From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 51FB0272E53; Thu, 20 Aug 2026 16:27:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787243275; cv=none; b=f8ZiHHEzEiw5ArnIyWyZlz/3/A6JsYf4uHj4xNYoxKI9EwrlDBFgdiTkSwor1q8GbzCA0cR65ZNXjut+TjPaJjoodFQBJvM+t/dxdZtGUYCn0dVsJ91GPG3YS13bryVR0R4mx9a9UBKHH6ehQ8UOnDqStcl0USG2vTLVw9EfjUU= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787243275; c=relaxed/simple; bh=72Rs9eIqETe8bwxTZ+FTAKiGn+6NpYeFesQKFre7npc=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version:Content-Type; b=qMHGJDkpRs7tbRqEMh9y456EvlQjCEDWdygeyqp7/cywg+Uq+fh2YhVvVhUcc+IXa/lT05slImGl1n2W6pJpCR9LCHgaShrNq6BRcFZEik0PnHSaEIntnIxvkqD5dVdffwK8jdWXTbhs4ZcJFdNFKV1Zbpv3OZs5q2tR+wqJl1c= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=1re+94Hd; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="1re+94Hd" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 136071F000E9; Thu, 20 Aug 2026 16:27:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1787243271; bh=K1kUntSACGYx/wlT+xJN6oxaA2lRoiHDkOhoKxK4sXg=; h=From:To:Cc:Subject:Date; b=1re+94HdJC7kqV5P4zzQ89PGG22SOwFPtWBfQdbxGSu20IAvabr6ZwjyCDrt6Rd1o uMmqnPufxEQe7SuCALB/M2kgEWMIwvdfGAVW0WmqDXBp2dc+LqVVCVb+wm27r8Ysr1 y35I3SndW10Wtqo6L67vgb4CS7mVGfdDo6aYdqaE= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, linux-kernel@vger.kernel.org, torvalds@linux-foundation.org, akpm@linux-foundation.org, linux@roeck-us.net, shuah@kernel.org, patches@kernelci.org, lkft-triage@lists.linaro.org, pavel@nabladev.com, jonathanh@nvidia.com, f.fainelli@gmail.com, sudipm.mukherjee@gmail.com, rwarsow@gmx.de, conor@kernel.org, hargar@microsoft.com, broonie@kernel.org, achill@achill.org, sr@sladewatkins.com Subject: [PATCH 5.15 000/272] 5.15.217-rc1 review Date: Thu, 20 Aug 2026 16:53:04 +0200 Message-ID: <20260820145231.229664293@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-KernelTest-Patch: http://kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.217-rc1.gz X-KernelTest-Tree: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git X-KernelTest-Branch: linux-5.15.y X-KernelTest-Patches: git://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git X-KernelTest-Version: 5.15.217-rc1 X-KernelTest-Deadline: 2026-08-22T14:52+00:00 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This is the start of the stable review cycle for the 5.15.217 release. There are 272 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sat, 22 Aug 2026 14:51:11 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.217-rc1.gz or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman Linux 5.15.217-rc1 Easwar Hariharan jiffies: Cast to unsigned long in secs_to_jiffies() conversion Dmitry Osipenko drm/virtio: Unlock reservations on dma_resv_reserve_fences() error Zack Rusin drm/vmwgfx: Reserve fence slots on buffer objects in cotables Robert Mader udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf() Christian Brauner binfmt_misc: use exe_file_deny_write_access() for the interpreter clone Baul Lee net/x25: fix use-after-free of the socket by its timers Siddharth Vadapalli net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG Eric Dumazet af_packet: Don't send zero-byte data in tpacket_snd(). Rosen Penev ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers Wei Fang net: packet: fix wrong transport_header when sending VLAN-tagged frame Florian Westphal netfilter: ipset: fix list type element drift bug Jérémy Jean netfilter: flowtable: publish GC-visible tuple last Alexey Velichayshiy netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path Xiang Mei (Microsoft) netfilter: ipset: fix refcount race between list:set GC and swap Herbert Xu crypto: ccm - Set rfc4309 maxauthsize from child Jon Hunter arm64: tegra: Add EL2 virtual timer interrupt for Tegra194 Daming Li net: smc: fix splice entry lifetime imbalance in smc_rx_splice Guangguan Wang net/smc: rdma write inline if qp has sufficient inline space Yangyu Chen net: atlantic: free stranded TX buffers on ring deinit Hyunjung Ko net/sched: act_ct: fix sk_buff leak when the header checks reject a packet Xin Long openvswitch: move key and ovs_cb update out of handle_fragments Xin Long net: sched: use skb_ip_totlen and iph_totlen Xin Long openvswitch: use skb_ip_totlen in conntrack Xin Long net: add a couple of helpers for iph tot_len Lorenzo Stoakes (ARM) mm/ptdump: always stabilise against page table freeing using init_mm Tejun Heo sched/psi: Shut down rtpoll_timer in psi_cgroup_free() Yang Wang drm/amd/pm: fix torn gpu metrics reads Aaron Ma ice: wait for reset completion in ice_resume() Easwar Hariharan jiffies: Define secs_to_jiffies() Marc Kleine-Budde can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure Jonas Gorski i2c: iproc: reset bus after timeout if START_BUSY is stuck Wolfram Sang i2c: bcm-iproc: remove printout on handled timeouts Liem i2c: imx: Fix slave registration race and error handling Christian Brauner binfmt_misc: restore write access when removing an entry Amir Goldstein fs: don't block write during exec on pre-content watched files Amir Goldstein fsnotify: opt-in for permission events at file open time Dawei Feng ice: fix memory leak in ice_lbtest_prepare_rings() Dawid Osuchowski ice: fix VF interrupts cleanup Ibrahim Hashimov scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write Damien Le Moal scsi: scsi_debug: Rename zone type constants Damien Le Moal scsi: sd: sd_zbc: Return early in sd_zbc_check_zoned_characteristics() Bart Van Assche scsi: sd: sd_zbc: Introduce struct zoned_disk_info Damien Le Moal scsi: sd: sd_zbc: Use logical blocks as unit when querying zones Bart Van Assche scsi: sd: sd_zbc: Improve source code documentation Chengfeng Ye net: pktgen: fix proc entry use-after-free Peter Seiderer net: pktgen: fix code style (WARNING: Block comments) David Carlier igc: remove napi_synchronize() in igc_down() Maoyi Xie wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() Namjae Jeon ksmbd: reject repeated SMB2 NEGOTIATE requests Namjae Jeon ksmbd: conn lock to serialize smb2 negotiate Gregory Price mm/vmstat: fold stranded per-cpu node stats when a node comes online Namjae Jeon ksmbd: validate minimum PDU size for transform requests ChenXiaoSong smb/server: fix minimum SMB2 PDU size ChenXiaoSong smb/server: fix minimum SMB1 PDU size Namjae Jeon ksmbd: rename smb2_get_msg to smb_get_msg Christian Brauner super: fix emergency thaw deadlock on frozen block devices Tengda Wu ftrace: Add global mutex to serialize trace_parser access Aldo Ariel Panzardo net/sched: serialize qdisc_rtab_list against concurrent get/put James Montgomery ksmbd: defer destroy_previous_session() until after NTLM authentication Pavitra Jha libceph: fix two unsafe bare decodes in decode_lockers() Max Kellermann ceph: fix hanging __ceph_get_caps() with stale mds_wanted Xiubo Li ceph: print cluster fsid and client global_id in all debug logs Xiubo Li ceph: rename _to_client() to _to_fs_client() Xiubo Li libceph: add doutc and *_client debug macros support Xiang Mei libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE Andy Shevchenko libceph: Amend checking to fix `make W=1` build breakage Max Kellermann ceph: avoid fs reclaim while using current->journal_info Zhiling Zou sctp: avoid auth_enable sysctl UAF during netns teardown Chenguang Zhao mptcp: decrement subflows counter on failed passive join Paolo Abeni mptcp: fix subflow accounting on close Paolo Abeni mptcp: cleanup MPJ subflow list handling Hugo Villeneuve serial: sc16is7xx: implement gpio get_direction() callback Hugo Villeneuve serial: sc16is7xx: fix regression with GPIO configuration Hugo Villeneuve serial: sc16is7xx: remove obsolete out_thread label Ilpo Järvinen serial: sc16is7xx: Fill in rs485_supported Tomasz Moń sc16is7xx: Properly resume TX after stop LiangCheng Wang wifi: brcmfmac: set F2 blocksize to 256 for BCM43752 Gokul Sivakumar wifi: brcmfmac: fix 43752 SDIO FWVID incorrectly labelled as Cypress (CYW) Jiangshan Yi serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms Andy Shevchenko serial: 8250_mid: Remove unneeded test for ->setup() presence Fan Wu wifi: brcmfmac: drain bus_reset work on device removal Norbert Szetei ALSA: seq: close a re-opened queue timer in the destructor Mirela Rabulea media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor() Sakari Ailus media: v4l: async: Set owner for async sub-devices Daniel Hodges wifi: ath6kl: fix use-after-free in aggr_reset_state() Sakari Ailus media: imx219: Fix maximum frame length in lines Jai Luthra media: i2c: imx219: Rename VTS to FRM_LENGTH David Plowman media: i2c: imx219: Correct the minimum vblanking value Laurent Pinchart media: i2c: imx219: Drop IMX219_VTS_* macros Guangshuo Li media: marvell-cam: fix missing pci_disable_device() on remove Jani Nikula drm/i915/hdcp: require monotonically increasing seq_num_v Jani Nikula drm/i915/hdcp: check streams[] bounds before overflow Jani Nikula drm/i915/vrr: require valid min/max vfreq for VRR David Carlier media: aspeed: fix missing of_reserved_mem_device_release() on probe failure Bryam Vargas drm/virtio: bound EDID block reads to the response buffer Dmitry Osipenko drm/virtio: Return proper error codes instead of -1 Timur Kristóf drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT Thomas Zimmermann drm/tegra: fbdev: Remove offset into framebuffer memory Jani Nikula drm/displayid: fix Tiled Display Topology ID size Deepanshu Kartikey drm/virtio: use uninterruptible resv lock for plane updates Christian König dma-buf/drivers: make reserving a shared slot mandatory v4 Ashutosh Desai drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers Ashutosh Desai drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers Cen Zhang usb: gadget: f_tcm: synchronize delayed set_alt with teardown Ashutosh Desai drm/dp/mst: fix buffer overflows in sideband chunk accumulation David Matlack KVM: x86/mmu: Rename __direct_map() to direct_map() David Matlack KVM: x86/mmu: Split out TDP MMU page fault handling Chao Peng KVM: Rename mmu_notifier_* to mmu_invalidate_* Sean Christopherson KVM: x86/mmu: Document the "rules" for using host_pfn_mapping_level() Sean Christopherson KVM: x86/mmu: Rename pte_list_{destroy,remove}() to show they zap SPTEs Sean Christopherson KVM: x86/mmu: Directly "destroy" PTE list when recycling rmaps Reinette Chatre fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list Dawei Feng octeontx2-pf: fix SQB pointer leak on init failure Haoxiang Li net: ipa: fix SMEM state handle leaks in SMP2P init Sabrina Dubroca espintcp: use sk_msg_free_partial to fix partial send Breno Leitao bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline() Breno Leitao bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c Rasmus Villemoes bootconfig: do not put quotes on cmdline items unless necessary Bryam Vargas net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked Vladimir Oltean net/sched: taprio: avoid calling child->ops->dequeue(child) twice Runyu Xiao gpio: tegra: do not call pinctrl for GPIO direction Bartosz Golaszewski treewide: rename pinctrl_gpio_direction_output_new() Junrui Luo octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF Maoyi Xie net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink Dexuan Cui net: mana: Validate the packet length reported by the NIC Zihan Xi net/sched: act_ct: preserve tc_skb_cb across defragmentation Haoxiang Li net: ixp4xx_hss: fix duplicate HDLC netdev allocation Maoyi Xie net: ipip: require CAP_NET_ADMIN in the device netns for changelink Liu Jian net: Add helper function to parse netlink msg of ip_tunnel_encap Thomas Gleixner locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() Guangshuo Li mmc: vub300: fix use-after-free on probe failure Johan Hovold mmc: vub300: rename probe error labels Johan Hovold mmc: vub300: fix use-after-free on disconnect Dmitry Torokhov Input: ims-pcu - fix firmware leak in async update Dmitry Torokhov firmware_loader: introduce __free() cleanup hanler Mikulas Patocka dm-verity: make error counter atomic Mikulas Patocka dm-integrity: don't increment hash_offset twice Abdun Nihaal scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup() Souvik Banerjee ovl: use linked upper dentry in copy-up tmpfile Jann Horn bpf,fork: wipe ->bpf_storage before bailouts that access it Michael Bommarito thunderbolt: Prevent XDomain delayed work use-after-free on disconnect Mika Westerberg thunderbolt: Remove XDomain from the bus without holding tb->lock Mika Westerberg thunderbolt: Remove service debugfs entries during unregister Mika Westerberg thunderbolt: Keep XDomain reference during the lifetime of a service Alan Borzeszkowski thunderbolt: Update property.c function documentation Christophe JAILLET thunderbolt: Remove usage of the deprecated ida_simple_xx() API Fan Wu can: esd_usb: kill anchored URBs before freeing netdevs Frank Jungclaus can/esd_usb2: Rename esd_usb2.c to esd_usb.c Vincent Jardin i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) Stefan Eichenberger i2c: imx: separate atomic, dma and non-dma use case Ibrahim Hashimov ksmbd: fix integer overflow in set_file_allocation_info() Jarkko Sakkinen tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat() Fredric Cover smb: client: use kvzalloc() for megabyte buffer in simple fallocate Yiyang Chen taskstats: retain dead thread stats in TGID queries Oleg Nesterov taskstats: fill_stats_for_tgid: use for_each_thread() Frank Li dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK Frank Li dmaengine: dw-edma: Detach the private data and chip info structures Frank Li dmaengine: dw-edma: Remove unused irq field in struct dw_edma_chip Miquel Raynal mtd: spi-nor: swp: Improve locking user experience Michael Walle mtd: spi-nor: Fix spi_nor_try_unlock_all() Maoyi Xie net: thunderbolt: Fix frags[] overflow by bounding frame_count Florian Fuchs mtd: maps: vmu-flash: fix fault in unaligned fixup Breno Leitao 9p: skip nlink update in cacheless mode to fix WARN_ON Michael Bommarito ntfs3: validate split-point offset in indx_insert_into_buffer Konstantin Komarov fs/ntfs3: Undo critial modificatins to keep directory consistency Pavel Skripkin fs/ntfs3: Make ntfs_update_mftmirr return void Tristan Madani selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() Casey Schaufler lsm: infrastructure management of the sock security Ondrej Mosnacek lsm: use default hook return value in call_int_hook() Wasim Nazir remoteproc: qcom: Fix leak when custom dump_segments addition fails Yogesh Lal remoteproc: qcom: pas: Adjust the phys addr wrt the mem region Mukesh Ojha remoteproc: qcom: fix sparse warnings Mukesh Ojha remoteproc: qcom: replace kstrdup with kstrndup Florian Westphal netfilter: nft_set_pipapo: don't leak bad clone into future transaction Florian Westphal netfilter: nft_set_pipapo: move cloning of match info to insert/removal path Florian Westphal netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone Florian Westphal netfilter: nft_set_pipapo: merge deactivate helper into caller Florian Westphal netfilter: nft_set_pipapo: prepare walk function for on-demand clone Florian Westphal netfilter: nft_set_pipapo: make pipapo_clone helper return NULL Pablo Neira Ayuso netfilter: nf_conntrack_sip: validate skb_dst() before accessing it Florian Westphal netfilter: nf_conntrack_sip: remove net variable shadowing Florian Westphal netfilter: nft_set_pipapo: move prove_locking helper around Florian Westphal netfilter: nft_set_pipapo: use GFP_KERNEL for insertions Cássio Gabriel ASoC: mediatek: mt8192: Check runtime resume during probe Tang Bin ASoC: mediatek: mt8192-afe-pcm: Simplify probe() with local dev variable AngeloGioacchino Del Regno ASoC: mediatek: Use common mtk_afe_pcm_platform with common probe cb AngeloGioacchino Del Regno ASoC: mediatek: mt8192-afe-pcm: Simplify with dev_err_probe() AngeloGioacchino Del Regno ASoC: mediatek: mt8192-afe-pcm: Convert to devm_pm_runtime_enable() Haoze Xie netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst Eric Dumazet ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu] Eric Dumazet net: dst: add four helpers to annotate data-races around dst->dev Eric Dumazet net: dst: annotate data-races around dst->output Eric Dumazet net: dst: annotate data-races around dst->input Eric Dumazet tcp: convert to dev_net_rcu() Cássio Gabriel ASoC: mediatek: mt8183: Check runtime resume during probe Runyu Xiao octeontx2-vf: clear stale mailbox IRQ state before request_irq() Runyu Xiao octeontx2-pf: clear stale mailbox IRQ state before request_irq() Subbaraya Sundeep octeontx2: Annotate mmio regions as __iomem Geetha sowjanya octeontx2-af: Fix APR entry mapping based on APR_LMT_CFG Jason Wang VDUSE: avoid leaking information to userspace Eugenio Pérez vduse: take out allocations from vduse_dev_alloc_coherent Eugenio Pérez vduse: remove unused vaddr parameter of vduse_domain_free_coherent Sheng Zhao vduse: Use fixed 4KB bounce pages for non-4KB page size Wentao Liang mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() Petr Machata mlxsw: spectrum: On port enslavement to a LAG, join upper's bridges Li Xiasong tipc: restrict socket queue dumps in enqueue tracepoints Jiacheng Yu fbcon: Use correct type for vc_resize() return value Thomas Zimmermann fbcon: Rename struct fbcon_ops to struct fbcon_par Li Daming rxrpc: serialize kernel accept preallocation with socket teardown Tapio Reijonen serial: max310x: implement gpio_chip::get_direction() Hugo Villeneuve serial: max310x: replace bare use of 'unsigned' with 'unsigned int' (checkpatch) Xu Rao ALSA: hda: Fix cached processing coefficient verbs Ricardo Robaina audit: fix recursive locking deadlock in audit_dupe_exe() Ricardo Robaina audit: use 'unsigned int' instead of 'unsigned' Jeff Layton audit: widen ino fields to u64 NeilBrown VFS/audit: introduce kern_path_parent() for audit Zhang Heng ALSA: hda: conexant: Remove mic bias threshold override Bryam Vargas Input: mms114 - reject an oversized device packet size Haoxiang Li i2c: davinci: Unregister cpufreq notifier on probe failure Dmitry Torokhov Input: mms114 - fix touch indexing for MMS134S and MMS136 Sebastian Alba Vives fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() Mikhail Gavrilov dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning Jason Gunthorpe udmabuf: Do not create malformed scatterlists Matt Bobrowski bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized Weinan Liu iommu/amd: Don't split flush for amd_iommu_domain_flush_all() Pedro Falcato mm: do file ownership checks with the proper mount idmap Xiang Mei net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot Christoph Hellwig xfs: check v5 superblock features early Long Li xfs: fix ilock leak on error in xfs_dq_get_next_id David Rosca drm/amdgpu: Fix UVD decode image min size calculation David Rosca drm/amdgpu: Implement insert_end for VCE 3 David Rosca drm/amdgpu: Reject UVD message with dimensions above 4096 Candice Li drm/amdgpu: validate GEM_CREATE domain combinations David Rosca drm/amdgpu: Reject UVD message with invalid number of h265 refs Eric Farman s390/vfio_ccw: Fix out of bounds check on CCW array Guangshuo Li drm/radeon: fix autosuspend cleanup during teardown Pei Xiao mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition Haibo Chen mmc: sdhci: make tuning_err a signed int Myeonghun Pak mmc: sdhci: unmap the bounce buffer before device release Zhan Xusheng mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit Kefu Chai libceph: tolerate addrvecs with multiple entries of the same type Yiming Zhu ceph: fix MDS random selection readiness predicate Raphael Zimmer libceph: Avoid using invalid osd indices from primary_temp Dmitry Torokhov Input: sur40 - fix V4L error path cleanup Dmitry Torokhov Input: sur40 - fix input device registration ordering Ali Ahmet Memis openrisc: signal: do not restore privileged SR bits on sigreturn Josh Poimboeuf ftrace: Fix off-by-one fentry site disable in ftrace_free_mem() Pavitra Jha libceph: fix multiple unsafe decodes in decode_locker() Thorsten Blum crypto: qce - fix error path in devm_qce_register_algs Dmitry Torokhov Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue Dmitry Torokhov Input: synaptics-rmi4 - block s_input when F54 queue is busy Bryam Vargas Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer Dmitry Torokhov Input: synaptics-rmi4 - zero report size on F54 work error George Wilson powerpc/pseries: lparcfg - fix kbuf[] underflow Pengpeng Hou Input: iforce - validate input packet lengths Zhefu Zhang Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard Linmao Li Input: psxpad-spi - set driver data before use Richard Davies Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet Dmitry Torokhov Input: synaptics-rmi4 - fix F55 transmitter electrode count typo George Wilson powerpc/pseries: pci - logic bug Dawid Wróbel ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses Peter Ujfalusi ASoC: cs4265: sort the register default table Hidayath Khan s390/qeth: validate user buffer length in SNMP and ARP query ioctls Matthieu Baerts (NGI0) mptcp: options: reset DSS fields in case of unexpected size Bryam Vargas selinux: do not cancel a policy conversion that never started Bryam Vargas selinux: reject a class permission count below its inherited common Bryam Vargas selinux: require every boolean value to be defined Yizhou Zhao ipvs: separate destination availability state Zhan Xusheng fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() Jiasheng Jiang media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization Fullway Wang media: mtk-vcodec: potential null pointer deference in SCP Chao Yu f2fs: fix UAF issue in f2fs_merge_page_bio() ------------- Diffstat: Makefile | 4 +- arch/arm64/boot/dts/nvidia/tegra194.dtsi | 2 + arch/arm64/kvm/mmu.c | 10 +- arch/mips/kvm/mmu.c | 12 +- arch/openrisc/include/asm/processor.h | 2 + arch/openrisc/kernel/signal.c | 5 +- arch/powerpc/include/asm/kvm_book3s_64.h | 2 +- arch/powerpc/kvm/book3s_64_mmu_host.c | 4 +- arch/powerpc/kvm/book3s_64_mmu_hv.c | 4 +- arch/powerpc/kvm/book3s_64_mmu_radix.c | 6 +- arch/powerpc/kvm/book3s_64_vio_hv.c | 2 +- arch/powerpc/kvm/book3s_hv_nested.c | 2 +- arch/powerpc/kvm/book3s_hv_rm_mmu.c | 8 +- arch/powerpc/kvm/e500_mmu_host.c | 4 +- arch/powerpc/platforms/pseries/lparcfg.c | 2 +- arch/powerpc/platforms/pseries/pci.c | 2 +- arch/x86/kernel/cpu/resctrl/rdtgroup.c | 12 +- arch/x86/kvm/mmu/mmu.c | 154 ++++-- arch/x86/kvm/mmu/paging_tmpl.h | 6 +- crypto/ccm.c | 2 +- drivers/char/tpm/tpm_tis_core.c | 38 +- drivers/crypto/qce/core.c | 2 +- drivers/dma-buf/dma-resv.c | 10 +- drivers/dma-buf/udmabuf.c | 21 +- drivers/dma/dw-edma/dw-edma-core.c | 90 ++-- drivers/dma/dw-edma/dw-edma-core.h | 33 +- drivers/dma/dw-edma/dw-edma-pcie.c | 83 ++-- drivers/dma/dw-edma/dw-edma-v0-core.c | 38 +- drivers/dma/dw-edma/dw-edma-v0-core.h | 4 +- drivers/dma/dw-edma/dw-edma-v0-debugfs.c | 18 +- drivers/dma/dw-edma/dw-edma-v0-debugfs.h | 8 +- drivers/fpga/dfl-afu-main.c | 3 + drivers/gpio/gpio-mvebu.c | 4 +- drivers/gpio/gpio-pxa.c | 4 +- drivers/gpio/gpio-rockchip.c | 4 +- drivers/gpio/gpio-tegra.c | 18 +- drivers/gpio/gpio-vf610.c | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 21 + drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 17 + drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 11 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 4 +- drivers/gpu/drm/amd/amdgpu/vce_v3_0.c | 26 +- drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 2 +- drivers/gpu/drm/amd/pm/amdgpu_pm.c | 14 +- drivers/gpu/drm/drm_connector.c | 12 +- drivers/gpu/drm/drm_dp_mst_topology.c | 32 +- drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c | 2 +- drivers/gpu/drm/i915/display/intel_hdcp.c | 12 +- drivers/gpu/drm/i915/display/intel_vrr.c | 4 + drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c | 4 +- drivers/gpu/drm/i915/i915_vma.c | 2 +- drivers/gpu/drm/lima/lima_gem.c | 2 +- drivers/gpu/drm/msm/msm_gem_submit.c | 2 +- drivers/gpu/drm/nouveau/nouveau_fence.c | 2 +- drivers/gpu/drm/qxl/qxl_release.c | 2 +- drivers/gpu/drm/radeon/radeon_kms.c | 1 + drivers/gpu/drm/radeon/radeon_vm.c | 2 +- drivers/gpu/drm/tegra/fb.c | 8 +- drivers/gpu/drm/ttm/ttm_bo.c | 4 +- drivers/gpu/drm/ttm/ttm_execbuf_util.c | 4 +- drivers/gpu/drm/vc4/vc4_gem.c | 2 +- drivers/gpu/drm/vgem/vgem_fence.c | 2 +- drivers/gpu/drm/virtio/virtgpu_drv.h | 1 + drivers/gpu/drm/virtio/virtgpu_gem.c | 28 ++ drivers/gpu/drm/virtio/virtgpu_plane.c | 10 +- drivers/gpu/drm/virtio/virtgpu_vq.c | 9 +- drivers/gpu/drm/vmwgfx/vmwgfx_cotable.c | 4 + drivers/i2c/busses/i2c-bcm-iproc.c | 11 +- drivers/i2c/busses/i2c-davinci.c | 4 +- drivers/i2c/busses/i2c-imx.c | 135 ++++-- drivers/input/joystick/iforce/iforce-packets.c | 11 +- drivers/input/joystick/iforce/iforce-usb.c | 3 + drivers/input/joystick/psxpad-spi.c | 1 + drivers/input/keyboard/atkbd.c | 8 + drivers/input/misc/ims-pcu.c | 5 +- drivers/input/mouse/focaltech.c | 2 +- drivers/input/rmi4/rmi_f54.c | 43 +- drivers/input/rmi4/rmi_f55.c | 4 +- drivers/input/touchscreen/mms114.c | 21 +- drivers/input/touchscreen/sur40.c | 23 +- drivers/iommu/amd/iommu.c | 3 +- drivers/md/dm-integrity.c | 4 - drivers/md/dm-verity-target.c | 12 +- drivers/md/dm-verity.h | 2 +- drivers/media/i2c/imx219.c | 47 +- drivers/media/platform/aspeed-video.c | 1 + drivers/media/platform/marvell-ccic/cafe-driver.c | 1 + .../media/platform/mtk-vcodec/mtk_vcodec_fw_scp.c | 5 + drivers/media/v4l2-core/v4l2-async.c | 8 +- drivers/media/v4l2-core/v4l2-fwnode.c | 6 +- drivers/mmc/host/atmel-mci.c | 2 + drivers/mmc/host/omap_hsmmc.c | 2 +- drivers/mmc/host/sdhci.c | 16 + drivers/mmc/host/sdhci.h | 2 +- drivers/mmc/host/vub300.c | 36 +- drivers/mtd/maps/vmu-flash.c | 8 +- drivers/mtd/spi-nor/swp.c | 30 +- drivers/net/can/usb/Kconfig | 15 +- drivers/net/can/usb/Makefile | 2 +- drivers/net/can/usb/{esd_usb2.c => esd_usb.c} | 5 +- drivers/net/can/usb/gs_usb.c | 2 +- drivers/net/ethernet/aquantia/atlantic/aq_ring.c | 25 + drivers/net/ethernet/aquantia/atlantic/aq_ring.h | 1 + drivers/net/ethernet/aquantia/atlantic/aq_vec.c | 2 +- drivers/net/ethernet/intel/ice/ice_ethtool.c | 10 +- drivers/net/ethernet/intel/ice/ice_main.c | 10 + drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c | 48 ++ drivers/net/ethernet/intel/igc/igc_main.c | 1 - drivers/net/ethernet/marvell/octeontx2/af/rvu.c | 14 +- drivers/net/ethernet/marvell/octeontx2/af/rvu.h | 1 + .../net/ethernet/marvell/octeontx2/af/rvu_cn10k.c | 18 +- .../net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 14 +- .../net/ethernet/marvell/octeontx2/nic/otx2_vf.c | 8 +- drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 92 +++- drivers/net/ethernet/microsoft/mana/mana_en.c | 13 + drivers/net/ethernet/ti/am65-cpsw-nuss.c | 2 + drivers/net/ipa/ipa_smp2p.c | 30 +- drivers/net/thunderbolt.c | 8 +- drivers/net/wan/ixp4xx_hss.c | 4 +- drivers/net/wireless/ath/ath6kl/txrx.c | 2 +- .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 16 +- .../net/wireless/broadcom/brcm80211/brcmfmac/bus.h | 6 + .../wireless/broadcom/brcm80211/brcmfmac/core.c | 45 +- .../wireless/broadcom/brcm80211/brcmfmac/pcie.c | 6 + .../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 8 +- .../wireless/broadcom/brcm80211/brcmfmac/sdio.h | 1 + .../net/wireless/broadcom/brcm80211/brcmfmac/usb.c | 3 + drivers/net/wireless/marvell/libertas_tf/main.c | 2 +- drivers/pinctrl/bcm/pinctrl-bcm2835.c | 4 +- drivers/pinctrl/cirrus/pinctrl-lochnagar.c | 2 +- drivers/pinctrl/core.c | 15 +- drivers/pinctrl/intel/pinctrl-cherryview.c | 4 +- drivers/pinctrl/intel/pinctrl-intel.c | 4 +- drivers/pinctrl/intel/pinctrl-lynxpoint.c | 4 +- drivers/pinctrl/mediatek/pinctrl-moore.c | 4 +- drivers/pinctrl/mediatek/pinctrl-mtk-common.c | 4 +- drivers/pinctrl/mediatek/pinctrl-paris.c | 4 +- drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c | 4 +- drivers/pinctrl/pinctrl-as3722.c | 4 +- drivers/pinctrl/pinctrl-axp209.c | 2 +- drivers/pinctrl/pinctrl-ingenic.c | 11 +- drivers/pinctrl/pinctrl-ocelot.c | 4 +- drivers/pinctrl/pinctrl-rk805.c | 4 +- drivers/pinctrl/pinctrl-st.c | 4 +- drivers/pinctrl/renesas/gpio.c | 4 +- drivers/pinctrl/stm32/pinctrl-stm32.c | 4 +- drivers/pinctrl/sunxi/pinctrl-sunxi.c | 4 +- drivers/pinctrl/vt8500/pinctrl-wmt.c | 4 +- drivers/remoteproc/qcom_common.c | 31 +- drivers/remoteproc/qcom_common.h | 5 +- drivers/remoteproc/qcom_q6v5_pas.c | 20 +- drivers/s390/cio/vfio_ccw_cp.c | 17 +- drivers/s390/net/qeth_core_main.c | 3 + drivers/s390/net/qeth_l3_main.c | 5 + drivers/scsi/lpfc/lpfc_init.c | 3 +- drivers/scsi/scsi_debug.c | 27 +- drivers/scsi/sd.h | 27 +- drivers/scsi/sd_zbc.c | 126 +++-- drivers/thunderbolt/domain.c | 36 +- drivers/thunderbolt/icm.c | 5 + drivers/thunderbolt/nhi.c | 6 +- drivers/thunderbolt/nvm.c | 4 +- drivers/thunderbolt/property.c | 38 +- drivers/thunderbolt/switch.c | 20 +- drivers/thunderbolt/tb.c | 58 +-- drivers/thunderbolt/tb.h | 2 + drivers/thunderbolt/xdomain.c | 96 ++-- drivers/tty/serial/8250/8250_mid.c | 6 +- drivers/tty/serial/max310x.c | 20 +- drivers/tty/serial/sc16is7xx.c | 192 ++++++-- drivers/usb/gadget/function/f_tcm.c | 192 ++++++-- drivers/usb/gadget/function/tcm.h | 13 + drivers/vdpa/vdpa_user/iova_domain.c | 91 ++-- drivers/vdpa/vdpa_user/iova_domain.h | 13 +- drivers/vdpa/vdpa_user/vduse_dev.c | 16 +- drivers/video/fbdev/core/bitblit.c | 120 ++--- drivers/video/fbdev/core/fbcon.c | 413 ++++++++-------- drivers/video/fbdev/core/fbcon.h | 6 +- drivers/video/fbdev/core/fbcon_ccw.c | 146 +++--- drivers/video/fbdev/core/fbcon_cw.c | 146 +++--- drivers/video/fbdev/core/fbcon_rotate.c | 44 +- drivers/video/fbdev/core/fbcon_rotate.h | 6 +- drivers/video/fbdev/core/fbcon_ud.c | 162 +++---- drivers/video/fbdev/core/softcursor.c | 18 +- drivers/video/fbdev/core/tileblit.c | 28 +- fs/9p/vfs_inode.c | 9 + fs/binfmt_elf.c | 4 +- fs/binfmt_elf_fdpic.c | 4 +- fs/binfmt_misc.c | 14 +- fs/ceph/acl.c | 6 +- fs/ceph/addr.c | 20 +- fs/ceph/cache.c | 2 +- fs/ceph/caps.c | 53 ++- fs/ceph/dir.c | 20 +- fs/ceph/export.c | 10 +- fs/ceph/file.c | 42 +- fs/ceph/inode.c | 14 +- fs/ceph/ioctl.c | 8 +- fs/ceph/mds_client.c | 11 + fs/ceph/mds_client.h | 2 + fs/ceph/mdsmap.c | 2 +- fs/ceph/metric.c | 5 +- fs/ceph/snap.c | 2 +- fs/ceph/super.c | 22 +- fs/ceph/super.h | 14 +- fs/ceph/xattr.c | 12 +- fs/cifs/smb2ops.c | 4 +- fs/crypto/policy.c | 2 +- fs/exec.c | 6 +- fs/f2fs/data.c | 2 +- fs/ksmbd/auth.c | 4 +- fs/ksmbd/connection.c | 23 +- fs/ksmbd/connection.h | 5 + fs/ksmbd/oplock.c | 8 +- fs/ksmbd/smb2pdu.c | 102 ++-- fs/ksmbd/smb2pdu.h | 9 - fs/ksmbd/smb_common.c | 43 +- fs/ksmbd/smb_common.h | 9 + fs/namei.c | 43 ++ fs/ntfs3/fsntfs.c | 20 +- fs/ntfs3/index.c | 44 +- fs/ntfs3/ntfs_fs.h | 2 +- fs/overlayfs/copy_up.c | 14 +- fs/super.c | 19 +- fs/xfs/libxfs/xfs_sb.c | 4 +- fs/xfs/xfs_dquot.c | 3 +- include/drm/drm_connector.h | 6 +- include/drm/drm_displayid.h | 2 +- include/linux/audit.h | 18 +- include/linux/bootconfig.h | 3 + include/linux/bpf_lsm.h | 4 + include/linux/ceph/ceph_debug.h | 38 ++ include/linux/dma-resv.h | 2 +- include/linux/dma/edma.h | 50 +- include/linux/firmware.h | 3 + include/linux/fs.h | 33 ++ include/linux/ip.h | 21 + include/linux/jiffies.h | 13 + include/linux/kvm_host.h | 60 +-- include/linux/lsm_hooks.h | 1 + include/linux/mmc/sdio_ids.h | 2 +- include/linux/namei.h | 1 + include/linux/pinctrl/consumer.h | 13 +- include/linux/thunderbolt.h | 3 + include/media/v4l2-async.h | 8 +- include/net/dst.h | 24 +- include/net/inet6_hashtables.h | 2 +- include/net/inet_hashtables.h | 2 +- include/net/ip.h | 11 +- include/net/ip_tunnels.h | 3 + include/net/ip_vs.h | 7 + include/net/lwtunnel.h | 8 +- include/net/netfilter/nf_queue.h | 1 + include/net/route.h | 5 +- include/uapi/linux/ip_vs.h | 6 - init/main.c | 39 -- kernel/audit.c | 2 +- kernel/audit.h | 32 +- kernel/audit_fsnotify.c | 39 +- kernel/audit_tree.c | 2 +- kernel/audit_watch.c | 42 +- kernel/auditfilter.c | 17 +- kernel/auditsc.c | 6 +- kernel/bpf/bpf_inode_storage.c | 10 + kernel/fork.c | 21 +- kernel/locking/spinlock_rt.c | 27 +- kernel/sched/psi.c | 6 + kernel/taskstats.c | 67 +-- kernel/trace/ftrace.c | 21 +- lib/bootconfig.c | 65 +++ lib/compat_audit.c | 12 +- mm/madvise.c | 3 +- mm/memory_hotplug.c | 15 +- mm/mincore.c | 3 +- mm/pagewalk.c | 8 + mm/ptdump.c | 7 + net/bluetooth/hci_event.c | 2 - net/ceph/cls_lock_client.c | 21 +- net/ceph/decode.c | 18 +- net/ceph/osdmap.c | 9 +- net/core/dst.c | 8 +- net/core/pktgen.c | 43 +- net/core/sock.c | 6 +- net/ipv4/icmp.c | 24 +- net/ipv4/igmp.c | 2 +- net/ipv4/ip_fragment.c | 2 +- net/ipv4/ip_output.c | 4 +- net/ipv4/ip_tunnel_core.c | 35 ++ net/ipv4/ip_vti.c | 4 +- net/ipv4/ipip.c | 41 +- net/ipv4/netfilter.c | 4 +- net/ipv4/route.c | 10 +- net/ipv4/tcp_fastopen.c | 4 +- net/ipv4/tcp_ipv4.c | 8 +- net/ipv4/tcp_metrics.c | 8 +- net/ipv4/xfrm4_output.c | 2 +- net/ipv6/ip6_tunnel.c | 40 +- net/ipv6/sit.c | 38 +- net/ipv6/tcp_ipv6.c | 10 +- net/mptcp/options.c | 8 +- net/mptcp/pm_netlink.c | 4 - net/mptcp/protocol.c | 127 +++-- net/mptcp/protocol.h | 29 +- net/mptcp/sockopt.c | 24 +- net/mptcp/subflow.c | 17 +- net/netfilter/ipset/ip_set_core.c | 19 +- net/netfilter/ipset/ip_set_list_set.c | 7 +- net/netfilter/ipvs/ip_vs_conn.c | 4 +- net/netfilter/ipvs/ip_vs_core.c | 6 +- net/netfilter/ipvs/ip_vs_ctl.c | 4 +- net/netfilter/ipvs/ip_vs_dh.c | 4 +- net/netfilter/ipvs/ip_vs_lblc.c | 2 +- net/netfilter/ipvs/ip_vs_lblcr.c | 8 +- net/netfilter/nf_conntrack_sip.c | 10 +- net/netfilter/nf_flow_table_core.c | 7 +- net/netfilter/nf_queue.c | 14 + net/netfilter/nf_tables_offload.c | 2 +- net/netfilter/nfnetlink_queue.c | 3 + net/netfilter/nft_set_pipapo.c | 260 ++++++---- net/netfilter/nft_set_pipapo.h | 8 + net/openvswitch/conntrack.c | 39 +- net/packet/af_packet.c | 7 +- net/rxrpc/call_accept.c | 27 +- net/sched/act_ct.c | 41 +- net/sched/sch_api.c | 24 +- net/sched/sch_cake.c | 2 +- net/sched/sch_taprio.c | 12 +- net/sctp/protocol.c | 20 +- net/sctp/sysctl.c | 9 +- net/smc/af_smc.c | 3 +- net/smc/smc_rx.c | 12 +- net/smc/smc_tx.c | 17 +- net/tipc/socket.c | 6 +- net/x25/af_x25.c | 4 +- net/x25/x25_timer.c | 25 +- net/xfrm/espintcp.c | 32 +- security/apparmor/include/net.h | 6 +- security/apparmor/lsm.c | 38 +- security/bpf/hooks.c | 3 + security/security.c | 530 +++++++++++++-------- security/selinux/hooks.c | 91 ++-- security/selinux/include/objsec.h | 5 + security/selinux/netlabel.c | 23 +- security/selinux/ss/policydb.c | 31 ++ security/selinux/ss/services.c | 4 +- security/smack/smack.h | 5 + security/smack/smack_lsm.c | 66 ++- security/smack/smack_netfilter.c | 8 +- sound/core/seq/seq_timer.c | 13 +- sound/hda/hdac_regmap.c | 4 +- sound/pci/hda/patch_conexant.c | 3 - sound/soc/codecs/cs4265.c | 4 +- sound/soc/codecs/lpass-wsa-macro.c | 8 +- sound/soc/mediatek/mt8183/mt8183-afe-pcm.c | 12 +- sound/soc/mediatek/mt8192/mt8192-afe-pcm.c | 118 ++--- sound/soc/xilinx/xlnx_formatter_pcm.c | 10 +- virt/kvm/kvm_main.c | 49 +- 358 files changed, 4765 insertions(+), 2894 deletions(-)