel/sys_compat.c | 2 +-
arch/arm64/kvm/arm.c | 5 +
arch/arm64/kvm/hyp/nvhe/tlb.c | 41 +---
arch/arm64/kvm/hyp/pgtable.c | 2 +-
arch/arm64/kvm/hyp/vhe/tlb.c | 19 +-
arch/arm64/mm/mmu.c | 36 ++--
arch/loongarch/kernel/syscall.c | 3 +-
arch/x86/kernel/cpu/amd.c | 18 +-
block/blk-cgroup.c | 32 +--
drivers/auxdisplay/line-display.c | 2 +-
drivers/base/power/domain.c | 10 +-
drivers/bluetooth/btusb.c | 8 +-
drivers/bluetooth/hci_qca.c | 33 ++-
drivers/char/ipmi/ipmi_msghandler.c | 2 +-
drivers/char/ipmi/ipmi_ssif.c | 42 ++--
drivers/comedi/drivers/comedi_test.c | 5 +-
drivers/counter/counter-core.c | 3 +-
drivers/crypto/caam/caamalg_qi2.c | 4 +-
drivers/crypto/caam/caamhash.c | 4 +-
drivers/crypto/nx/nx-842.c | 47 +++--
drivers/crypto/nx/nx-842.h | 24 ++-
drivers/crypto/nx/nx-common-powernv.c | 31 ++-
drivers/crypto/nx/nx-common-pseries.c | 33 ++-
drivers/dma/idxd/init.c | 1 -
drivers/dma/idxd/sysfs.c | 1 +
drivers/gpio/gpio-rockchip.c | 6 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 4 +-
drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 10 +-
drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 3 +
.../drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 5 +
drivers/gpu/drm/amd/display/dc/basics/vector.c | 4 +-
drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | 54 +++--
.../gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c | 3 +-
drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 4 +
drivers/gpu/drm/hyperv/hyperv_drm_proto.c | 113 ++++++++--
drivers/gpu/drm/i915/display/intel_display_types.h | 1 +
drivers/gpu/drm/i915/display/intel_dpcd.h | 15 ++
drivers/gpu/drm/i915/display/intel_psr.c | 34 ++-
drivers/gpu/drm/i915/gem/i915_gem_phys.c | 19 +-
drivers/gpu/drm/i915/gem/i915_gem_ttm.c | 28 +--
drivers/gpu/drm/imx/dcss/dcss-scaler.c | 3 +
drivers/gpu/drm/v3d/v3d_gem.c | 5 +
drivers/gpu/drm/vc4/vc4_validate_shaders.c | 13 +-
drivers/hid/hid-core.c | 33 ++-
drivers/hid/hid-gfrm.c | 4 +-
drivers/hid/hid-ids.h | 1 +
drivers/hid/hid-logitech-hidpp.c | 2 +-
drivers/hid/hid-multitouch.c | 2 +-
drivers/hid/hid-primax.c | 2 +-
drivers/hid/hid-quirks.c | 1 +
drivers/hid/hid-vivaldi-common.c | 2 +-
drivers/hid/wacom_sys.c | 19 +-
drivers/hid/wacom_wac.h | 1 +
drivers/hwmon/pmbus/adm1266.c | 56 ++++-
drivers/i2c/busses/i2c-qcom-cci.c | 2 +-
drivers/i2c/busses/i2c-stm32f7.c | 6 +-
drivers/i2c/busses/i2c-tegra.c | 53 +++--
drivers/i2c/i2c-dev.c | 9 +-
drivers/iio/adc/bcm_iproc_adc.c | 4 +-
drivers/iio/adc/lpc32xx_adc.c | 4 +-
drivers/iio/adc/npcm_adc.c | 31 +--
drivers/iio/adc/spear_adc.c | 4 +-
drivers/iio/adc/viperboard_adc.c | 4 +-
drivers/iio/adc/xilinx-xadc-core.c | 11 +-
drivers/iio/buffer/industrialio-hw-consumer.c | 4 +-
drivers/iio/chemical/scd30_core.c | 65 +++---
drivers/iio/common/ssp_sensors/ssp_dev.c | 1 +
drivers/iio/dac/ad5686.c | 16 +-
drivers/iio/dac/ad5686.h | 1 +
drivers/iio/dac/max5821.c | 9 +-
drivers/iio/gyro/adis16260.c | 3 +
drivers/iio/gyro/itg3200_buffer.c | 2 +-
drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c | 2 +-
drivers/iio/light/cm3323.c | 5 +-
drivers/iio/magnetometer/st_magn_core.c | 13 +-
drivers/iio/temperature/tsys01.c | 2 +-
drivers/infiniband/core/Makefile | 2 +-
drivers/infiniband/core/iter.c | 43 ++++
drivers/infiniband/core/verbs.c | 38 ----
drivers/infiniband/hw/bnxt_re/qplib_res.c | 2 +-
drivers/infiniband/hw/cxgb4/mem.c | 2 +-
drivers/infiniband/hw/efa/efa_verbs.c | 2 +-
drivers/infiniband/hw/erdma/erdma_verbs.c | 2 +-
drivers/infiniband/hw/hns/hns_roce_alloc.c | 2 +-
drivers/infiniband/hw/irdma/main.h | 2 +-
drivers/infiniband/hw/mlx4/mr.c | 1 +
drivers/infiniband/hw/mlx5/mem.c | 1 +
drivers/infiniband/hw/mlx5/umr.c | 1 +
drivers/infiniband/hw/mthca/mthca_provider.c | 2 +-
drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 2 +-
drivers/infiniband/hw/qedr/verbs.c | 2 +-
drivers/infiniband/hw/vmw_pvrdma/pvrdma.h | 2 +-
drivers/infiniband/sw/rxe/rxe_qp.c | 4 +-
drivers/infiniband/sw/rxe/rxe_srq.c | 3 -
drivers/infiniband/ulp/isert/ib_isert.c | 6 +
drivers/infiniband/ulp/srp/ib_srp.c | 30 ++-
drivers/input/keyboard/atkbd.c | 15 ++
drivers/input/misc/ims-pcu.c | 2 +-
drivers/input/mouse/elan_i2c_core.c | 5 +
drivers/input/mouse/synaptics.c | 1 +
drivers/input/touchscreen/atmel_mxt_ts.c | 2 +-
drivers/input/touchscreen/usbtouchscreen.c | 5 +
drivers/iommu/io-pgtable-arm-v7s.c | 18 +-
drivers/md/dm-cache-policy-smq.c | 12 +-
drivers/media/rc/igorplugusb.c | 16 +-
drivers/media/rc/ttusbir.c | 13 +-
drivers/misc/fastrpc.c | 102 +++++----
drivers/mmc/core/mmc.c | 4 +-
drivers/mmc/host/litex_mmc.c | 20 +-
drivers/mmc/host/renesas_sdhi_internal_dmac.c | 1 +
drivers/mmc/host/sdhci.c | 1 +
drivers/mtd/spi-nor/core.c | 1 +
drivers/mtd/spi-nor/debugfs.c | 4 +-
drivers/net/bonding/bond_main.c | 19 +-
drivers/net/bonding/bond_options.c | 2 +
drivers/net/ethernet/amd/pcnet32.c | 4 +-
drivers/net/ethernet/broadcom/bnxt/bnxt.c | 2 +-
drivers/net/ethernet/freescale/fec_main.c | 3 +-
drivers/net/ethernet/intel/ice/ice_virtchnl.c | 2 +-
drivers/net/ethernet/marvell/mv643xx_eth.c | 2 +-
drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 75 ++++---
drivers/net/ethernet/marvell/octeontx2/af/cgx.c | 13 +-
drivers/net/ethernet/marvell/octeontx2/af/rvu.c | 2 +-
drivers/net/ethernet/marvell/octeontx2/af/rvu.h | 1 +
.../net/ethernet/marvell/octeontx2/af/rvu_npc.c | 32 +--
.../net/ethernet/marvell/octeontx2/af/rvu_npc_fs.c | 2 +-
.../ethernet/marvell/octeontx2/nic/otx2_common.c | 2 +
drivers/net/ethernet/mellanox/mlx4/cq.c | 9 +-
drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 6 +-
drivers/net/ethernet/microchip/lan743x_main.c | 32 +++
drivers/net/ethernet/microchip/lan743x_main.h | 1 +
drivers/net/ethernet/microsoft/mana/mana_en.c | 72 ++++---
drivers/net/ethernet/stmicro/stmmac/chain_mode.c | 2 +-
drivers/net/ethernet/stmicro/stmmac/common.h | 2 +-
drivers/net/ethernet/stmicro/stmmac/ring_mode.c | 2 +-
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 47 +++--
drivers/net/ethernet/ti/cpsw_new.c | 4 +-
drivers/net/hyperv/netvsc.c | 19 +-
drivers/net/macsec.c | 3 +-
drivers/net/phy/mscc/mscc.h | 9 +-
drivers/net/phy/mscc/mscc_main.c | 38 +---
drivers/net/tap.c | 2 +
drivers/net/tun.c | 5 +-
drivers/net/usb/r8152.c | 211 ++++++++++++++++---
drivers/net/vxlan/vxlan_core.c | 4 +-
drivers/net/vxlan/vxlan_vnifilter.c | 5 +-
drivers/net/wireguard/send.c | 20 +-
.../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 4 +
drivers/net/wireless/marvell/mwifiex/init.c | 2 +-
drivers/net/wwan/t7xx/t7xx_modem_ops.c | 17 +-
drivers/net/wwan/t7xx/t7xx_port_ctrl_msg.c | 18 +-
drivers/net/wwan/t7xx/t7xx_port_proxy.h | 2 +-
drivers/nfc/nxp-nci/i2c.c | 21 +-
drivers/parport/share.c | 11 +-
drivers/phy/tegra/xusb-tegra186.c | 38 +++-
drivers/phy/tegra/xusb.h | 1 +
drivers/platform/x86/intel/vsec.c | 77 +++++--
drivers/platform/x86/intel/vsec.h | 2 +-
drivers/ptp/ptp_vclock.c | 14 +-
drivers/scsi/fcoe/fcoe_ctlr.c | 2 +-
drivers/scsi/scsi_transport_fc.c | 77 +++----
drivers/slimbus/qcom-ngd-ctrl.c | 5 +-
drivers/spi/spi-amd.c | 2 +-
drivers/spi/spi-cavium-thunderx.c | 2 +-
drivers/spi/spi-falcon.c | 2 +-
drivers/spi/spi-imx.c | 8 +-
drivers/spi/spi-lantiq-ssc.c | 8 +-
drivers/spi/spi-lp8841-rtc.c | 2 +-
drivers/spi/spi-microchip-core-qspi.c | 47 ++---
drivers/spi/spi-mxs.c | 2 +-
drivers/spi/spi-omap-uwire.c | 2 +-
drivers/spi/spi-pic32-sqi.c | 2 +-
drivers/spi/spi-qcom-qspi.c | 2 +-
drivers/spi/spi-qup.c | 169 +++++++--------
drivers/spi/spi-rockchip-sfc.c | 2 +-
drivers/spi/spi-s3c64xx.c | 44 +---
drivers/spi/spi-sprd-adi.c | 2 +-
drivers/spi/spi-st-ssc4.c | 76 +++----
drivers/spi/spi-sun4i.c | 84 ++++----
drivers/spi/spi-sun6i.c | 9 +-
drivers/spi/spi-synquacer.c | 92 ++++----
drivers/spi/spi-tegra114.c | 8 +-
drivers/spi/spi-tegra20-sflash.c | 8 +-
drivers/spi/spi-ti-qspi.c | 97 +++++----
drivers/spi/spi-topcliff-pch.c | 6 +-
drivers/spi/spi-uniphier.c | 216 ++++++++++---------
drivers/spi/spi-xcomm.c | 2 +-
drivers/spi/spi-zynq-qspi.c | 89 +++-----
drivers/spi/spi-zynqmp-gqspi.c | 4 +-
drivers/spi/spi.c | 61 +++---
drivers/staging/greybus/hid.c | 2 +-
drivers/target/iscsi/iscsi_target.c | 6 +-
drivers/target/iscsi/iscsi_target_auth.c | 19 +-
drivers/target/iscsi/iscsi_target_nego.c | 7 +-
drivers/target/iscsi/iscsi_target_parameters.c | 62 ++++--
drivers/target/iscsi/iscsi_target_parameters.h | 2 +-
drivers/tee/optee/supp.c | 107 +++++++---
drivers/thermal/thermal_core.c | 7 +-
drivers/thunderbolt/property.c | 38 +++-
drivers/thunderbolt/xdomain.c | 14 +-
drivers/tty/serial/altera_jtaguart.c | 7 +-
drivers/tty/serial/dz.c | 57 ++---
drivers/tty/serial/fsl_lpuart.c | 15 +-
drivers/tty/serial/pch_uart.c | 19 +-
drivers/tty/serial/qcom_geni_serial.c | 75 +++----
drivers/tty/serial/samsung_tty.c | 130 ++++++------
drivers/tty/serial/sh-sci.c | 2 +-
drivers/tty/serial/zs.c | 40 ++--
drivers/tty/serial/zs.h | 2 +-
drivers/usb/cdns3/cdns3-gadget.c | 12 +-
drivers/usb/cdns3/cdns3-plat.c | 11 +-
drivers/usb/chipidea/core.c | 16 +-
drivers/usb/class/cdc-acm.c | 2 -
drivers/usb/class/cdc-acm.h | 2 +
drivers/usb/class/usbtmc.c | 14 ++
drivers/usb/core/config.c | 9 +-
drivers/usb/core/hcd.c | 4 +-
drivers/usb/core/quirks.c | 4 +
drivers/usb/dwc2/hcd.c | 4 +-
drivers/usb/dwc3/core.c | 12 +-
drivers/usb/dwc3/dwc3-xilinx.c | 26 +--
drivers/usb/gadget/function/f_fs.c | 2 +-
drivers/usb/gadget/function/f_hid.c | 20 +-
drivers/usb/gadget/function/f_ncm.c | 33 ++-
drivers/usb/gadget/function/u_ether.c | 28 ++-
drivers/usb/gadget/function/u_ether.h | 26 +++
drivers/usb/gadget/function/u_ncm.h | 2 +-
drivers/usb/gadget/udc/dummy_hcd.c | 4 +
drivers/usb/gadget/udc/net2280.c | 4 +-
drivers/usb/host/xhci-tegra.c | 76 ++++---
drivers/usb/musb/omap2430.c | 3 +-
drivers/usb/serial/belkin_sa.c | 3 +
drivers/usb/serial/cypress_m8.c | 20 +-
drivers/usb/serial/digi_acceleport.c | 23 +-
drivers/usb/serial/io_ti.c | 11 +
drivers/usb/serial/keyspan.c | 4 +
drivers/usb/serial/kl5kusb105.c | 4 +-
drivers/usb/serial/mct_u232.c | 26 ++-
drivers/usb/serial/mxuport.c | 8 +
drivers/usb/serial/omninet.c | 9 +-
drivers/usb/serial/option.c | 12 +-
drivers/usb/serial/safe_serial.c | 11 +
drivers/usb/storage/unusual_uas.h | 7 +
drivers/usb/typec/altmodes/displayport.c | 2 +
drivers/usb/typec/tcpm/tcpm.c | 2 +
drivers/usb/typec/tcpm/wcove.c | 13 +-
drivers/usb/typec/ucsi/displayport.c | 4 +
drivers/usb/typec/ucsi/ucsi.c | 24 ++-
drivers/usb/typec/ucsi/ucsi_ccg.c | 5 +
drivers/usb/usbip/vudc_dev.c | 1 +
drivers/usb/usbip/vudc_transfer.c | 3 +-
drivers/video/fbdev/core/fb_defio.c | 164 +++++++++++++--
drivers/video/fbdev/core/fbcon_rotate.c | 5 +-
drivers/video/fbdev/vt8500lcdfb.c | 2 +-
fs/btrfs/inode.c | 2 +
fs/btrfs/ioctl.c | 5 +-
fs/btrfs/space-info.c | 8 +-
fs/btrfs/sysfs.c | 5 +-
fs/btrfs/sysfs.h | 3 +-
fs/ceph/dir.c | 6 +-
fs/erofs/decompressor.c | 1 +
fs/f2fs/data.c | 4 +-
fs/f2fs/f2fs.h | 5 +-
fs/f2fs/inline.c | 13 +-
fs/f2fs/node.c | 4 +-
fs/f2fs/segment.c | 10 +-
fs/f2fs/super.c | 29 ++-
fs/fcntl.c | 8 +-
fs/fuse/dev.c | 9 +-
fs/hfsplus/bfind.c | 51 +++++
fs/hfsplus/catalog.c | 4 +-
fs/hfsplus/dir.c | 2 +-
fs/hfsplus/hfsplus_fs.h | 9 +
fs/hfsplus/super.c | 6 +-
fs/hpfs/alloc.c | 2 +-
fs/iomap/buffered-io.c | 4 -
fs/ntfs3/xattr.c | 1 +
fs/smb/client/cifsacl.c | 128 +++++++++--
fs/smb/client/ioctl.c | 2 +-
fs/smb/client/netlink.c | 6 +-
fs/smb/client/smb2transport.c | 32 ++-
fs/smb/server/smb2pdu.c | 11 +
fs/smb/server/smbacl.c | 17 +-
fs/udf/super.c | 4 +-
fs/xfs/xfs_buf.c | 1 +
include/drm/display/drm_dp.h | 1 +
include/drm/drm_fourcc.h | 5 +-
include/linux/compat.h | 4 +
include/linux/compiler-clang.h | 6 +
include/linux/compiler_attributes.h | 11 +
include/linux/compiler_types.h | 4 +
include/linux/damon.h | 2 +
include/linux/fb.h | 4 +-
include/linux/hid.h | 15 +-
include/linux/hugetlb.h | 14 +-
include/linux/mm.h | 5 -
include/linux/parport.h | 1 +
include/linux/printk.h | 13 ++
include/linux/syscalls.h | 4 +
include/net/act_api.h | 1 +
include/net/bluetooth/bluetooth.h | 1 +
include/net/bluetooth/l2cap.h | 1 +
include/net/bonding.h | 1 +
include/net/genetlink.h | 9 +-
include/net/ip_vs.h | 3 +-
include/net/mctp.h | 3 +
include/net/netfilter/nf_conntrack_core.h | 5 +
include/net/netfilter/nf_conntrack_helper.h | 1 +
include/net/sock.h | 1 +
include/net/xfrm.h | 3 +-
include/rdma/ib_umem.h | 36 +---
include/rdma/ib_verbs.h | 48 -----
include/rdma/iter.h | 88 ++++++++
ipc/shm.c | 10 +-
ipc/util.c | 2 +-
kernel/cgroup/cpuset.c | 8 +-
kernel/pid.c | 8 +-
kernel/sched/core.c | 2 +-
kernel/sched/rt.c | 2 +-
kernel/sched/sched.h | 2 +-
kernel/signal.c | 1 +
kernel/time/time.c | 2 +-
kernel/trace/trace_probe.c | 6 +
kernel/trace/trace_probe.h | 4 +-
kernel/tracepoint.c | 2 +
lib/debugobjects.c | 2 +-
lib/mpi/mpicoder.c | 2 +-
lib/test_hmm.c | 86 ++++----
mm/damon/core.c | 37 +++-
mm/damon/lru_sort.c | 84 +++++---
mm/damon/ops-common.c | 4 +-
mm/damon/reclaim.c | 84 +++++---
mm/gup.c | 2 +-
mm/huge_memory.c | 2 +
mm/hugetlb.c | 113 +++++++---
mm/memory-failure.c | 92 ++++----
mm/memory.c | 2 +-
mm/memory_hotplug.c | 2 +-
mm/mempolicy.c | 2 +-
mm/migrate.c | 18 +-
mm/page_alloc.c | 1 +
net/6lowpan/iphc.c | 4 +-
net/802/garp.c | 2 +-
net/802/mrp.c | 9 +
net/batman-adv/bat_iv_ogm.c | 82 ++++++--
net/batman-adv/bat_v_ogm.c | 59 +++---
net/batman-adv/bridge_loop_avoidance.c | 57 +++--
net/batman-adv/main.c | 1 +
net/batman-adv/soft-interface.c | 1 +
net/batman-adv/tp_meter.c | 109 +++++++---
net/batman-adv/tp_meter.h | 1 +
net/batman-adv/translation-table.c | 43 +++-
net/batman-adv/tvlv.c | 28 ++-
net/batman-adv/tvlv.h | 2 +-
net/batman-adv/types.h | 46 +++-
net/bluetooth/6lowpan.c | 2 +
net/bluetooth/af_bluetooth.c | 113 ++++++++--
net/bluetooth/bnep/core.c | 50 +++--
net/bluetooth/hci_sync.c | 5 +
net/bluetooth/hci_sysfs.c | 6 +-
net/bluetooth/hidp/core.c | 23 +-
net/bluetooth/hidp/sock.c | 10 +-
net/bluetooth/iso.c | 12 +-
net/bluetooth/l2cap_core.c | 87 +++++++-
net/bluetooth/l2cap_sock.c | 35 +---
net/bluetooth/mgmt.c | 17 +-
net/bluetooth/rfcomm/core.c | 69 ++++--
net/bluetooth/rfcomm/sock.c | 26 ++-
net/bridge/br_arp_nd_proxy.c | 8 +-
net/bridge/br_fdb.c | 28 ++-
net/bridge/netfilter/ebt_snat.c | 3 +
net/bridge/netfilter/ebtables.c | 30 +++
net/core/drop_monitor.c | 2 +-
net/core/filter.c | 17 +-
net/core/gro.c | 3 +
net/core/skbuff.c | 20 +-
net/core/sock.c | 13 +-
net/ethtool/eeprom.c | 5 +-
net/hsr/hsr_forward.c | 4 +-
net/hsr/hsr_framereg.c | 6 +-
net/ieee802154/6lowpan/tx.c | 5 +
net/ipv4/ah4.c | 31 +--
net/ipv4/esp4.c | 4 +-
net/ipv4/ip_options.c | 4 +
net/ipv4/ip_tunnel_core.c | 22 +-
net/ipv4/netfilter/arp_tables.c | 15 +-
net/ipv4/netfilter/ip_tables.c | 15 +-
net/ipv4/netfilter/nf_nat_h323.c | 2 +
net/ipv4/netfilter/nft_fib_ipv4.c | 2 +-
net/ipv4/sysctl_net_ipv4.c | 2 +-
net/ipv4/udp.c | 8 +
net/ipv6/ah6.c | 29 ++-
net/ipv6/datagram.c | 54 ++++-
net/ipv6/esp6.c | 4 +-
net/ipv6/exthdrs.c | 21 +-
net/ipv6/ip6_vti.c | 25 ++-
net/ipv6/mcast.c | 8 +-
net/ipv6/netfilter/ip6_tables.c | 15 +-
net/ipv6/netfilter/nft_fib_ipv6.c | 2 +-
net/ipv6/route.c | 5 +
net/ipv6/sit.c | 1 +
net/iucv/af_iucv.c | 20 +-
net/key/af_key.c | 6 +-
net/mac80211/mlme.c | 4 +-
net/mctp/device.c | 1 +
net/mctp/neigh.c | 1 +
net/mctp/route.c | 9 +-
net/mptcp/options.c | 43 ++--
net/mptcp/pm.c | 34 ++-
net/mptcp/pm_netlink.c | 45 ++--
net/mptcp/protocol.c | 29 ++-
net/mptcp/sockopt.c | 8 +-
net/netfilter/ipvs/ip_vs_ctl.c | 13 +-
net/netfilter/ipvs/ip_vs_proto_sctp.c | 18 +-
net/netfilter/ipvs/ip_vs_proto_tcp.c | 21 +-
net/netfilter/ipvs/ip_vs_proto_udp.c | 20 +-
net/netfilter/ipvs/ip_vs_sched.c | 14 +-
net/netfilter/nf_conntrack_ecache.c | 2 +
net/netfilter/nf_conntrack_expect.c | 10 +-
net/netfilter/nf_conntrack_helper.c | 19 ++
net/netfilter/nf_conntrack_irc.c | 4 +-
net/netfilter/nf_conntrack_netlink.c | 28 ++-
net/netfilter/nf_conntrack_proto_tcp.c | 3 +-
net/netfilter/nf_log_syslog.c | 4 +-
net/netfilter/nf_nat_core.c | 2 +
net/netfilter/nf_nat_sip.c | 1 +
net/netfilter/nf_synproxy_core.c | 26 ++-
net/netfilter/nf_tables_api.c | 41 +++-
net/netfilter/nft_exthdr.c | 3 +
net/netfilter/nft_fib.c | 6 +
net/netfilter/nft_set_bitmap.c | 4 +-
net/netfilter/nft_set_hash.c | 8 +-
net/netfilter/nft_set_pipapo.c | 5 +-
net/netfilter/nft_set_rbtree.c | 4 +-
net/netfilter/nft_tunnel.c | 2 +-
net/netfilter/xt_NFQUEUE.c | 2 +-
net/netfilter/xt_cpu.c | 2 +-
net/netlabel/netlabel_unlabeled.c | 30 +--
net/netlink/af_netlink.c | 11 +-
net/netlink/genetlink.c | 4 +-
net/nfc/hci/core.c | 10 +
net/nfc/llcp_core.c | 11 +
net/nfc/llcp_sock.c | 2 +
net/nfc/nci/hci.c | 10 +
net/openvswitch/datapath.c | 1 +
net/packet/af_packet.c | 74 ++++---
net/packet/diag.c | 6 +-
net/packet/internal.h | 8 +-
net/psample/psample.c | 2 +-
net/qrtr/af_qrtr.c | 4 +-
net/qrtr/ns.c | 180 ++++++----------
net/rds/ib_cm.c | 1 +
net/rds/ib_send.c | 2 +
net/rds/info.c | 2 +-
net/sched/act_api.c | 7 +-
net/sched/cls_fw.c | 6 +-
net/sched/sch_netem.c | 40 ----
net/sched/sch_sfb.c | 2 +-
net/sctp/diag.c | 17 +-
net/sctp/input.c | 8 +
net/sctp/sm_statefuns.c | 6 +-
net/sctp/socket.c | 2 +
net/sctp/stream.c | 6 +-
net/smc/af_smc.c | 21 +-
net/socket.c | 11 +-
net/vmw_vsock/vmci_transport.c | 4 +-
net/wireless/nl80211.c | 3 +
net/xfrm/espintcp.c | 4 +
net/xfrm/xfrm_input.c | 16 +-
net/xfrm/xfrm_policy.c | 15 +-
net/xfrm/xfrm_state.c | 35 +++-
net/xfrm/xfrm_user.c | 5 +-
security/apparmor/policy_unpack.c | 27 +--
sound/aoa/codecs/onyx.c | 104 +++------
sound/aoa/codecs/tas.c | 113 ++++------
sound/aoa/core/gpio-feature.c | 20 +-
sound/aoa/core/gpio-pmf.c | 26 +--
sound/aoa/soundbus/i2sbus/core.c | 3 +
sound/aoa/soundbus/i2sbus/pcm.c | 143 ++++++-------
sound/core/pcm_native.c | 7 +-
sound/core/timer.c | 1 +
.../motu/motu-register-dsp-message-parser.c | 14 +-
sound/pci/hda/patch_hdmi.c | 1 +
sound/soc/codecs/simple-mux.c | 2 +-
sound/soc/codecs/wm_adsp.c | 3 +
sound/soc/intel/boards/bytcht_es8316.c | 29 ++-
sound/soc/qcom/qdsp6/q6asm-dai.c | 43 ++--
tools/bootconfig/main.c | 23 +-
tools/perf/Makefile.config | 1 +
tools/perf/util/Build | 32 ++-
tools/perf/util/expr.y | 4 +-
tools/perf/util/parse-events.y | 3 +
tools/perf/util/pmu.y | 3 +
tools/scripts/utilities.mak | 20 ++
tools/testing/selftests/bpf/DENYLIST.s390x | 1 -
tools/testing/selftests/bpf/Makefile | 2 +-
tools/testing/selftests/bpf/prog_tests/align.c | 18 +-
tools/testing/selftests/bpf/prog_tests/bpf_nf.c | 6 +-
tools/testing/selftests/bpf/prog_tests/empty_skb.c | 12 +-
.../bpf/prog_tests/libbpf_get_fd_by_id_opts.c | 87 --------
.../selftests/bpf/prog_tests/ns_current_pid_tgid.c | 73 -------
.../selftests/bpf/prog_tests/test_global_funcs.c | 131 +++---------
.../selftests/bpf/prog_tests/xdp_synproxy.c | 6 +-
tools/testing/selftests/bpf/progs/bpf_misc.h | 5 +
.../selftests/bpf/progs/test_global_func1.c | 6 +-
.../selftests/bpf/progs/test_global_func10.c | 1 +
.../selftests/bpf/progs/test_global_func11.c | 4 +-
.../selftests/bpf/progs/test_global_func12.c | 4 +-
.../selftests/bpf/progs/test_global_func13.c | 4 +-
.../selftests/bpf/progs/test_global_func14.c | 4 +-
.../selftests/bpf/progs/test_global_func15.c | 4 +-
.../selftests/bpf/progs/test_global_func16.c | 4 +-
.../selftests/bpf/progs/test_global_func17.c | 5 +-
.../selftests/bpf/progs/test_global_func2.c | 43 +++-
.../selftests/bpf/progs/test_global_func3.c | 10 +-
.../selftests/bpf/progs/test_global_func4.c | 55 ++++-
.../selftests/bpf/progs/test_global_func5.c | 4 +-
.../selftests/bpf/progs/test_global_func6.c | 4 +-
.../selftests/bpf/progs/test_global_func7.c | 4 +-
.../selftests/bpf/progs/test_global_func8.c | 4 +-
.../selftests/bpf/progs/test_global_func9.c | 4 +-
.../bpf/progs/test_libbpf_get_fd_by_id_opts.c | 37 ----
.../selftests/bpf/progs/test_ns_current_pid_tgid.c | 7 -
tools/testing/selftests/bpf/test_loader.c | 233 +++++++++++++++++++++
tools/testing/selftests/bpf/test_progs.h | 33 +++
tools/testing/selftests/bpf/trace_helpers.c | 82 ++++++++
tools/testing/selftests/bpf/trace_helpers.h | 5 +
tools/testing/selftests/bpf/verifier/int_ptr.c | 6 +-
tools/testing/selftests/net/forwarding/lib.sh | 56 +++++
tools/testing/selftests/net/mptcp/mptcp_connect.sh | 6 +-
tools/testing/selftests/ptp/testptp.c | 62 +-----
tools/testing/selftests/vm/hmm-tests.c | 50 +++++
543 files changed, 6595 insertions(+), 3687 deletions(-)
^ permalink raw reply [flat|nested] 3+ messages in thread
* [PATCH 6.1 337/522] arm64/mm: Enable batched TLB flush in unmap_hotplug_range()
2026-06-16 14:52 [PATCH 6.1 000/522] 6.1.176-rc1 review Greg Kroah-Hartman
@ 2026-06-16 14:58 ` Greg Kroah-Hartman
2026-06-16 16:55 ` [PATCH 6.1 000/522] 6.1.176-rc1 review Brett A C Sheffield
1 sibling, 0 replies; 3+ messages in thread
From: Greg Kroah-Hartman @ 2026-06-16 14:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Will Deacon, linux-arm-kernel,
linux-kernel, David Hildenbrand (Arm), Ryan Roberts,
Anshuman Khandual, Catalin Marinas, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anshuman Khandual <anshuman.khandual@arm.com>
[ Upstream commit 48478b9f791376b4b89018d7afdfd06865498f65 ]
During a memory hot remove operation, both linear and vmemmap mappings for
the memory range being removed, get unmapped via unmap_hotplug_range() but
mapped pages get freed only for vmemmap mapping. This is just a sequential
operation where each table entry gets cleared, followed by a leaf specific
TLB flush, and then followed by memory free operation when applicable.
This approach was simple and uniform both for vmemmap and linear mappings.
But linear mapping might contain CONT marked block memory where it becomes
necessary to first clear out all entire in the range before a TLB flush.
This is as per the architecture requirement. Hence batch all TLB flushes
during the table tear down walk and finally do it in unmap_hotplug_range().
Prior to this fix, it was hypothetically possible for a speculative access
to a higher address in the contiguous block to fill the TLB with shattered
entries for the entire contiguous range after a lower address had already
been cleared and invalidated. Due to the table entries being shattered, the
subsequent TLB invalidation for the higher address would not then clear the
TLB entries for the lower address, meaning stale TLB entries could persist.
Besides it also helps in improving the performance via TLBI range operation
along with reduced synchronization instructions. The time spent executing
unmap_hotplug_range() improved 97% measured over a 2GB memory hot removal
in KVM guest.
This scheme is not applicable during vmemmap mapping tear down where memory
needs to be freed and hence a TLB flush is required after clearing out page
table entry.
Cc: Will Deacon <will@kernel.org>
Cc: linux-arm-kernel@lists.infradead.org
Cc: linux-kernel@vger.kernel.org
Closes: https://lore.kernel.org/all/aWZYXhrT6D2M-7-N@willie-the-truck/
Fixes: bbd6ec605c0f ("arm64/mm: Enable memory hot remove")
Cc: stable@vger.kernel.org
Reviewed-by: David Hildenbrand (Arm) <david@kernel.org>
Reviewed-by: Ryan Roberts <ryan.roberts@arm.com>
Signed-off-by: Ryan Roberts <ryan.roberts@arm.com>
Signed-off-by: Anshuman Khandual <anshuman.khandual@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
[ replaced `__pte_clear()` with `pte_clear()` ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/mm/mmu.c | 36 ++++++++++++++++++++----------------
1 file changed, 20 insertions(+), 16 deletions(-)
--- a/arch/arm64/mm/mmu.c
+++ b/arch/arm64/mm/mmu.c
@@ -925,10 +925,14 @@ static void unmap_hotplug_pte_range(pmd_
WARN_ON(!pte_present(pte));
pte_clear(&init_mm, addr, ptep);
- flush_tlb_kernel_range(addr, addr + PAGE_SIZE);
- if (free_mapped)
+ if (free_mapped) {
+ /* CONT blocks are not supported in the vmemmap */
+ WARN_ON(pte_cont(pte));
+ flush_tlb_kernel_range(addr, addr + PAGE_SIZE);
free_hotplug_page_range(pte_page(pte),
PAGE_SIZE, altmap);
+ }
+ /* unmap_hotplug_range() flushes TLB for !free_mapped */
} while (addr += PAGE_SIZE, addr < end);
}
@@ -949,15 +953,14 @@ static void unmap_hotplug_pmd_range(pud_
WARN_ON(!pmd_present(pmd));
if (pmd_sect(pmd)) {
pmd_clear(pmdp);
-
- /*
- * One TLBI should be sufficient here as the PMD_SIZE
- * range is mapped with a single block entry.
- */
- flush_tlb_kernel_range(addr, addr + PAGE_SIZE);
- if (free_mapped)
+ if (free_mapped) {
+ /* CONT blocks are not supported in the vmemmap */
+ WARN_ON(pmd_cont(pmd));
+ flush_tlb_kernel_range(addr, addr + PMD_SIZE);
free_hotplug_page_range(pmd_page(pmd),
PMD_SIZE, altmap);
+ }
+ /* unmap_hotplug_range() flushes TLB for !free_mapped */
continue;
}
WARN_ON(!pmd_table(pmd));
@@ -982,15 +985,12 @@ static void unmap_hotplug_pud_range(p4d_
WARN_ON(!pud_present(pud));
if (pud_sect(pud)) {
pud_clear(pudp);
-
- /*
- * One TLBI should be sufficient here as the PUD_SIZE
- * range is mapped with a single block entry.
- */
- flush_tlb_kernel_range(addr, addr + PAGE_SIZE);
- if (free_mapped)
+ if (free_mapped) {
+ flush_tlb_kernel_range(addr, addr + PUD_SIZE);
free_hotplug_page_range(pud_page(pud),
PUD_SIZE, altmap);
+ }
+ /* unmap_hotplug_range() flushes TLB for !free_mapped */
continue;
}
WARN_ON(!pud_table(pud));
@@ -1020,6 +1020,7 @@ static void unmap_hotplug_p4d_range(pgd_
static void unmap_hotplug_range(unsigned long addr, unsigned long end,
bool free_mapped, struct vmem_altmap *altmap)
{
+ unsigned long start = addr;
unsigned long next;
pgd_t *pgdp, pgd;
@@ -1041,6 +1042,9 @@ static void unmap_hotplug_range(unsigned
WARN_ON(!pgd_present(pgd));
unmap_hotplug_p4d_range(pgdp, addr, next, free_mapped, altmap);
} while (addr = next, addr < end);
+
+ if (!free_mapped)
+ flush_tlb_kernel_range(start, end);
}
static void free_empty_pte_table(pmd_t *pmdp, unsigned long addr,
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH 6.1 000/522] 6.1.176-rc1 review
2026-06-16 14:52 [PATCH 6.1 000/522] 6.1.176-rc1 review Greg Kroah-Hartman
2026-06-16 14:58 ` [PATCH 6.1 337/522] arm64/mm: Enable batched TLB flush in unmap_hotplug_range() Greg Kroah-Hartman
@ 2026-06-16 16:55 ` Brett A C Sheffield
1 sibling, 0 replies; 3+ messages in thread
From: Brett A C Sheffield @ 2026-06-16 16:55 UTC (permalink / raw)
To: gregkh
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill, sr,
Brett A C Sheffield
# Librecast Test Results
020/020 [ OK ] liblcrq
010/010 [ OK ] libmld
120/120 [ OK ] liblibrecast
CPU/kernel: Linux auntie 6.1.176-rc1-01488-g6db5a9e163ae #1 SMP PREEMPT_DYNAMIC Tue Jun 16 15:53:20 -00 2026 x86_64 AMD Ryzen 9 9950X 16-Core Processor AuthenticAMD GNU/Linux
Tested-by: Brett A C Sheffield <bacs@librecast.net>
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-06-16 17:49 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-06-16 14:52 [PATCH 6.1 000/522] 6.1.176-rc1 review Greg Kroah-Hartman
2026-06-16 14:58 ` [PATCH 6.1 337/522] arm64/mm: Enable batched TLB flush in unmap_hotplug_range() Greg Kroah-Hartman
2026-06-16 16:55 ` [PATCH 6.1 000/522] 6.1.176-rc1 review Brett A C Sheffield
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox