[PATCH 6.6 000/166] 6.6.153-rc1 review

[PATCH 6.6 000/166] 6.6.153-rc1 review

[Greg Kroah-Hartman]

This is the start of the stable review cycle for the 6.6.153 release.
There are 166 patches in this series, all will be posted as a response
to this one.  If anyone has any issues with these being applied, please
let me know.

Responses should be made by Sat, 22 Aug 2026 14:51:11 +0000.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
	https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.153-rc1.gz
or in the git tree and branch at:
	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Linux 6.6.153-rc1

Paolo Abeni <pabeni@redhat.com>
    net: harmonize tstats and dstats

Christian Brauner <brauner@kernel.org>
    binfmt_misc: use exe_file_deny_write_access() for the interpreter clone

Baul Lee <baul.lee@xbow.com>
    net/x25: fix use-after-free of the socket by its timers

Gao Xiang <xiang@kernel.org>
    erofs: fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms

Jamal Hadi Salim <jhs@mojatatu.com>
    net/sched: cls_bpf: reject dev-bound programs bound to a different device

Siddharth Vadapalli <s-vadapalli@ti.com>
    net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG

Uwe Kleine-König <ukleinek@kernel.org>
    m68k: Define NR_CPUS to 1

Christoph Hellwig <hch@lst.de>
    m68k: use the coherent DMA code for coldfire without data cache

Christoph Hellwig <hch@lst.de>
    dma-direct: add a CONFIG_ARCH_HAS_DMA_ALLOC symbol

Zhang Changzhong <zhangchangzhong@huawei.com>
    net/sched: cls_u32: skip hash tables in u32_bind_class()

Jamal Hadi Salim <jhs@mojatatu.com>
    net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain

Victor Nogueira <victor@mojatatu.com>
    net: sched: Add initial TC error skb drop reasons

Victor Nogueira <victor@mojatatu.com>
    net: sched: Move drop_reason to struct tc_skb_cb

Yan Zhai <yan@cloudflare.com>
    packet: add a generic drop reason for receive

Jamal Hadi Salim <jhs@mojatatu.com>
    net, sched: Fix SKB_NOT_DROPPED_YET splat under debug config

Daniel Borkmann <daniel@iogearbox.net>
    net, sched: Add tcf_set_drop_reason for {__,}tcf_classify

Daniel Borkmann <daniel@iogearbox.net>
    net, sched: Make tc-related drop reason more flexible

Eric Dumazet <edumazet@google.com>
    af_packet: Don't send zero-byte data in tpacket_snd().

Rosen Penev <rosenp@gmail.com>
    ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers

Chuck Lever <cel@kernel.org>
    net/tls: Fail tls_sw_splice_read() after a failed async decrypt

Wei Fang <wei.fang@nxp.com>
    net: packet: fix wrong transport_header when sending VLAN-tagged frame

Eric Dumazet <edumazet@google.com>
    macvlan: inherit needed_headroom and needed_tailroom from lowerdev

Eric Dumazet <edumazet@google.com>
    ipvlan: inherit needed_headroom and needed_tailroom from phy_dev

Florian Westphal <fw@strlen.de>
    netfilter: ipset: let destroy callbacks adjust ext mem size

Florian Westphal <fw@strlen.de>
    netfilter: ipset: fix list type element drift bug

Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
    netfilter: flowtable: publish GC-visible tuple last

Alexey Velichayshiy <a.velichayshiy@ispras.ru>
    netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path

Xiang Mei (Microsoft) <xmei5@asu.edu>
    netfilter: ipset: fix refcount race between list:set GC and swap

Herbert Xu <herbert@gondor.apana.org.au>
    crypto: ccm - Set rfc4309 maxauthsize from child

Jon Hunter <jonathanh@nvidia.com>
    arm64: tegra: Add EL2 virtual timer interrupt for Tegra194

Lorenzo Stoakes (ARM) <ljs@kernel.org>
    mm/huge_memory: fix huge_zero_pfn race

Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
    tls: rx: restore msg_iter before TLS 1.3 optimistic retry

Sabrina Dubroca <sd@queasysnail.net>
    selftests: tls: add rekey tests

Paolo Bonzini <pbonzini@redhat.com>
    KVM: SVM: Serialize accesses to the owner and mirror list with separate lock

Lorenzo Stoakes (ARM) <ljs@kernel.org>
    mm/ptdump: always stabilise against page table freeing using init_mm

Lorenzo Stoakes (ARM) <ljs@kernel.org>
    mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF

Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
    mm/pagewalk: split walk_page_range_novma() into kernel/user parts

Pierre-Eric Pelloux-Prayer <pierre-eric.pelloux-prayer@amd.com>
    drm/amdgpu: move debug_vm handling to amdgpu_cs_parser_fini

Yang Wang <kevinyang.wang@amd.com>
    drm/amd/pm: fix pptable use-after-free

Yang Wang <kevinyang.wang@amd.com>
    drm/amd/pm: fix torn gpu metrics reads

Tu Nguyen <tu.nguyen.xg@renesas.com>
    can: rcar_canfd: change the initializing flow for clocks and resets

Jonas Gorski <jonas.gorski@bisdn.de>
    i2c: iproc: reset bus after timeout if START_BUSY is stuck

Wolfram Sang <wsa+renesas@sang-engineering.com>
    i2c: bcm-iproc: remove printout on handled timeouts

Eric Dumazet <edumazet@google.com>
    vxlan: use pskb_network_may_pull() for transmit path header pulls

Guillaume Nault <gnault@redhat.com>
    vxlan: Handle stats using NETDEV_PCPU_STAT_DSTATS.

Guillaume Nault <gnault@redhat.com>
    vrf: Make pcpu_dstats update functions available to other modules.

Jeremy Kerr <jk@codeconstruct.com.au>
    net: core,vrf: Change pcpu_dstat fields to u64_stats_t

Breno Leitao <leitao@debian.org>
    vxlan: Do not alloc tstats manually

Dawid Osuchowski <dawid.osuchowski@linux.intel.com>
    ice: fix VF interrupts cleanup

Christian Brauner <brauner@kernel.org>
    binfmt_misc: restore write access when removing an entry

Amir Goldstein <amir73il@gmail.com>
    fs: don't block write during exec on pre-content watched files

Matt Fleming <mfleming@cloudflare.com>
    veth: convert frag_list skbs before running XDP

Chengfeng Ye <nicoyip.dev@gmail.com>
    net: pktgen: fix proc entry use-after-free

Peter Seiderer <ps.report@gmx.net>
    net: pktgen: fix code style (WARNING: Block comments)

Namjae Jeon <linkinjeon@kernel.org>
    ksmbd: reject repeated SMB2 NEGOTIATE requests

Namjae Jeon <linkinjeon@kernel.org>
    ksmbd: conn lock to serialize smb2 negotiate

David Carlier <devnexen@gmail.com>
    igc: remove napi_synchronize() in igc_down()

Mark Brown <broonie@kernel.org>
    ASoC: tas2562: Validate values for volume writes

Chengfeng Ye <nicoyip.dev@gmail.com>
    Bluetooth: hci_sync: Fix advertising data UAFs

Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
    Bluetooth: eir: Fix possible crashes on eir_create_adv_data

Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
    Bluetooth: hci_core: Fix not handling hdev->le_num_of_adv_sets=1

Gustavo A. R. Silva <gustavoars@kernel.org>
    Bluetooth: hci_conn, hci_sync: Use __counted_by() to avoid -Wfamnae warnings

Kees Cook <keescook@chromium.org>
    overflow: Change DEFINE_FLEX to take __counted_by member

Maciej Fijalkowski <maciej.fijalkowski@intel.com>
    ice: make ice_vsi_cfg_rxq() static

Przemek Kitszel <przemyslaw.kitszel@intel.com>
    ice: make use of DEFINE_FLEX() in ice_switch.c

Kefeng Wang <wangkefeng.wang@huawei.com>
    mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE

Guanghui Yang <3497809730@qq.com>
    btrfs: zoned: fix missing chunk metadata reservation

Filipe Manana <fdmanana@suse.com>
    btrfs: remove fs_info argument from btrfs_zoned_activate_one_bg()

Naohiro Aota <naohiro.aota@wdc.com>
    btrfs: add space_info argument to btrfs_chunk_alloc()

David Sterba <dsterba@suse.com>
    btrfs: add debug build only WARN

Yuxiang Yang <yangyx22@mails.tsinghua.edu.cn>
    tcp: challenge ACK for non-exact RST in SYN-RECEIVED

Ilpo Järvinen <ij@kernel.org>
    tcp: fast path functions later

Ilpo Järvinen <ij@kernel.org>
    tcp: Pass flags to __tcp_send_ack

Namjae Jeon <linkinjeon@kernel.org>
    ksmbd: validate minimum PDU size for transform requests

ChenXiaoSong <chenxiaosong@kylinos.cn>
    smb/server: fix minimum SMB2 PDU size

ChenXiaoSong <chenxiaosong@kylinos.cn>
    smb/server: fix minimum SMB1 PDU size

Namjae Jeon <linkinjeon@kernel.org>
    ksmbd: rename smb2_get_msg to smb_get_msg

ChenXiaoSong <chenxiaosong@kylinos.cn>
    smb/server: rename include guard in smb_common.h

ZhangGuoDong <zhangguodong@kylinos.cn>
    smb: move get_rfc1002_len() to common/smbglob.h

ZhangGuoDong <zhangguodong@kylinos.cn>
    smb: move smb_version_values to common/smbglob.h

Christian Brauner <brauner@kernel.org>
    super: fix emergency thaw deadlock on frozen block devices

Aldo Ariel Panzardo <qwe.aldo@gmail.com>
    net/sched: serialize qdisc_rtab_list against concurrent get/put

Shiming Cheng <shiming.cheng@mediatek.com>
    net: gro: fix double aggregation of flush-marked skbs

Felix Fietkau <nbd@nbd.name>
    net: move skb_gro_receive_list from udp to core

Pavitra Jha <jhapavitra98@gmail.com>
    libceph: fix two unsafe bare decodes in decode_lockers()

Mike Rapoport (Microsoft) <rppt@kernel.org>
    userfaultfd: prevent registration of special VMAs

Mike Rapoport (Microsoft) <rppt@kernel.org>
    userfaultfd: move vma_can_userfault out of line

Chunyan Zhang <zhangchunyan@iscas.ac.cn>
    mm: userfaultfd: add pgtable_supports_uffd_wp()

Zhang Yi <yi.zhang@huawei.com>
    iomap: fix out-of-bounds bitmap_set() with zero-length range

Matthew Wilcox (Oracle) <willy@infradead.org>
    iomap: hold state_lock over call to ifs_set_range_uptodate()

Chancel Liu <chancel.liu@nxp.com>
    ASoC: fsl_sai: Fix spurious BCLK on resume by clearing BYP

Xiang Mei <xmei5@asu.edu>
    libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE

Andy Shevchenko <andriy.shevchenko@linux.intel.com>
    libceph: Amend checking to fix `make W=1` build breakage

Matthew Wilcox (Oracle) <willy@infradead.org>
    ceph: Use a folio in ceph_page_mkwrite()

Max Kellermann <max.kellermann@ionos.com>
    ceph: fix hanging __ceph_get_caps() with stale mds_wanted

Matthew Wilcox (Oracle) <willy@infradead.org>
    ceph: Remove ceph_writepage()

Max Kellermann <max.kellermann@ionos.com>
    ceph: avoid fs reclaim while using current->journal_info

Sabrina Dubroca <sd@queasysnail.net>
    selftests: tls: add test with a partially invalid iov

Palmer Dabbelt <palmer@rivosinc.com>
    RISC-V: Provide pgtable_l5_enabled on rv32

Christoph Hellwig <hch@lst.de>
    xfs: check v5 superblock features early

Long Li <leo.lilong@huawei.com>
    xfs: don't swallow dquot recovery verification errors

Long Li <leo.lilong@huawei.com>
    xfs: fix ilock leak on error in xfs_dq_get_next_id

Darrick J. Wong <djwong@kernel.org>
    xfs: only check mergeability of bnobt records

Junrui Luo <moonafterrain@outlook.com>
    drm/amdgpu: disallow multiple FENCE chunks in one submit

David Rosca <david.rosca@amd.com>
    drm/amdgpu: Fix UVD decode image min size calculation

David Rosca <david.rosca@amd.com>
    drm/amdgpu: Fix UVD dpb min size calculation for H264

David Rosca <david.rosca@amd.com>
    drm/amdgpu: Fix UVD min buffer sizes

David Rosca <david.rosca@amd.com>
    drm/amdgpu: Implement insert_end for VCE 3

David Rosca <david.rosca@amd.com>
    drm/amdgpu: Reject UVD message with dimensions above 4096

Candice Li <candice.li@amd.com>
    drm/amdgpu: validate GEM_CREATE domain combinations

David Rosca <david.rosca@amd.com>
    drm/amdgpu: Reject UVD message with invalid number of h265 refs

Eric Farman <farman@linux.ibm.com>
    s390/vfio_ccw: Selectively expand io_mutex

Eric Farman <farman@linux.ibm.com>
    s390/vfio_ccw: Move cp cleanup out of not operational

Eric Farman <farman@linux.ibm.com>
    s390/vfio_ccw: Fix out of bounds check on CCW array

Eric Farman <farman@linux.ibm.com>
    s390/vfio_ccw: Ensure index for read/write regions are within range

Eric Farman <farman@linux.ibm.com>
    s390/vfio_ccw: Cancel existing workqueues

Eric Farman <farman@linux.ibm.com>
    s390/vfio_ccw: Limit the number of channel program segments

Eric Farman <farman@linux.ibm.com>
    s390/vfio_ccw: Free all memory if cp_init() fails

Guangshuo Li <lgs201920130244@gmail.com>
    drm/radeon: fix autosuspend cleanup during teardown

Pei Xiao <xiaopei01@kylinos.cn>
    mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition

Haibo Chen <haibo.chen@nxp.com>
    mmc: sdhci: make tuning_err a signed int

Myeonghun Pak <mhun512@gmail.com>
    mmc: sdhci: unmap the bounce buffer before device release

Zhan Xusheng <zhanxusheng1024@gmail.com>
    mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit

Kefu Chai <k.chai@proxmox.com>
    libceph: tolerate addrvecs with multiple entries of the same type

Yiming Zhu <zhuyiming@kuaishou.com>
    ceph: fix MDS random selection readiness predicate

Raphael Zimmer <raphael.zimmer@tu-ilmenau.de>
    libceph: Avoid using invalid osd indices from primary_temp

Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Input: sur40 - fix V4L error path cleanup

Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Input: sur40 - fix input device registration ordering

Ali Ahmet Memis <ali@iusegentoo.com>
    openrisc: signal: do not restore privileged SR bits on sigreturn

Josh Poimboeuf <jpoimboe@kernel.org>
    ftrace: Fix off-by-one fentry site disable in ftrace_free_mem()

Leon Hwang <leon.hwang@linux.dev>
    ftrace: Protect direct_functions in ftrace_find_rec_direct

Pavitra Jha <jhapavitra98@gmail.com>
    libceph: fix multiple unsafe decodes in decode_locker()

Thorsten Blum <thorsten.blum@linux.dev>
    crypto: qce - fix error path in devm_qce_register_algs

Jianing Li <m13940358460@163.com>
    Input: hynitron_cstxxx - validate touch count and finger IDs

Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue

Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Input: synaptics-rmi4 - block s_input when F54 queue is busy

Bryam Vargas <hexlabsecurity@proton.me>
    Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer

Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Input: synaptics-rmi4 - zero report size on F54 work error

George Wilson <gcwilson@linux.ibm.com>
    powerpc/pseries: lparcfg - fix kbuf[] underflow

Pengpeng Hou <pengpeng@iscas.ac.cn>
    Input: iforce - validate input packet lengths

Zhefu Zhang <a723356@gmail.com>
    Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard

Linmao Li <lilinmao@kylinos.cn>
    Input: psxpad-spi - set driver data before use

Richard Davies <richard@arachsys.com>
    Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet

Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Input: synaptics-rmi4 - fix F55 transmitter electrode count typo

George Wilson <gcwilson@linux.ibm.com>
    powerpc/pseries: pci - logic bug

Kyohei Kadota <lufia@lufia.org>
    Input: xpad - add support for ZENAIM LEVERLESS

Asad Kamal <asad.kamal@amd.com>
    drm/amdgpu: fix aperture iounmap skipped on device removal

Mingyu Wang <25181214217@stu.xidian.edu.cn>
    fbdev: core: Fix pointer desynchronization in fb_io_read()

Dawid Wróbel <me@dawidwrobel.com>
    ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses

Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
    ASoC: cs35l41: sort the register default table

Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
    ASoC: cs35l45: sort the register default table

Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
    ASoC: cs4265: sort the register default table

Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
    ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked()

Hidayath Khan <hidayath@linux.ibm.com>
    s390/qeth: validate user buffer length in SNMP and ARP query ioctls

Wyatt Feng <bronzed_45_vested@icloud.com>
    mptcp: fastopen: only mark MPTFO subflows with SYN data

Matthieu Baerts (NGI0) <matttbe@kernel.org>
    mptcp: options: reset DSS fields in case of unexpected size

Matthieu Baerts (NGI0) <matttbe@kernel.org>
    mptcp: avoid combining some incoming suboptions

Gang Yan <yangang@kylinos.cn>
    selftests: mptcp: join: mark tests with data corruption as failed

Bryam Vargas <hexlabsecurity@proton.me>
    selinux: reject an unclaimed class value in security_get_classes()

Bryam Vargas <hexlabsecurity@proton.me>
    selinux: do not cancel a policy conversion that never started

Bryam Vargas <hexlabsecurity@proton.me>
    selinux: reject a class permission count below its inherited common

Bryam Vargas <hexlabsecurity@proton.me>
    selinux: require every boolean value to be defined

Erni Sri Satya Vennela <ernis@linux.microsoft.com>
    net: mana: Fix EQ leak in mana_remove on NULL port

Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
    ipvs: separate destination availability state

Chao Yu <chao@kernel.org>
    f2fs: fix UAF issue in f2fs_merge_page_bio()

Chao Shi <coshi036@gmail.com>
    block: stop the timeout timer when releasing a never added disk


-------------

Diffstat:

 Makefile                                           |   4 +-
 arch/arm/Kconfig                                   |   1 +
 arch/arm64/boot/dts/nvidia/tegra194.dtsi           |   2 +
 arch/m68k/Kconfig                                  |   7 +-
 arch/m68k/Kconfig.cpu                              |  16 +
 arch/m68k/kernel/Makefile                          |   2 +-
 arch/m68k/kernel/dma.c                             |   2 +-
 arch/openrisc/include/asm/processor.h              |   2 +
 arch/openrisc/kernel/dma.c                         |   4 +-
 arch/openrisc/kernel/signal.c                      |   5 +-
 arch/parisc/Kconfig                                |   1 +
 arch/powerpc/platforms/pseries/lparcfg.c           |   2 +-
 arch/powerpc/platforms/pseries/pci.c               |   2 +-
 arch/riscv/include/asm/pgtable-32.h                |   3 +
 arch/riscv/include/asm/pgtable.h                   |   1 -
 arch/riscv/mm/init.c                               |   2 +
 arch/riscv/mm/pageattr.c                           |   8 +-
 arch/x86/kvm/svm/sev.c                             |  34 +-
 arch/x86/kvm/svm/svm.h                             |   1 +
 block/genhd.c                                      |  12 +-
 crypto/ccm.c                                       |   2 +-
 drivers/crypto/qce/core.c                          |   2 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c             |  34 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c            |  21 +
 drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c            |  10 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c            |  85 +---
 drivers/gpu/drm/amd/amdgpu/vce_v3_0.c              |  26 +-
 drivers/gpu/drm/amd/pm/amdgpu_dpm.c                |  27 +-
 drivers/gpu/drm/amd/pm/amdgpu_pm.c                 |  16 +-
 drivers/gpu/drm/amd/pm/inc/amdgpu_dpm.h            |   6 +-
 drivers/gpu/drm/radeon/radeon_kms.c                |   1 +
 drivers/i2c/busses/i2c-bcm-iproc.c                 |  11 +-
 drivers/input/joystick/iforce/iforce-packets.c     |  11 +-
 drivers/input/joystick/iforce/iforce-usb.c         |   3 +
 drivers/input/joystick/psxpad-spi.c                |   1 +
 drivers/input/joystick/xpad.c                      |   2 +
 drivers/input/keyboard/atkbd.c                     |   8 +
 drivers/input/mouse/focaltech.c                    |   2 +-
 drivers/input/rmi4/rmi_f54.c                       |  43 +-
 drivers/input/rmi4/rmi_f55.c                       |   4 +-
 drivers/input/touchscreen/hynitron_cstxxx.c        |  13 +-
 drivers/input/touchscreen/sur40.c                  |  23 +-
 drivers/mmc/host/atmel-mci.c                       |   2 +
 drivers/mmc/host/omap_hsmmc.c                      |   2 +-
 drivers/mmc/host/sdhci.c                           |  16 +
 drivers/mmc/host/sdhci.h                           |   2 +-
 drivers/net/can/rcar/rcar_canfd.c                  |  28 +-
 drivers/net/ethernet/intel/ice/ice_base.c          |  58 ++-
 drivers/net/ethernet/intel/ice/ice_base.h          |   3 +-
 drivers/net/ethernet/intel/ice/ice_lib.c           |  56 ---
 drivers/net/ethernet/intel/ice/ice_lib.h           |   4 -
 drivers/net/ethernet/intel/ice/ice_switch.c        |  63 +--
 drivers/net/ethernet/intel/ice/ice_vf_lib.c        |  27 +
 .../net/ethernet/intel/ice/ice_vf_lib_private.h    |   1 +
 drivers/net/ethernet/intel/ice/ice_virtchnl.c      |  21 +
 drivers/net/ethernet/intel/ice/ice_xsk.c           |   2 +-
 drivers/net/ethernet/intel/igc/igc_main.c          |   1 -
 drivers/net/ethernet/microsoft/mana/mana_en.c      |   4 +-
 drivers/net/ethernet/ti/am65-cpsw-nuss.c           |   2 +
 drivers/net/ipvlan/ipvlan_main.c                   |   4 +
 drivers/net/macvlan.c                              |   4 +
 drivers/net/veth.c                                 |   4 +-
 drivers/net/vrf.c                                  |  49 +-
 drivers/net/vxlan/vxlan_core.c                     |  45 +-
 drivers/net/vxlan/vxlan_mdb.c                      |   4 +-
 drivers/s390/cio/vfio_ccw_async.c                  |  16 +
 drivers/s390/cio/vfio_ccw_chp.c                    |  17 +-
 drivers/s390/cio/vfio_ccw_cp.c                     |  53 +-
 drivers/s390/cio/vfio_ccw_cp.h                     |   8 +
 drivers/s390/cio/vfio_ccw_drv.c                    |  15 +-
 drivers/s390/cio/vfio_ccw_fsm.c                    |   8 +-
 drivers/s390/cio/vfio_ccw_ops.c                    |  35 +-
 drivers/s390/cio/vfio_ccw_private.h                |   6 +-
 drivers/s390/net/qeth_core_main.c                  |   3 +
 drivers/s390/net/qeth_l3_main.c                    |   5 +
 drivers/video/fbdev/core/fb_io_fops.c              |   8 +
 fs/binfmt_elf.c                                    |   4 +-
 fs/binfmt_elf_fdpic.c                              |   4 +-
 fs/binfmt_misc.c                                   |  14 +-
 fs/btrfs/block-group.c                             |  61 ++-
 fs/btrfs/block-group.h                             |   3 +-
 fs/btrfs/extent-tree.c                             |   6 +-
 fs/btrfs/messages.h                                |   7 +
 fs/btrfs/space-info.c                              |   2 +-
 fs/btrfs/transaction.c                             |   5 +-
 fs/btrfs/zoned.c                                   |   5 +-
 fs/btrfs/zoned.h                                   |   6 +-
 fs/ceph/addr.c                                     |  54 +-
 fs/ceph/caps.c                                     |  17 +-
 fs/ceph/file.c                                     |   9 +-
 fs/ceph/mds_client.c                               |  11 +
 fs/ceph/mds_client.h                               |   2 +
 fs/ceph/mdsmap.c                                   |   2 +-
 fs/erofs/Kconfig                                   |   3 +-
 fs/exec.c                                          |   6 +-
 fs/f2fs/data.c                                     |   2 +-
 fs/iomap/buffered-io.c                             |  42 +-
 fs/smb/client/cifsglob.h                           |  27 -
 fs/smb/client/cifssmb.c                            |   6 +-
 fs/smb/client/connect.c                            |   2 +-
 fs/smb/client/transport.c                          |   8 +-
 fs/smb/common/cifsglob.h                           |  36 ++
 fs/smb/server/auth.c                               |   4 +-
 fs/smb/server/connection.c                         |  23 +-
 fs/smb/server/connection.h                         |   5 +
 fs/smb/server/oplock.c                             |   8 +-
 fs/smb/server/smb2misc.c                           |   2 +-
 fs/smb/server/smb2ops.c                            |  32 +-
 fs/smb/server/smb2pdu.c                            |  88 ++--
 fs/smb/server/smb2pdu.h                            |   9 -
 fs/smb/server/smb_common.c                         |  43 +-
 fs/smb/server/smb_common.h                         |  43 +-
 fs/super.c                                         |  22 +-
 fs/userfaultfd.c                                   |  20 +-
 fs/xfs/libxfs/xfs_sb.c                             |   4 +-
 fs/xfs/scrub/alloc.c                               |   5 +-
 fs/xfs/xfs_dquot.c                                 |   3 +-
 fs/xfs/xfs_dquot_item_recover.c                    |   2 +-
 include/asm-generic/pgtable_uffd.h                 |  17 +
 include/linux/fs.h                                 |  12 +
 include/linux/mm_inline.h                          |   7 +-
 include/linux/mmap_lock.h                          |   4 +
 include/linux/netdevice.h                          |  52 +-
 include/linux/overflow.h                           |  52 ++
 include/linux/pagewalk.h                           |   7 +-
 include/linux/userfaultfd_k.h                      |  19 +-
 include/net/bluetooth/hci.h                        |   8 +-
 include/net/bluetooth/hci_core.h                   |   1 +
 include/net/dropreason-core.h                      |  21 +
 include/net/gro.h                                  |   1 +
 include/net/ip_vs.h                                |   7 +
 include/net/pkt_cls.h                              |  16 +
 include/net/pkt_sched.h                            |   3 +-
 include/net/sch_generic.h                          |   2 -
 include/net/tcp.h                                  |  58 +--
 include/uapi/linux/ip_vs.h                         |   6 -
 kernel/dma/Kconfig                                 |   9 +
 kernel/dma/direct.c                                |  12 +-
 kernel/fork.c                                      |  12 +-
 kernel/trace/ftrace.c                              |   9 +-
 lib/overflow_kunit.c                               |  19 +
 mm/huge_memory.c                                   |  49 +-
 mm/internal.h                                      |   7 +
 mm/migrate_device.c                                |   5 +-
 mm/pagewalk.c                                      |  82 ++-
 mm/ptdump.c                                        |  10 +-
 mm/userfaultfd.c                                   |  26 +
 mm/vmalloc.c                                       |  49 +-
 net/bluetooth/eir.c                                |   7 +-
 net/bluetooth/eir.h                                |   2 +-
 net/bluetooth/hci_core.c                           |   9 +
 net/bluetooth/hci_event.c                          |   3 +-
 net/bluetooth/hci_sync.c                           | 237 +++++----
 net/ceph/cls_lock_client.c                         |  21 +-
 net/ceph/decode.c                                  |  18 +-
 net/ceph/osdmap.c                                  |   9 +-
 net/core/dev.c                                     |  29 +-
 net/core/gro.c                                     |  31 ++
 net/core/pktgen.c                                  |  43 +-
 net/ipv4/bpf_tcp_ca.c                              |   2 +-
 net/ipv4/tcp_dctcp.h                               |   2 +-
 net/ipv4/tcp_input.c                               |  56 ++-
 net/ipv4/tcp_minisocks.c                           |  12 +-
 net/ipv4/tcp_output.c                              |   6 +-
 net/ipv4/udp_offload.c                             |  29 --
 net/mptcp/fastopen.c                               |   7 +-
 net/mptcp/options.c                                |  67 ++-
 net/mptcp/protocol.h                               |   1 +
 net/netfilter/ipset/ip_set_bitmap_gen.h            |   2 +-
 net/netfilter/ipset/ip_set_core.c                  |  19 +-
 net/netfilter/ipset/ip_set_list_set.c              |  10 +-
 net/netfilter/ipvs/ip_vs_conn.c                    |   4 +-
 net/netfilter/ipvs/ip_vs_core.c                    |   6 +-
 net/netfilter/ipvs/ip_vs_ctl.c                     |   4 +-
 net/netfilter/ipvs/ip_vs_dh.c                      |   4 +-
 net/netfilter/ipvs/ip_vs_lblc.c                    |   2 +-
 net/netfilter/ipvs/ip_vs_lblcr.c                   |   8 +-
 net/netfilter/nf_flow_table_core.c                 |   7 +-
 net/netfilter/nf_tables_offload.c                  |   2 +-
 net/packet/af_packet.c                             |  27 +-
 net/sched/act_api.c                                |  13 +-
 net/sched/cls_api.c                                |  32 +-
 net/sched/cls_bpf.c                                |  18 +-
 net/sched/cls_u32.c                                |   3 +
 net/sched/sch_api.c                                |  24 +-
 net/tls/tls_sw.c                                   |   7 +
 net/x25/af_x25.c                                   |   4 +-
 net/x25/x25_timer.c                                |  25 +-
 security/selinux/ss/policydb.c                     |  31 ++
 security/selinux/ss/services.c                     |  28 +-
 sound/soc/codecs/cs35l41-lib.c                     |   2 +-
 sound/soc/codecs/cs35l45-tables.c                  |  32 +-
 sound/soc/codecs/cs4265.c                          |   4 +-
 sound/soc/codecs/lpass-wsa-macro.c                 |   8 +-
 sound/soc/codecs/tas2562.c                         |   9 +-
 sound/soc/fsl/fsl_sai.c                            |  29 +-
 sound/soc/sof/sof-audio.c                          |   9 +-
 sound/soc/xilinx/xlnx_formatter_pcm.c              |  10 +-
 tools/testing/selftests/net/mptcp/mptcp_join.sh    |   4 +-
 tools/testing/selftests/net/tls.c                  | 549 +++++++++++++++++++++
 200 files changed, 2659 insertions(+), 1145 deletions(-)

Re: [PATCH 6.6 000/166] 6.6.153-rc1 review

[Pavel Machek]

[-- Attachment #1: Type: text/plain, Size: 394 bytes --]

Hi!

> This is the start of the stable review cycle for the 6.6.153 release.
> There are 166 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.

https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/pipelines/2776656726

I assume this is same problem as 5.15.

Best regards,
								Pavel

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

Re: [PATCH 6.6 000/166] 6.6.153-rc1 review

[Brett A C Sheffield]

# Librecast Test Results

020/020 [ OK ] liblcrq
010/010 [ OK ] libmld
120/120 [ OK ] liblibrecast

CPU/kernel: Linux auntie 6.6.153-rc1-g0ce9d61969cf #1 SMP PREEMPT_DYNAMIC Thu Aug 20 20:00:23 -00 2026 x86_64 AMD Ryzen 9 9950X 16-Core Processor AuthenticAMD GNU/Linux

Tested-by: Brett A C Sheffield <bacs@librecast.net>

Re: [PATCH 6.6 000/166] 6.6.153-rc1 review

[Florian Fainelli]

On 8/20/26 07:54, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.6.153 release.
> There are 166 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
> 
> Responses should be made by Sat, 22 Aug 2026 14:51:11 +0000.
> Anything received after that time might be too late.
> 
> The whole patch series can be found in one patch at:
> 	https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.153-rc1.gz
> or in the git tree and branch at:
> 	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y
> and the diffstat can be found below.
> 
> thanks,
> 
> greg k-h

On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels, build tested on 
BMIPS_GENERIC:

Tested-by: Florian Fainelli <florian.fainelli@broadcom.com>
-- 
Florian

Re: [PATCH 6.6 000/166] 6.6.153-rc1 review

[Ron Economos]

On 8/20/26 07:54, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.6.153 release.
> There are 166 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sat, 22 Aug 2026 14:51:11 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> 	https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.153-rc1.gz
> or in the git tree and branch at:
> 	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
>
The build fails with:

drivers/net/ethernet/intel/ice/ice_switch.c: In function 'ice_aq_alloc_free_vsi_list':
drivers/net/ethernet/intel/ice/ice_switch.c:1816:23: error: implicit declaration of function '__struct_size'; did you mean 
'struct_size'? [-Wimplicit-function-declaration]
  1816 |         u16 buf_len = __struct_size(sw_buf);
       |                       ^~~~~~~~~~~~~
       |                       struct_size

This can be fixed by reverting commits:

"overflow: Change DEFINE_FLEX to take __counted_by member" a5c50a3af39c74eef1a15c39924b0e1f4c6a43a6

"ice: make use of DEFINE_FLEX() in ice_switch.c" 858a287aeaf8a690fd3c769e0ee2247f40e44b62

Unfortunately, the Bluetooth commits have to be reverted also (because they depend on "overflow: Change DEFINE_FLEX to take 
__counted_by member").

"Bluetooth: hci_sync: Fix advertising data UAFs" 50d4431fab38c15c9ef405b6c7e13c0491f29928

"Bluetooth: eir: Fix possible crashes on eir_create_adv_data" c4fedbbb5b925228321a359b8a3949b207cc0a62

"Bluetooth: hci_core: Fix not handling hdev->le_num_of_adv_sets=1" cf931b0c0a6a5b8b70da339101c0df17cc068488

"Bluetooth: hci_conn, hci_sync: Use __counted_by() to avoid -Wfamnae warnings" 88dd9093e398c68467d8e9c8b7fb630aab05be05

Re: [PATCH 6.6 000/166] 6.6.153-rc1 review

[Jon Hunter]

On 20/08/2026 19:30, Pavel Machek wrote:
> Hi!
> 
>> This is the start of the stable review cycle for the 6.6.153 release.
>> There are 166 patches in this series, all will be posted as a response
>> to this one.  If anyone has any issues with these being applied, please
>> let me know.
> 
> https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/pipelines/2776656726
> 
> I assume this is same problem as 5.15.
I see the same issue for v6.6 too.

Jon

-- 
nvpublic

Re: [PATCH 6.6 000/166] 6.6.153-rc1 review

[Miguel Ojeda]

On Thu, 20 Aug 2026 16:54:19 +0200 Greg Kroah-Hartman <gregkh@linuxfoundation.org> wrote:
>
> This is the start of the stable review cycle for the 6.6.153 release.
> There are 166 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sat, 22 Aug 2026 14:51:11 +0000.
> Anything received after that time might be too late.

Boot-tested under QEMU for Rust x86_64:

Tested-by: Miguel Ojeda <ojeda@kernel.org>

I don't see in my config the build issue reported by others.

Thanks!

Cheers,
Miguel

Re: [PATCH 6.6 000/166] 6.6.153-rc1 review

[Peter Schneider]

Am 20.08.2026 um 16:54 schrieb Greg Kroah-Hartman:
> This is the start of the stable review cycle for the 6.6.153 release.
> There are 166 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.

Builds, boots and works on my 2-socket Ivy Bridge Xeon E5-2697 v2 server. No dmesg oddities or regressions found.

Tested-by: Peter Schneider <pschneider1968@googlemail.com>


Beste Grüße,
Peter Schneider

-- 
Climb the mountain not to plant your flag, but to embrace the challenge,
enjoy the air and behold the view. Climb it so you can see the world,
not so the world can see you.                    -- David McCullough Jr.

OpenPGP:  0xA3828BD796CCE11A8CADE8866E3A92C92C3FF244
Download: https://www.peters-netzplatz.de/download/pschneider1968_pub.asc
https://keys.mailvelope.com/pks/lookup?op=get&search=pschneider1968@googlemail.com
https://keys.mailvelope.com/pks/lookup?op=get&search=pschneider1968@gmail.com

Re: [PATCH 6.6 000/166] 6.6.153-rc1 review

[Francesco Dolcini]

On Thu, Aug 20, 2026 at 04:54:19PM +0200, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.6.153 release.
> There are 166 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.

Tested-by: Francesco Dolcini <francesco.dolcini@toradex.com>

Re: [PATCH 6.6 000/166] 6.6.153-rc1 review

[Barry K. Nathan]

On 8/20/26 7:54 AM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.6.153 release.
> There are 166 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
> 
> Responses should be made by Sat, 22 Aug 2026 14:51:11 +0000.
> Anything received after that time might be too late.
> 
> The whole patch series can be found in one patch at:
> 	https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.153-rc1.gz
> or in the git tree and branch at:
> 	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y
> and the diffstat can be found below.
> 
> thanks,
> 
> greg k-h

Tested on an amd64 laptop (Lenovo ThinkPad T14 Gen 1). Working well,
no regressions observed.

Tested-by: Barry K. Nathan <barryn@pobox.com>

-- 
-Barry K. Nathan  <barryn@pobox.com>

Re: [PATCH 6.6 000/166] 6.6.153-rc1 review

[Greg Kroah-Hartman]

On Thu, Aug 20, 2026 at 10:34:59PM -0700, Ron Economos wrote:
> On 8/20/26 07:54, Greg Kroah-Hartman wrote:
> > This is the start of the stable review cycle for the 6.6.153 release.
> > There are 166 patches in this series, all will be posted as a response
> > to this one.  If anyone has any issues with these being applied, please
> > let me know.
> > 
> > Responses should be made by Sat, 22 Aug 2026 14:51:11 +0000.
> > Anything received after that time might be too late.
> > 
> > The whole patch series can be found in one patch at:
> > 	https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.153-rc1.gz
> > or in the git tree and branch at:
> > 	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y
> > and the diffstat can be found below.
> > 
> > thanks,
> > 
> > greg k-h
> > 
> > 
> The build fails with:
> 
> drivers/net/ethernet/intel/ice/ice_switch.c: In function 'ice_aq_alloc_free_vsi_list':
> drivers/net/ethernet/intel/ice/ice_switch.c:1816:23: error: implicit
> declaration of function '__struct_size'; did you mean 'struct_size'?
> [-Wimplicit-function-declaration]
>  1816 |         u16 buf_len = __struct_size(sw_buf);
>       |                       ^~~~~~~~~~~~~
>       |                       struct_size
> 
> This can be fixed by reverting commits:
> 
> "overflow: Change DEFINE_FLEX to take __counted_by member" a5c50a3af39c74eef1a15c39924b0e1f4c6a43a6
> 
> "ice: make use of DEFINE_FLEX() in ice_switch.c" 858a287aeaf8a690fd3c769e0ee2247f40e44b62
> 
> Unfortunately, the Bluetooth commits have to be reverted also (because they
> depend on "overflow: Change DEFINE_FLEX to take __counted_by member").
> 
> "Bluetooth: hci_sync: Fix advertising data UAFs" 50d4431fab38c15c9ef405b6c7e13c0491f29928
> 
> "Bluetooth: eir: Fix possible crashes on eir_create_adv_data" c4fedbbb5b925228321a359b8a3949b207cc0a62
> 
> "Bluetooth: hci_core: Fix not handling hdev->le_num_of_adv_sets=1" cf931b0c0a6a5b8b70da339101c0df17cc068488
> 
> "Bluetooth: hci_conn, hci_sync: Use __counted_by() to avoid -Wfamnae warnings" 88dd9093e398c68467d8e9c8b7fb630aab05be05
> 
> 

This is odd, because this builds here for me just fine.  Let me dig...

Re: [PATCH 6.6 000/166] 6.6.153-rc1 review

[Ron Economos]

On 8/21/26 06:59, Greg Kroah-Hartman wrote:
> On Thu, Aug 20, 2026 at 10:34:59PM -0700, Ron Economos wrote:
>> On 8/20/26 07:54, Greg Kroah-Hartman wrote:
>>> This is the start of the stable review cycle for the 6.6.153 release.
>>> There are 166 patches in this series, all will be posted as a response
>>> to this one.  If anyone has any issues with these being applied, please
>>> let me know.
>>>
>>> Responses should be made by Sat, 22 Aug 2026 14:51:11 +0000.
>>> Anything received after that time might be too late.
>>>
>>> The whole patch series can be found in one patch at:
>>> 	https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.153-rc1.gz
>>> or in the git tree and branch at:
>>> 	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y
>>> and the diffstat can be found below.
>>>
>>> thanks,
>>>
>>> greg k-h
>>>
>>>
>> The build fails with:
>>
>> drivers/net/ethernet/intel/ice/ice_switch.c: In function 'ice_aq_alloc_free_vsi_list':
>> drivers/net/ethernet/intel/ice/ice_switch.c:1816:23: error: implicit
>> declaration of function '__struct_size'; did you mean 'struct_size'?
>> [-Wimplicit-function-declaration]
>>   1816 |         u16 buf_len = __struct_size(sw_buf);
>>        |                       ^~~~~~~~~~~~~
>>        |                       struct_size
>>
>> This can be fixed by reverting commits:
>>
>> "overflow: Change DEFINE_FLEX to take __counted_by member" a5c50a3af39c74eef1a15c39924b0e1f4c6a43a6
>>
>> "ice: make use of DEFINE_FLEX() in ice_switch.c" 858a287aeaf8a690fd3c769e0ee2247f40e44b62
>>
>> Unfortunately, the Bluetooth commits have to be reverted also (because they
>> depend on "overflow: Change DEFINE_FLEX to take __counted_by member").
>>
>> "Bluetooth: hci_sync: Fix advertising data UAFs" 50d4431fab38c15c9ef405b6c7e13c0491f29928
>>
>> "Bluetooth: eir: Fix possible crashes on eir_create_adv_data" c4fedbbb5b925228321a359b8a3949b207cc0a62
>>
>> "Bluetooth: hci_core: Fix not handling hdev->le_num_of_adv_sets=1" cf931b0c0a6a5b8b70da339101c0df17cc068488
>>
>> "Bluetooth: hci_conn, hci_sync: Use __counted_by() to avoid -Wfamnae warnings" 88dd9093e398c68467d8e9c8b7fb630aab05be05
>>
>>
> This is odd, because this builds here for me just fine.  Let me dig...

You have to have CONFIG_ICE enabled. I have a fixup patch that avoids all these reverts. I'll send it if we agree there's an issue.

Re: [PATCH 6.6 000/166] 6.6.153-rc1 review

[Greg Kroah-Hartman]

On Thu, Aug 20, 2026 at 10:34:59PM -0700, Ron Economos wrote:
> On 8/20/26 07:54, Greg Kroah-Hartman wrote:
> > This is the start of the stable review cycle for the 6.6.153 release.
> > There are 166 patches in this series, all will be posted as a response
> > to this one.  If anyone has any issues with these being applied, please
> > let me know.
> > 
> > Responses should be made by Sat, 22 Aug 2026 14:51:11 +0000.
> > Anything received after that time might be too late.
> > 
> > The whole patch series can be found in one patch at:
> > 	https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.153-rc1.gz
> > or in the git tree and branch at:
> > 	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y
> > and the diffstat can be found below.
> > 
> > thanks,
> > 
> > greg k-h
> > 
> > 
> The build fails with:
> 
> drivers/net/ethernet/intel/ice/ice_switch.c: In function 'ice_aq_alloc_free_vsi_list':
> drivers/net/ethernet/intel/ice/ice_switch.c:1816:23: error: implicit
> declaration of function '__struct_size'; did you mean 'struct_size'?
> [-Wimplicit-function-declaration]
>  1816 |         u16 buf_len = __struct_size(sw_buf);
>       |                       ^~~~~~~~~~~~~
>       |                       struct_size
> 
> This can be fixed by reverting commits:
> 
> "overflow: Change DEFINE_FLEX to take __counted_by member" a5c50a3af39c74eef1a15c39924b0e1f4c6a43a6
> 
> "ice: make use of DEFINE_FLEX() in ice_switch.c" 858a287aeaf8a690fd3c769e0ee2247f40e44b62
> 
> Unfortunately, the Bluetooth commits have to be reverted also (because they
> depend on "overflow: Change DEFINE_FLEX to take __counted_by member").
> 
> "Bluetooth: hci_sync: Fix advertising data UAFs" 50d4431fab38c15c9ef405b6c7e13c0491f29928
> 
> "Bluetooth: eir: Fix possible crashes on eir_create_adv_data" c4fedbbb5b925228321a359b8a3949b207cc0a62
> 
> "Bluetooth: hci_core: Fix not handling hdev->le_num_of_adv_sets=1" cf931b0c0a6a5b8b70da339101c0df17cc068488
> 
> "Bluetooth: hci_conn, hci_sync: Use __counted_by() to avoid -Wfamnae warnings" 88dd9093e398c68467d8e9c8b7fb630aab05be05

Ok, this is a mess, I'll go drop all of these now and push out a -rc2.

Thanks for testing and letting me know.

greg k-h

Re: [PATCH 6.6 000/166] 6.6.153-rc1 review

[Shuah Khan]

On 8/20/26 08:54, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.6.153 release.
> There are 166 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
> 
> Responses should be made by Sat, 22 Aug 2026 14:51:11 +0000.
> Anything received after that time might be too late.
> 
> The whole patch series can be found in one patch at:
> 	https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.153-rc1.gz
> or in the git tree and branch at:
> 	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y
> and the diffstat can be found below.
> 
> thanks,
> 
> greg k-h
> 

Compiled and booted on my test system. No dmesg regressions.

Tested-by: Shuah Khan <skhan@linuxfoundation.org>

thanks,
-- Shuah

Re: [PATCH 6.6 000/166] 6.6.153-rc1 review

[Wentao Guan]

Hi,

Same build error:
  CC      drivers/net/ethernet/stmicro/stmmac/stmmac_tc.o
drivers/net/ethernet/intel/ice/ice_switch.c: In function ‘ice_aq_alloc_free_vsi_list’:
drivers/net/ethernet/intel/ice/ice_switch.c:1816:23: error: implicit declaration of function ‘__struct_size’; did you mean ‘struct_size’? [-Werror=implicit-function-declaration]
 1816 |         u16 buf_len = __struct_size(sw_buf);
      |                       ^~~~~~~~~~~~~
      |                       struct_size
  CC [M]  drivers/net/ethernet/intel/ice/ice_vf_vsi_vlan_ops.o

As Ron Economos wrote:
> This can be fixed by reverting commits:
>
> "overflow: Change DEFINE_FLEX to take __counted_by member" a5c50a3af39c74eef1a15c39924b0e1f4c6a43a6
>
> "ice: make use of DEFINE_FLEX() in ice_switch.c" 858a287aeaf8a690fd3c769e0ee2247f40e44b62
>
> Unfortunately, the Bluetooth commits have to be reverted also (because they
> depend on "overflow: Change DEFINE_FLEX to take __counted_by member").
>
> "Bluetooth: hci_sync: Fix advertising data UAFs" 50d4431fab38c15c9ef405b6c7e13c0491f29928
>
> "Bluetooth: eir: Fix possible crashes on eir_create_adv_data" c4fedbbb5b925228321a359b8a3949b207cc0a62
>
> "Bluetooth: hci_core: Fix not handling hdev->le_num_of_adv_sets=1" cf931b0c0a6a5b8b70da339101c0df17cc068488
>
> "Bluetooth: hci_conn, hci_sync: Use __counted_by() to avoid -Wfamnae warnings" 88dd9093e398c68467d8e9c8b7fb630aab05be05

After reverted,

Build tested in our x86,arm64,loongarch,riscv config successfully without error.

Tested-by: Wentao Guan <guanwentao@uniontech.com>

Best Regards
Wentao Guan

Log:
Linux version 6.6.153-rc1-arm64-desktop-hwe-g0ce9d61969cf-dirty (guanwentao@uos-PC) (aarch64-linux-gnu-gcc-12 (Deepin 12.3.0-17deepin8) 12.3.0, GNU ld (GNU Binutils for Deepin) 2.41) # SMP PREEMPT
Linux version 6.6.153-rc1-arm64-desktop-hwe-g0ce9d61969cf-dirty (guanwentao@uos-PC) (aarch64-linux-gnu-gcc-12 (Deepin 12.3.0-17deepin8) 12.3.0, GNU ld (GNU Binutils for Deepin) 2.41) #4 SMP PREEMPT Sat Aug 22 02:08:37 CST 2026
Linux version 6.6.153-rc1-loong64-desktop-hwe-g0ce9d61969cf-dirty (guanwentao@uos-PC) (loongarch64-linux-gnu-gcc-12 (Deepin 12.3.0-17deepin8) 12.3.0, GNU ld (GNU Binutils for Deepin) 2.41) # SMP PREEMPT
Linux version 6.6.153-rc1-loong64-desktop-hwe-g0ce9d61969cf-dirty (guanwentao@uos-PC) (loongarch64-linux-gnu-gcc-12 (Deepin 12.3.0-17deepin8) 12.3.0, GNU ld (GNU Binutils for Deepin) 2.41) #5 SMP PREEMPT Sat Aug 22 02:26:01 CST 2026
Linux version 6.6.153-rc1-riscv64-desktop-hwe+ (guanwentao@uos-PC) (riscv64-linux-gnu-gcc-12 (Deepin 12.3.0-17deepin8) 12.3.0, GNU ld (GNU Binutils for Deepin) 2.41) # SMP
Linux version 6.6.153-rc1-riscv64-desktop-hwe+ (guanwentao@uos-PC) (riscv64-linux-gnu-gcc-12 (Deepin 12.3.0-17deepin8) 12.3.0, GNU ld (GNU Binutils for Deepin) 2.41) #6 SMP Sat Aug 22 02:41:52 CST 2026
Linux version 6.6.153-rc1-amd64-desktop-hwe-g0ce9d61969cf-dirty (guanwentao@uos-PC) (gcc (Deepin 12.3.0-17deepin15) 12.3.0, GNU ld (GNU Binutils for Deepin) 2.41) # SMP PREEMPT_DYNAMIC
Linux version 6.6.153-rc1-amd64-desktop-hwe-g0ce9d61969cf-dirty (guanwentao@uos-PC) (gcc (Deepin 12.3.0-17deepin15) 12.3.0, GNU ld (GNU Binutils for Deepin) 2.41) #3 SMP PREEMPT_DYNAMIC Sat Aug 22 01:47:48 CST 2026