This bug was fixed in the package linux - 6.11.0-26.26
---------------
linux (6.11.0-26.26) oracular; urgency=medium
* oracular/linux: 6.11.0-26.26 -proposed tracker (LP: #2107166)
* Packaging resync (LP: #1786013)
- [Packaging] debian.master/dkms-versions -- update from kernel-versions
(main/2025.04.14)
* drm/xe: prevent potential UAF in pf_provision_vf_ggtt() (LP: #2106652)
- drm/xe: prevent potential UAF in pf_provision_vf_ggtt()
* Oracular update: upstream stable patchset 2025-04-09 (LP: #2106703)
- IB/mlx5: Set and get correct qp_num for a DCT QP
- RDMA/mana_ib: Allocate PAGE aligned doorbell index
- scsi: ufs: core: Fix ufshcd_is_ufs_dev_busy() and ufshcd_eh_timed_out()
- ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up
- SUNRPC: convert RPC_TASK_* constants to enum
- SUNRPC: Prevent looping due to rpc_signal_task() races
- SUNRPC: Handle -ETIMEDOUT return from tlshd
- RDMA/mlx5: Fix AH static rate parsing
- scsi: core: Clear driver private data when retrying request
- RDMA/mlx5: Fix bind QP error cleanup flow
- sunrpc: suppress warnings for unused procfs functions
- ALSA: usb-audio: Avoid dropping MIDI events at closing multiple ports
- Bluetooth: L2CAP: Fix L2CAP_ECRED_CONN_RSP response
- rxrpc: rxperf: Fix missing decoding of terminal magic cookie
- afs: Fix the server_list to unuse a displaced server rather than putting
it
- net: loopback: Avoid sending IP packets without an Ethernet header
- net: set the minimum for net_hotdata.netdev_budget_usecs
- ipv4: icmp: Pass full DS field to ip_route_input()
- ipv4: icmp: Unmask upper DSCP bits in icmp_route_lookup()
- ipvlan: Unmask upper DSCP bits in ipvlan_process_v4_outbound()
- ipv4: Convert icmp_route_lookup() to dscp_t.
- ipv4: Convert ip_route_input() to dscp_t.
- ipvlan: Prepare ipvlan_process_v4_outbound() to future .flowi4_tos
conversion.
- ipvlan: ensure network headers are in skb linear part
- net: cadence: macb: Synchronize stats calculations
- ASoC: es8328: fix route from DAC to output
- ipvs: Always clear ipvs_property flag in skb_scrub_packet()
- firmware: cs_dsp: Remove async regmap writes
- ALSA: hda/realtek: Fix wrong mic setup for ASUS VivoBook 15
- ice: add E830 HW VF mailbox message limit support
- ice: Fix deinitializing VF in error path
- tcp: Defer ts_recent changes until req is owned
- net: Clear old fragment checksum value in napi_reuse_skb
- net: mvpp2: cls: Fixed Non IP flow, with vlan tag flow defination.
- net/mlx5: IRQ, Fix null string in debug print
- net: ipv6: fix dst ref loop on input in seg6 lwt
- net: ipv6: fix dst ref loop on input in rpl lwt
- net: ti: icss-iep: Reject perout generation request
- perf/core: Order the PMU list to fix warning about unordered pmu_ctx_list
- uprobes: Reject the shared zeropage in uprobe_write_opcode()
- io_uring/net: save msg_control for compat
- x86/CPU: Fix warm boot hang regression on AMD SC1100 SoC systems
- phy: rockchip: naneng-combphy: compatible reset with old DT
- riscv: KVM: Fix hart suspend status check
- riscv: KVM: Fix SBI IPI error generation
- riscv: KVM: Fix SBI TIME error generation
- tracing: Fix bad hist from corrupting named_triggers list
- ftrace: Avoid potential division by zero in function_stat_show()
- ALSA: usb-audio: Re-add sample rate quirk for Pioneer DJM-900NXS2
- ALSA: hda/realtek: Fix microphone regression on ASUS N705UD
- perf/core: Add RCU read lock protection to perf_iterate_ctx()
- perf/x86: Fix low freqency setting issue
- perf/core: Fix low freq setting via IOC_PERIOD
- drm/amd/display: Disable PSR-SU on eDP panels
- drm/amd/display: Fix HPD after gpu reset
- i2c: npcm: disable interrupt enable bit before devm_request_irq
- i2c: ls2x: Fix frequency division register access
- usbnet: gl620a: fix endpoint checking in genelink_bind()
- net: enetc: fix the off-by-one issue in enetc_map_tx_buffs()
- net: enetc: keep track of correct Tx BD count in enetc_map_tx_tso_buffs()
- net: enetc: update UDP checksum when updating originTimestamp field
- net: enetc: correct the xdp_tx statistics
- net: enetc: fix the off-by-one issue in enetc_map_tx_tso_buffs()
- phy: tegra: xusb: reset VBUS & ID OVERRIDE
- phy: exynos5-usbdrd: fix MPLL_MULTIPLIER and SSC_REFCLKSEL masks in refclk
- mptcp: always handle address removal under msk socket lock
- mptcp: reset when MPTCP opts are dropped after join
- vmlinux.lds: Ensure that const vars with relocations are mapped R/O
- rcuref: Plug slowpath race in rcuref_put()
- sched/core: Prevent rescheduling when interrupts are disabled
- scsi: ufs: core: bsg: Fix crash when arpmb command fails
- rseq/selftests: Fix riscv rseq_offset_deref_addv inline asm
- riscv/futex: sign extend compare value in atomic cmpxchg
- riscv: signal: fix signal frame size
- Revert "rtla/timerlat_top: Set OSNOISE_WORKLOAD for kernel threads"
- Revert "rtla/timerlat_hist: Set OSNOISE_WORKLOAD for kernel threads"
- amdgpu/pm/legacy: fix suspend/resume issues
- x86/microcode/AMD: Use the family,model,stepping encoded in the patch ID
- x86/microcode/AMD: Pay attention to the stepping dynamically
- x86/microcode/AMD: Split load_microcode_amd()
- x86/microcode/intel: Remove unnecessary cache writeback and invalidation
- x86/microcode/AMD: Flush patch buffer mapping after application
- x86/microcode/AMD: Return bool from find_blobs_in_containers()
- x86/microcode/AMD: Make __verify_patch_size() return bool
- x86/microcode/AMD: Have __apply_microcode_amd() return bool
- x86/microcode/AMD: Merge early_apply_microcode() into its single callsite
- x86/microcode/AMD: Get rid of the _load_microcode_amd() forward
declaration
- x86/microcode/AMD: Add get_patch_level()
- x86/microcode/AMD: Load only SHA256-checksummed patches
- x86/microcode/AMD: Fix a -Wsometimes-uninitialized clang false positive
- RDMA/mlx5: Fix the recovery flow of the UMR QP
- RDMA/mlx5: Fix a race for DMABUF MR which can lead to CQE with error
- RDMA/mlx5: Fix a WARN during dereg_mr for DM type
- RDMA/hns: Fix mbox timing out by adding retry mechanism
- RDMA/bnxt_re: Fail probe early when not enough MSI-x vectors are reserved
- RDMA/bnxt_re: Refactor NQ allocation
- landlock: Fix non-TCP sockets restriction
- NFS: O_DIRECT writes must check and adjust the file length
- NFS: Adjust delegated timestamps for O_DIRECT reads and writes
- NFSv4: Fix a deadlock when recovering state on a sillyrenamed file
- scsi: ufs: core: Set default runtime/system PM levels before
ufshcd_hba_init()
- RDMA/bnxt_re: Fix the page details for the srq created by kernel consumers
- afs: Give an afs_server object a ref on the afs_cell object it points to
- ASoC: fsl: Rename stream name of SAI DAI driver
- drm/xe/oa: Signal output fences
- drm/xe/oa: Move functions up so they can be reused for config ioctl
- drm/xe/oa: Add syncs support to OA config ioctl
- drm/xe/oa: Allow only certain property changes from config
- drm/xe/oa: Allow oa_exponent value of 0
- ASoC: cs35l56: Prevent races when soft-resetting using SPI control
- net: ethernet: ti: am65-cpsw: select PAGE_POOL
- ice: Avoid setting default Rx VSI twice in switchdev setup
- selftests: drv-net: Check if combined-count exists
- idpf: fix checksums set in idpf_rx_rsc()
- thermal: gov_power_allocator: Fix incorrect calculation in
divvy_up_power()
- unreachable: Unify
- objtool: Remove annotate_{,un}reachable()
- objtool: Fix C jump table annotations for Clang
- phy: rockchip: fix Kconfig dependency more
- riscv: KVM: Fix hart suspend_type use
- KVM: arm64: Ensure a VMID is allocated before programming VTTBR_EL2
- drm/xe/regs: remove a duplicate definition for RING_CTL_SIZE(size)
- drm/xe/userptr: restore invalidation list on error
- drm/amdkfd: Preserve cp_hqd_pq_control on update_mqd
- drm/amdgpu: disable BAR resize on Dell G5 SE
- drm/amdgpu: init return value in amdgpu_ttm_clear_buffer
- drm/amd/display: add a quirk to enable eDP0 on DP1
- arm64/mm: Fix Boot panic on Ampere Altra
- block: Remove zone write plugs when handling native zone append writes
- net: phy: qcom: qca807x fix condition for DAC_DSP_BIAS_CURRENT
- phy: exynos5-usbdrd: gs101: ensure power is gated to SS phy in phy_exit()
- iommu/vt-d: Fix suspicious RCU usage
- intel_idle: Handle older CPUs, which stop the TSC in deeper C states,
correctly
- selftests/landlock: Test that MPTCP actions are not restricted
- selftests/landlock: Test TCP accesses with protocol=IPPROTO_TCP
- dm-integrity: Avoid divide by zero in table status in Inline mode
- dm vdo: add missing spin_lock_init
- ima: Reset IMA_NONACTION_RULE_FLAGS after post_setattr
- riscv: cacheinfo: Use of_property_present() for non-boolean properties
- riscv: signal: fix signal_minsigstksz
- riscv: cpufeature: use bitmap_equal() instead of memcmp()
- efi: Don't map the entire mokvar table to determine its size
- x86/microcode/AMD: Remove ugly linebreak in __verify_patch_section()
signature
- x86/microcode/AMD: Remove unused save_microcode_in_initrd_amd()
declarations
- Upstream stable to v6.6.81, v6.12.18
* Oracular update: upstream stable patchset 2025-04-08 (LP: #2106494)
- arm64: mte: Do not allow PROT_MTE on MAP_HUGETLB user mappings
- xfs: assert a valid limit in xfs_rtfind_forw
- xfs: validate inumber in xfs_iget
- xfs: fix a sloppy memory handling bug in xfs_iroot_realloc
- xfs: fix a typo
- xfs: skip background cowblock trims on inodes open for write
- xfs: don't free cowblocks from under dirty pagecache on unshare
- xfs: merge xfs_attr_leaf_try_add into xfs_attr_leaf_addname
- xfs: return bool from xfs_attr3_leaf_add
- xfs: distinguish extra split from real ENOSPC from xfs_attr3_leaf_split
- xfs: distinguish extra split from real ENOSPC from
xfs_attr_node_try_addname
- xfs: fold xfs_bmap_alloc_userdata into xfs_bmapi_allocate
- xfs: don't ifdef around the exact minlen allocations
- xfs: call xfs_bmap_exact_minlen_extent_alloc from xfs_bmap_btalloc
- xfs: support lowmode allocations in xfs_bmap_exact_minlen_extent_alloc
- xfs: Use try_cmpxchg() in xlog_cil_insert_pcp_aggregate()
- xfs: Remove empty declartion in header file
- xfs: pass the exact range to initialize to xfs_initialize_perag
- xfs: update the file system geometry after recoverying superblock buffers
- xfs: error out when a superblock buffer update reduces the agcount
- xfs: don't use __GFP_RETRY_MAYFAIL in xfs_initialize_perag
- xfs: update the pag for the last AG at recovery time
- xfs: Reduce unnecessary searches when searching for the best extents
- xfs: streamline xfs_filestream_pick_ag
- xfs: Check for delayed allocations before setting extsize
- md/md-bitmap: replace md_bitmap_status() with a new helper
md_bitmap_get_stats()
- md/md-cluster: fix spares warnings for __le64
- md/md-bitmap: add 'sync_size' into struct md_bitmap_stats
- md/md-bitmap: Synchronize bitmap_get_stats() with bitmap lifetime
- Input: serio - define serio_pause_rx guard to pause and resume serio ports
- Input: synaptics - fix crash when enabling pass-through port
- ASoC: renesas: rz-ssi: Add a check for negative sample_space
- USB: gadget: f_midi: f_midi_complete to call queue_work
- ASoC: rockchip: i2s-tdm: fix shift config for SND_SOC_DAIFMT_DSP_[AB]
- powerpc/64s/mm: Move __real_pte stubs into hash-4k.h
- powerpc/64s: Rewrite __real_pte() and __rpte_to_hidx() as static inline
- ALSA: hda/realtek: Fixup ALC225 depop procedure
- powerpc/code-patching: Fix KASAN hit by not flagging text patching area as
VM_ALLOC
- geneve: Fix use-after-free in geneve_find_dev().
- net/sched: cls_api: fix error handling causing NULL dereference
- ALSA: seq: Drop UMP events when no UMP-conversion is set
- s390/ism: add release function for struct device
- ibmvnic: Introduce send sub-crq direct
- ibmvnic: Add stat for tx direct vs tx batched
- ibmvnic: Don't reference skb after sending to VIOS
- sockmap, vsock: For connectible sockets allow only connected
- vsock/bpf: Warn on socket without transport
- tcp: adjust rcvq_space after updating scaling ratio
- gtp: Suppress list corruption splat in gtp_net_exit_batch_rtnl().
- geneve: Suppress list corruption splat in geneve_destroy_tunnels().
- flow_dissector: Fix handling of mixed port and port-range keys
- flow_dissector: Fix port range key handling in BPF conversion
- net: Add non-RCU dev_getbyhwaddr() helper
- arp: switch to dev_getbyhwaddr() in arp_req_set_public()
- net: axienet: Set mac_managed_pm
- tcp: drop secpath at the same time as we currently drop dst
- bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type()
- bpf: unify VM_WRITE vs VM_MAYWRITE use in BPF map mmaping logic
- bpf: avoid holding freeze_mutex during mmap operation
- strparser: Add read_sock callback
- bpf: Fix wrong copied_seq calculation
- bpf: Disable non stream socket for strparser
- bpf: Fix deadlock when freeing cgroup storage
- power: supply: da9150-fg: fix potential overflow
- nouveau/svm: fix missing folio unlock + put after
make_device_exclusive_range()
- drm/msm: Avoid rounding up to one jiffy
- nvme/ioctl: add missing space in err message
- bpf: skip non exist keys in generic_map_lookup_batch
- drm/nouveau/pmu: Fix gp10b firmware guard
- arm64: dts: mediatek: mt8183: Disable DSI display output by default
- drm/msm/dpu: Disable dither in phys encoder cleanup
- drm/i915: Make sure all planes in use by the joiner have their crtc
included
- drm/i915/dp: Fix error handling during 128b/132b link training
- io_uring: prevent opcode speculation
- tee: optee: Fix supplicant wait loop
- drop_monitor: fix incorrect initialization order
- soc: loongson: loongson2_guts: Add check for devm_kstrdup()
- lib/iov_iter: fix import_iovec_ubuf iovec management
- nfp: bpf: Add check for nfp_app_ctrl_msg_alloc()
- ASoC: SOF: stream-ipc: Check for cstream nullity in sof_ipc_msg_data()
- ASoC: fsl_micfil: Enable default case in micfil_set_quality()
- ALSA: hda: Add error check for snd_ctl_rename_id() in
snd_hda_create_dig_out_ctls()
- ALSA: hda/conexant: Add quirk for HP ProBook 450 G4 mute LED
- ASoC: SOF: pcm: Clear the susbstream pointer to NULL on close
- acct: perform last write from workqueue
- acct: block access to kernel internal filesystems
- mm,madvise,hugetlb: check for 0-length range after end address adjustment
- mtd: rawnand: cadence: fix error code in cadence_nand_init()
- mtd: rawnand: cadence: use dma_map_resource for sdma address
- mtd: rawnand: cadence: fix incorrect device in dma_unmap_single
- smb: client: Add check for next_buffer in receive_encrypted_standard()
- EDAC/qcom: Correct interrupt enable register configuration
- ftrace: Correct preemption accounting for function tracing.
- ftrace: Do not add duplicate entries in subops manager ops
- arm64: dts: rockchip: change eth phy mode to rgmii-id for orangepi r1 plus
lts
- nilfs2: handle errors that nilfs_prepare_chunk() may return
- drm/xe/oa: Separate batch submission from waiting for completion
- drm/xe/oa/uapi: Define and parse OA sync properties
- drm/xe/oa: Add input fence dependencies
- xe/oa: Fix query mode of operation for OAR/OAC
- KVM: x86: Get vcpu->arch.apic_base directly and drop kvm_get_apic_base()
- KVM: x86: Inline kvm_get_apic_mode() in lapic.h
- KVM: nVMX: Defer SVI update to vmcs01 on EOI when L2 is active w/o VID
- drm/amd/display: Refactoring if and endif statements to enable DC_LOGGER
- drm/amd/display: update dcn351 used clock offset
- drm/amd/display: Correct register address in dcn35
- Revert "UBUNTU: SAUCE: Bluetooth: qca: Support downloading board ID
specific
NVM for WCN6855"
- Bluetooth: qca: Update firmware-name to support board specific nvm
- Bluetooth: qca: Fix poor RF performance for WCN6855
- ASoC: renesas: rz-ssi: Terminate all the DMA transactions
- PCI: Make pcim_request_all_regions() a public function
- PCI: Export pci_intx_unmanaged() and pcim_intx()
- PCI: Remove devres from pci_intx()
- PCI: Restore original INTX_DISABLE bit by pcim_intx()
- accel/ivpu: Limit FW version string length
- accel/ivpu: Add coredump support
- accel/ivpu: Add FW state dump on TDR
- accel/ivpu: Fix error handling in recovery/reset
- drm/amdkfd: Move gfx12 trap handler to separate file
- drm/amdkfd: Ensure consistent barrier state saved in gfx12 trap handler
- tracing: Switch trace.c code over to use guard()
- tracing: Have the error of __tracing_resize_ring_buffer() passed to user
- ASoC: SOF: ipc4-topology: Harden loops for looking up ALH copiers
- powerpc/code-patching: Disable KASAN report during patching via temporary
mm
- ASoC: imx-audmix: remove cpu_mclk which is from cpu dai device
- vsock/virtio: fix variables initialization during resuming
- net: pse-pd: Avoid setting max_uA in regulator constraints
- net: pse-pd: Use power limit at driver side instead of current limit
- net: pse-pd: pd692x0: Fix power limit retrieval
- net: allow small head cache usage with large MAX_SKB_FRAGS values
- selftests/bpf: Add tests for raw_tp null handling
- net: Add rx_skb of kfree_skb to raw_tp_null_args[].
- bpf: Fix softlockup in arena_map_free on 64k page kernel
- arm64: dts: rockchip: adjust SMMU interrupt type on rk3588
- md/raid*: Fix the set_queue_limits implementations
- platform: cznic: CZNIC_PLATFORMS should depend on ARCH_MVEBU
- [Config] updateconfigs for CZNIC_PLATFORMS
- drm/msm/dpu: skip watchdog timer programming through TOP on >= SM8450
- drm/msm/dpu: Don't leak bits_per_component into random DSC_ENC fields
- drm/msm/dsi/phy: Protect PHY_CMN_CLK_CFG0 updated from driver side
- drm/msm/dsi/phy: Protect PHY_CMN_CLK_CFG1 against clock driver
- drm/msm/dsi/phy: Do not overwite PHY_CMN_CLK_CFG1 when choosing bitclk
source
- nvme: tcp: Fix compilation warning with W=1
- nvme-tcp: fix connect failure on receiving partial ICResp PDU
- drm: panel: jd9365da-h3: fix reset signal polarity
- drm/i915/ddi: Fix HDMI port width programming in DDI_BUF_CTL
- drm/i915/gt: Use spin_lock_irqsave() in interruptible context
- io_uring/rw: forbid multishot async reads
- gpiolib: protect gpio_chip with SRCU in array_info paths in multi get/set
- arm64: dts: rockchip: Fix broken tsadc pinctrl names for rk3588
- arm64: dts: rockchip: Move uart5 pin configuration to px30 ringneck SoM
- arm64: dts: rockchip: Disable DMA for uart5 on px30-ringneck
- s390/boot: Fix ESSA detection
- xfs: fix online repair probing when CONFIG_XFS_ONLINE_REPAIR=n
- smb: client: fix chmod(2) regression with ATTR_READONLY
- gve: set xdp redirect target only when it is available
- perf/x86/intel: Fix event constraints for LNC
- irqchip/gic-v3: Fix rk3399 workaround when secure interrupts are enabled
- ftrace: Fix accounting of adding subops to a manager ops
- tracing: Fix using ret variable in tracing_set_tracer()
- net: pse-pd: Fix deadlock in current limit functions
- selftests/mm: build with -O2
- drm/amdgpu: bump version for RV/PCO compute fix
- Upstream stable to v6.6.80, v6.12.17
* WARNING: CPU: 18 PID: 3683 at arch/powerpc/kvm/../../../virt/kvm/vfio.c Call
Traces seen when pci device is detached from the kvm guest (LP: #2104893)
- KVM: PPC: Enable CAP_SPAPR_TCE_VFIO on pSeries KVM guests
* [SRU] Enable speaker/mic mute LEDs on Lenovo ideapad and thinkbook
(LP: #2106449)
- ALSA: hda: Support for Ideapad hotkey mute LEDs
- platform/x86:lenovo-wmi-hotkey-utilities.c: Support for mic and audio mute
LEDs
- [Config] Enable Lenovo wmi hotkey driver
* Backport "PCI: Wait for device readiness with Configuration RRS" to N/O
(LP: #2106251)
- PCI: Wait for device readiness with Configuration RRS
* BMG: support additional PCI ID (LP: #2105768)
- SAUCE: drm/xe/bmg: Add one additional PCI ID
* mptcp BUG 'scheduling while atomic' in mptcp_pm_nl_append_new_local_addr
(LP: #2101120)
- mptcp: fix 'scheduling while atomic' in mptcp_pm_nl_append_new_local_addr
* CVE-2025-21971
- net_sched: Prevent creation of classes with TC_H_ROOT
* uprobe-related panics during profiling (LP: #2104210)
- uprobes: Fix race in uprobe_free_utask
* ubuntu_bpf failed to build on Noble / Oracular (LP: #2069407)
- selftests/bpf: Fix compilation failure when CONFIG_NET_FOU!=y
* drm/xe: improve behavior under memory pressure (LP: #2102659)
- drm/xe: Avoid evicting object of the same vm in none fault mode
- drm/xe: Reject BO eviction if BO is bound to current VM
* BMG: fix EFAULT handling (LP: #2102657)
- drm/xe/userptr: fix EFAULT handling
* HDMI cause display malfunctioning on BMG hardware (LP: #2102378)
- drm/xe: Remove runtime argument from display s/r functions
- drm/xe/display: Separate the d3cold and non-d3cold runtime PM handling
- drm/xe/display: Add missing HPD interrupt enabling during non-d3cold RPM
resume
- drm/xe: Fix missing conversion to xe_display_pm_runtime_resume
* [SRU] Fix Lenovo M70/90 gen6 micmute key and led (LP: #2101811)
- ALSA: hda/realtek - add supported Mic Mute LED for Lenovo platform
- ALSA: hda: realtek: fix incorrect IS_REACHABLE() usage
* Oracular update: upstream stable patchset 2025-03-27 (LP: #2104873)
- nfsd: clear acl_access/acl_default after releasing them
- NFSD: fix hang in nfsd4_shutdown_callback
- pinctrl: cy8c95x0: Respect IRQ trigger settings from firmware
- HID: multitouch: Add NULL check in mt_input_configured
- HID: hid-thrustmaster: fix stack-out-of-bounds read in
usb_check_int_endpoints()
- spi: sn-f-ospi: Fix division by zero
- ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt
- ndisc: ndisc_send_redirect() must use dev_get_by_index_rcu()
- vrf: use RCU protection in l3mdev_l3_out()
- vxlan: check vxlan_vnigroup_init() return value
- LoongArch: Fix idle VS timer enqueue
- LoongArch: csum: Fix OoB access in IP checksum code for negative lengths
- arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array
- cgroup: Remove steal time from usage_usec
- drm/i915/selftests: avoid using uninitialized context
- gpio: bcm-kona: Fix GPIO lock/unlock for banks above bank 0
- gpio: bcm-kona: Make sure GPIO bits are unlocked when requesting IRQ
- gpio: bcm-kona: Add missing newline to dev_err format string
- drm/amdgpu: bail out when failed to load fw in psp_init_cap_microcode()
- xen/swiotlb: relax alignment requirements
- x86/xen: allow larger contiguous memory regions in PV guests
- block: cleanup and fix batch completion adding conditions
- gpiolib: Fix crash on error in gpiochip_get_ngpios()
- tools: fix annoying "mkdir -p ..." logs when building tools in parallel
- RDMA/efa: Reset device on probe failure
- fbdev: omap: use threaded IRQ for LCD DMA
- soc/tegra: fuse: Update Tegra234 nvmem keepout list
- media: cxd2841er: fix 64-bit division on gcc-9
- media: i2c: ds90ub913: Add error handling to ub913_hw_init()
- media: i2c: ds90ub953: Add error handling for i2c reads/writes
- media: uvcvideo: Implement dual stream quirk to fix loss of usb packets
- media: uvcvideo: Add new quirk definition for the Sonix Technology Co.
292a
camera
- media: uvcvideo: Add Kurokesu C1 PRO camera
- media: vidtv: Fix a null-ptr-deref in vidtv_mux_stop_thread
- PCI/DPC: Quirk PIO log size for Intel Raptor Lake-P
- PCI: switchtec: Add Microchip PCI100X device IDs
- scsi: ufs: bsg: Set bsg_queue to NULL after removal
- rtla/timerlat_hist: Abort event processing on second signal
- rtla/timerlat_top: Abort event processing on second signal
- vfio/pci: Enable iowrite64 and ioread64 for vfio pci
- NFS: Fix potential buffer overflowin nfs_sysfs_link_rpc_client()
- Grab mm lock before grabbing pt lock
- selftests: gpio: gpio-sim: Fix missing chip disablements
- ACPI: x86: Add skip i2c clients quirk for Vexia EDU ATLA 10 tablet 5V
- x86/mm/tlb: Only trim the mm_cpumask once a second
- orangefs: fix a oob in orangefs_debug_write
- ASoC: Intel: bytcr_rt5640: Add DMI quirk for Vexia Edu Atla 10 tablet 5V
- batman-adv: fix panic during interface removal
- batman-adv: Ignore neighbor throughput metrics in error case
- batman-adv: Drop unmanaged ELP metric worker
- drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table()
- KVM: x86: Reject Hyper-V's SEND_IPI hypercalls if local APIC isn't
in-kernel
- KVM: nSVM: Enter guest mode before initializing nested NPT MMU
- perf/x86/intel: Ensure LBRs are disabled when a CPU is starting
- usb: gadget: f_midi: Fixing wMaxPacketSize exceeded issue during MIDI bind
retries
- usb: dwc3: Fix timeout issue during controller enter/exit from halt state
- usb: roles: set switch registered flag early on
- usb: gadget: udc: renesas_usb3: Fix compiler warning
- usb: dwc2: gadget: remove of_node reference upon udc_stop
- USB: pci-quirks: Fix HCCPARAMS register error for LS7A EHCI
- usb: core: fix pipe creation for get_bMaxPacketSize0
- USB: quirks: add USB_QUIRK_NO_LPM quirk for Teclast dist
- USB: Add USB_QUIRK_NO_LPM quirk for sony xperia xz1 smartphone
- usb: gadget: f_midi: fix MIDI Streaming descriptor lengths
- USB: hub: Ignore non-compliant devices with too many configs or interfaces
- USB: cdc-acm: Fill in Renesas R-Car D3 USB Download mode quirk
- usb: cdc-acm: Check control transfer buffer size before access
- usb: cdc-acm: Fix handling of oversized fragments
- USB: serial: option: add MeiG Smart SLM828
- USB: serial: option: add Telit Cinterion FN990B compositions
- USB: serial: option: fix Telit Cinterion FN990A name
- USB: serial: option: drop MeiG Smart defines
- can: ctucanfd: handle skb allocation failure
- can: c_can: fix unbalanced runtime PM disable in error path
- can: j1939: j1939_sk_send_loop(): fix unable to send messages with data
length zero
- can: etas_es58x: fix potential NULL pointer dereference on udev->serial
- alpha: make stack 16-byte aligned (most cases)
- wifi: ath12k: fix handling of 6 GHz rules
- kbuild: userprogs: fix bitsize and target detection on clang
- efi: Avoid cold plugged memory for placing the kernel
- cgroup: fix race between fork and cgroup.kill
- serial: port: Assign ->iotype correctly when ->iobase is set
- serial: port: Always update ->iotype in __uart_read_properties()
- serial: 8250: Fix fifo underflow on flush
- alpha: align stack for page fault and user unaligned trap handlers
- gpiolib: acpi: Add a quirk for Acer Nitro ANV14
- gpio: stmpe: Check return value of stmpe_reg_read in
stmpe_gpio_irq_sync_unlock
- partitions: mac: fix handling of bogus partition table
- regulator: qcom_smd: Add l2, l5 sub-node to mp5496 regulator
- regmap-irq: Add missing kfree()
- arm64: Handle .ARM.attributes section in linker scripts
- mmc: mtk-sd: Fix register settings for hs400(es) mode
- igc: Set buffer type for empty frames in igc_init_empty_frame
- mlxsw: Add return value check for mlxsw_sp_port_get_stats_raw()
- btrfs: fix hole expansion when writing at an offset beyond EOF
- clocksource: Use pr_info() for "Checking clocksource synchronization"
message
- clocksource: Use migrate_disable() to avoid calling get_random_u32() in
atomic context
- ipv4: add RCU protection to ip4_dst_hoplimit()
- net: add dev_net_rcu() helper
- ipv4: use RCU protection in ipv4_default_advmss()
- ipv4: use RCU protection in rt_is_expired()
- ipv4: use RCU protection in inet_select_addr()
- net: ipv4: Cache pmtu for all packet paths if multipath enabled
- ipv4: use RCU protection in __ip_rt_update_pmtu()
- ipv4: icmp: convert to dev_net_rcu()
- flow_dissector: use RCU protection to fetch dev_net()
- ipv6: use RCU protection in ip6_default_advmss()
- ipv6: icmp: convert to dev_net_rcu()
- HID: hid-steam: Make sure rumble work is canceled on removal
- HID: hid-steam: Move hidraw input (un)registering to work
- ndisc: use RCU protection in ndisc_alloc_skb()
- neighbour: delete redundant judgment statements
- neighbour: use RCU protection in __neigh_notify()
- arp: use RCU protection in arp_xmit()
- openvswitch: use RCU protection in ovs_vport_cmd_fill_info()
- ndisc: extend RCU protection in ndisc_send_skb()
- ipv6: mcast: extend RCU protection in igmp6_send()
- ipv6: mcast: add RCU protection to mld_newpack()
- drm/tidss: Fix issue in irq handling causing irq-flood issue
- drm/tidss: Clear the interrupt status for interrupts being disabled
- drm/rcar-du: dsi: Fix PHY lock bit check
- drm/v3d: Stop active perfmon if it is being destroyed
- netdevsim: print human readable IP address
- md/md-bitmap: factor behind write counters out from
bitmap_{start/end}write()
- md/md-bitmap: remove the last parameter for bimtap_ops->endwrite()
- md/md-bitmap: move bitmap_{start, end}write to md upper layer
- HID: hid-steam: Don't use cancel_delayed_work_sync in IRQ context
- io_uring/kbuf: reallocate buf lists on upgrade
- x86/i8253: Disable PIT timer 0 when not in use
- nfsd: validate the nfsd_serv pointer before calling svc_wake_up
- x86/cpu/kvm: SRSO: Fix possible missing IBPB on VM-Exit
- pinctrl: cy8c95x0: Avoid accessing reserved registers
- pinctrl: cy8c95x0: Enable regmap locking for debug
- pinctrl: cy8c95x0: Rename PWMSEL to SELPWM
- HID: winwing: Add NULL check in winwing_init_led()
- scripts/Makefile.extrawarn: Do not show clang's non-kprintf warnings at
W=1
- pinctrl: pinconf-generic: Print unsigned value if a format is registered
- net: fib_rules: annotate data-races around rule->[io]ifindex
- Documentation/networking: fix basic node example document ISO 15765-2
- idpf: fix handling rsc packet with a single segment
- idpf: record rx queue in skb for RSC packets
- idpf: call set_real_num_queues in idpf_open
- igc: Fix HW RX timestamp when passed by ZC XDP
- LoongArch: KVM: Fix typo issue about GCFG feature detection
- net: ethernet: ti: am65-cpsw: fix memleak in certain XDP cases
- net: ethernet: ti: am65_cpsw: fix tx_cleanup for XDP case
- Bluetooth: btintel_pcie: Fix a potential race condition
- team: better TEAM_OPTION_TYPE_STRING validation
- workqueue: Put the pwq after detaching the rescuer from the pool
- drm/tests: hdmi: Fix WW_MUTEX_SLOWPATH failures
- gpu: host1x: Fix a use of uninitialized mutex
- perf/x86/intel: Clean up PEBS-via-PT on hybrid
- drm/xe/client: bo->client does not need bos_lock
- io_uring/waitid: don't abuse io_tw_state
- io_uring/uring_cmd: remove dead req_has_async_data() check
- drm: Fix DSC BPP increment decoding
- iommu/amd: Expicitly enable CNTRL.EPHEn bit in resume path
- firmware: qcom: scm: smc: Handle missing SCM device
- i3c: mipi-i3c-hci: Add Intel specific quirk to ring resuming
- i3c: mipi-i3c-hci: Add support for MIPI I3C HCI on PCI bus
- [Config] updateconfigs for MIPI_I3C_HCI_PCI
- media: bcm2835-unicam: Disable trigger mode operation
- serial: 8250_pci: Resolve WCH vendor ID ambiguity
- serial: 8250_pci: Share WCH IDs with parport_serial driver
- 8250: microchip: pci1xxxx: Add workaround for RTS bit toggle
- vfio/nvgrace-gpu: Read dvsec register to determine need for uncached
resmem
- vfio/nvgrace-gpu: Expose the blackwell device PF BAR1 to the VM
- fs/ntfs3: Unify inode corruption marking with _ntfs_bad_inode()
- kbuild: suppress stdout from merge_config for silent builds
- kbuild: Use -fzero-init-padding-bits=all
- KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop
- perf/x86/intel: Fix ARCH_PERFMON_NUM_COUNTER_LEAF
- ring-buffer: Unlock resize on mmap error
- usb: gadget: core: flush gadget workqueue after device removal
- PCI: Avoid FLR for Mediatek MT7922 WiFi
- arm64: rust: clean Rust 1.85.0 warning using softfloat target
- alpha: replace hardcoded stack offsets with autogenerated ones
- s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn()
- s390/pci: Fix handling of isolated VFs
- iommu: Fix potential memory leak in iopf_queue_remove_device()
- include: net: add static inline dst_dev_overhead() to dst.h
- net: ipv6: ioam6_iptunnel: mitigate 2-realloc issue
- net: ipv6: seg6_iptunnel: mitigate 2-realloc issue
- net: ipv6: rpl_iptunnel: mitigate 2-realloc issue
- net: ipv6: fix dst ref loops in rpl, seg6 and ioam6 lwtunnels
- scsi: ufs: core: Introduce ufshcd_has_pending_tasks()
- scsi: ufs: core: Prepare to introduce a new clock_gating lock
- scsi: ufs: core: Introduce a new clock_gating lock
- scsi: ufs: Fix toggling of clk_gating.state when clock gating is not
allowed
- rust: kbuild: add -fzero-init-padding-bits to bindgen_skip_cflags
- cpufreq/amd-pstate: Call cppc_set_epp_perf in the reenable function
- cpufreq/amd-pstate: Align offline flow of shared memory and MSR based
systems
- cpufreq/amd-pstate: Refactor amd_pstate_epp_reenable() and
amd_pstate_epp_offline()
- cpufreq/amd-pstate: Remove the cppc_state check in offline/online
functions
- cpufreq/amd-pstate: Merge amd_pstate_epp_cpu_offline() and
amd_pstate_epp_offline()
- ipv4: use RCU protection in ip_dst_mtu_maybe_forward()
- drm/tidss: Fix race condition while handling interrupt registers
- drm/msm/gem: prevent integer overflow in msm_ioctl_gem_submit()
- drm/msm/dpu: fix x1e80100 intf_6 underrun/vsync interrupt
- drm/msm/dpu1: don't choke on disabling the writeback connector
- drm/xe/tracing: Fix a potential TP_printk UAF
- drm: renesas: rz-du: Increase supported resolutions
- Revert "UBUNTU: SAUCE: selftest: netfilter: fix null IP field in
kci_test_ipsec_offload"
- selftests: rtnetlink: update netdevsim ipsec output format
- wifi: rtw89: pci: disable PCIE wake bit when PCIE deinit
- net: ipv6: fix dst refleaks in rpl, seg6 and ioam6 lwtunnels
- scsi: ufs: core: Ensure clk_gating.lock is used only after initialization
- Upstream stable to v6.6.79, v6.12.16
* Oracular update: upstream stable patchset 2025-03-25 (LP: #2104188)
- xfs: don't lose solo dquot update transactions
- Upstream stable to v6.6.78, v6.12.15
* Oracular update: upstream stable patchset 2025-03-24 (LP: #2104091)
- irqchip/lan966x-oic: Make CONFIG_LAN966X_OIC depend on
CONFIG_MCHP_LAN966X_PCI
- [Config] updateconfigs for LAN966X_OIC
- btrfs: fix assertion failure when splitting ordered extent after
transaction
abort
- btrfs: do not output error message if a qgroup has been already cleaned up
- btrfs: fix use-after-free when attempting to join an aborted transaction
- arm64/mm: Ensure adequate HUGE_MAX_HSTATE
- exec: fix up /proc/pid/comm in the execveat(AT_EMPTY_PATH) case
- s390/stackleak: Use exrl instead of ex in __stackleak_poison()
- btrfs: fix data race when accessing the inode's disk_i_size at
btrfs_drop_extents()
- btrfs: convert BUG_ON in btrfs_reloc_cow_block() to proper error handling
- sched: Don't try to catch up excess steal time.
- x86: Convert unreachable() to BUG()
- locking/ww_mutex/test: Use swap() macro
- lockdep: Fix upper limit for LOCKDEP_*_BITS configs
- x86/amd_nb: Restrict init function to AMD-based systems
- drm/virtio: New fence for every plane update
- drm: Add panel backlight quirks
- drm: panel-backlight-quirks: Add Framework 13 matte panel
- drm: panel-backlight-quirks: Add Framework 13 glossy and 2.8k panels
- nvkm/gsp: correctly advance the read pointer of GSP message queue
- nvkm: correctly calculate the available space of the GSP cmdq buffer
- drm/tests: hdmi: handle empty modes in find_preferred_mode()
- drm/tests: hdmi: return meaningful value from set_connector_edid()
- drm/amd/display: Populate chroma prefetch parameters, DET buffer fix
- drm/amd/display: Overwriting dualDPP UBF values before usage
- printk: Fix signed integer overflow when defining LOG_BUF_LEN_MAX
- drm/connector: add mutex to protect ELD from concurrent access
- drm/bridge: anx7625: use eld_mutex to protect access to connector->eld
- drm/bridge: ite-it66121: use eld_mutex to protect access to connector->eld
- drm/amd/display: use eld_mutex to protect access to connector->eld
- drm/exynos: hdmi: use eld_mutex to protect access to connector->eld
- drm/radeon: use eld_mutex to protect access to connector->eld
- drm/sti: hdmi: use eld_mutex to protect access to connector->eld
- drm/vc4: hdmi: use eld_mutex to protect access to connector->eld
- drm/amd/display: Fix Mode Cutoff in DSC Passthrough to DP2.1 Monitor
- drm/amdgpu: Don't enable sdma 4.4.5 CTXEMPTY interrupt
- drm/amdkfd: Queue interrupt work to different CPU
- drm/bridge: it6505: Change definition MAX_HDCP_DOWN_STREAM_COUNT
- drm/bridge: it6505: fix HDCP Bstatus check
- drm/bridge: it6505: fix HDCP encryption when R0 ready
- drm/bridge: it6505: fix HDCP CTS compare V matching
- drm/bridge: it6505: fix HDCP CTS KSV list wait timer
- safesetid: check size of policy writes
- drm/amd/display: Increase sanitizer frame larger than limit when compile
testing with clang
- drm/amd/display: Limit Scaling Ratio on DCN3.01
- ring-buffer: Make reading page consistent with the code logic
- wifi: rtw89: add crystal_cap check to avoid setting as overflow value
- tun: fix group permission check
- mmc: core: Respect quirk_max_rate for non-UHS SDIO card
- mmc: sdhci-esdhc-imx: enable 'SDHCI_QUIRK_NO_LED' quirk for S32G
- wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy()
- tomoyo: don't emit warning in tomoyo_write_control()
- mfd: lpc_ich: Add another Gemini Lake ISA bridge PCI device-id
- wifi: rtw88: add __packed attribute to efuse layout struct
- clk: qcom: Make GCC_8150 depend on QCOM_GDSC
- HID: multitouch: Add quirk for Hantick 5288 touchpad
- HID: Wacom: Add PCI Wacom device support
- net/mlx5: use do_aux_work for PHC overflow checks
- wifi: brcmfmac: Check the return value of of_property_read_string_index()
- wifi: iwlwifi: pcie: Add support for new device ids
- wifi: iwlwifi: avoid memory leak
- i2c: Force ELAN06FA touchpad I2C bus freq to 100KHz
- APEI: GHES: Have GHES honor the panic= setting
- Bluetooth: btusb: Add new VID/PID 13d3/3610 for MT7922
- Bluetooth: btusb: Add new VID/PID 13d3/3628 for MT7925
- Bluetooth: MGMT: Fix slab-use-after-free Read in
mgmt_remove_adv_monitor_sync
- net: wwan: iosm: Fix hibernation by re-binding the driver around it
- HID: hid-asus: Disable OOBE mode on the ProArt P16
- mmc: sdhci-msm: Correctly set the load for the regulator
- octeon_ep: update tx/rx stats locally for persistence
- octeon_ep_vf: update tx/rx stats locally for persistence
- tipc: re-order conditions in tipc_crypto_key_rcv()
- selftests/net/ipsec: Fix Null pointer dereference in rtattr_pack()
- ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params
- x86/kexec: Allocate PGD for x86_64 transition page tables separately
- ASoC: Intel: sof_sdw: Correct quirk for Lenovo Yoga Slim 7
- iommu/arm-smmu-qcom: add sdm670 adreno iommu compatible
- iommu/arm-smmu-v3: Clean up more on probe failure
- platform/x86: int3472: Check for adev == NULL
- platform/x86: acer-wmi: Add support for Acer PH14-51
- ASoC: soc-pcm: don't use soc_pcm_ret() on .prepare callback
- platform/x86: acer-wmi: Add support for Acer Predator PH16-72
- ASoC: amd: Add ACPI dependency to fix build error
- Input: allocate keycode for phone linking
- platform/x86: acer-wmi: add support for Acer Nitro AN515-58
- platform/x86: acer-wmi: Ignore AC events
- xfs: report realtime block quota limits on realtime directories
- xfs: don't over-report free space or inodes in statvfs
- tty: xilinx_uartps: split sysrq handling
- tty: Permit some TIOCL_SETSEL modes without CAP_SYS_ADMIN
- platform/x86: serdev_helpers: Check for serial_ctrl_uid == NULL
- nvme: handle connectivity loss in nvme_set_queue_count
- firmware: iscsi_ibft: fix ISCSI_IBFT Kconfig entry
- gpu: drm_dp_cec: fix broken CEC adapter properties check
- ice: put Rx buffers after being done with current frame
- ice: gather page_count()'s of each frag right before XDP prog call
- ice: stop storing XDP verdict within ice_rx_buf
- nvme-fc: use ctrl state getter
- net: bcmgenet: Correct overlaying of PHY and MAC Wake-on-LAN
- ice: Add check for devm_kzalloc()
- vmxnet3: Fix tx queue race condition with XDP
- tg3: Disable tg3 PCIe AER on system reboot
- udp: gso: do not drop small packets when PMTU reduces
- drm/i915/dp: fix the Adaptive sync Operation mode for SDP
- rxrpc: Fix the rxrpc_connection attend queue handling
- gpio: pca953x: Improve interrupt support
- net: atlantic: fix warning during hot unplug
- net: rose: lock the socket in rose_bind()
- gpio: sim: lock hog configfs items if present
- x86/xen: fix xen_hypercall_hvm() to not clobber %rbx
- x86/xen: add FRAME_END to xen_hypercall_hvm()
- ACPI: property: Fix return value for nval == 0 in acpi_data_prop_read()
- tun: revert fix group permission check
- net: sched: Fix truncation of offloaded action statistics
- rxrpc: Fix call state set to not include the SERVER_SECURING state
- cpufreq: fix using cpufreq-dt as module
- cpufreq: s3c64xx: Fix compilation warning
- leds: lp8860: Write full EEPROM, not only half of it
- ALSA: hda/realtek: Enable Mute LED on HP Laptop 14s-fq1xxx
- drm/modeset: Handle tiled displays in pan_display_atomic.
- drm/client: Handle tiled displays better
- smb: client: fix order of arguments of tracepoints
- smb: client: change lease epoch type from unsigned int to __u16
- md: reintroduce md-linear
- [Config] updateconfigs for reintroducing MD_LINEAR
- s390/futex: Fix FUTEX_OP_ANDN implementation
- arm64: Filter out SVE hwcaps when FEAT_SVE isn't implemented
- m68k: vga: Fix I/O defines
- fs/proc: do_task_stat: Fix ESP not readable during coredump
- binfmt_flat: Fix integer overflow bug on 32 bit systems
- accel/ivpu: Fix Qemu crash when running in passthrough
- arm64/kvm: Configure HYP TCR.PS/DS based on host stage1
- arm64/mm: Override PARange for !LPA2 and use it consistently
- arm64/sme: Move storage of reg_smidr to __cpuinfo_store_cpu()
- arm64/mm: Reduce PA space to 48 bits when LPA2 is not enabled
- KVM: arm64: timer: Always evaluate the need for a soft timer
- drm/rockchip: cdn-dp: Use drm_connector_helper_hpd_irq_event()
- arm64: dts: rockchip: increase gmac rx_delay on rk3399-puma
- remoteproc: omap: Handle ARM dma_iommu_mapping
- KVM: Explicitly verify target vCPU is online in kvm_get_vcpu()
- kvm: defer huge page recovery vhost task to later
- KVM: s390: vsie: fix some corner-cases when grabbing vsie pages
- ksmbd: fix integer overflows on 32 bit systems
- drm/amd/display: Optimize cursor position updates
- drm/amd/pm: Mark MM activity as unsupported
- drm/amd/amdgpu: change the config of cgcg on gfx12
- drm/amdkfd: only flush the validate MES contex
- drm/i915/guc: Debug print LRC state entries only if the context is pinned
- drm/i915: Fix page cleanup on DMA remap failure
- drm/komeda: Add check for komeda_get_layer_fourcc_list()
- drm/xe/devcoredump: Move exec queue snapshot to Contexts section
- drm/i915/dp: Iterate DSC BPP from high to low on all platforms
- drm/i915: Drop 64bpp YUV formats from ICL+ SDR planes
- drm/amdgpu: add a BO metadata flag to disable write compression for Vulkan
- drm/amd/display: Fix seamless boot sequence
- Bluetooth: L2CAP: accept zero as a special value for MTU auto-selection
- KEYS: trusted: dcp: fix improper sg use with CONFIG_VMAP_STACK=y
- clk: sunxi-ng: a100: enable MMC clock reparenting
- clk: mmp2: call pm_genpd_init() only after genpd.name is set
- media: i2c: ds90ub960: Fix UB9702 refclk register access
- clk: clk-loongson2: Fix the number count of clk provider
- clk: qcom: clk-alpha-pll: fix alpha mode configuration
- clk: qcom: gcc-sm8550: Do not turn off PCIe GDSCs during gdsc_disable()
- clk: qcom: gcc-sm8650: Do not turn off PCIe GDSCs during gdsc_disable()
- clk: qcom: gcc-sm6350: Add missing parent_map for two clocks
- clk: qcom: dispcc-sm6350: Add missing parent_map for a clock
- clk: qcom: gcc-mdm9607: Fix cmd_rcgr offset for blsp1_uart6 rcg
- clk: qcom: clk-rpmh: prevent integer overflow in recalc_rate
- clk: mediatek: mt2701-vdec: fix conversion to mtk_clk_simple_probe
- clk: mediatek: mt2701-aud: fix conversion to mtk_clk_simple_probe
- clk: mediatek: mt2701-bdp: add missing dummy clk
- clk: mediatek: mt2701-img: add missing dummy clk
- clk: mediatek: mt2701-mm: add missing dummy clk
- blk-cgroup: Fix class @block_class's subsystem refcount leakage
- efi: libstub: Use '-std=gnu11' to fix build with GCC 15
- perf bench: Fix undefined behavior in cmpworker()
- scsi: ufs: core: Fix the HIGH/LOW_TEMP Bit Definitions
- of: Correct child specifier used as input of the 2nd nexus node
- of: Fix of_find_node_opts_by_path() handling of alias+path+options
- Input: bbnsm_pwrkey - add remove hook
- HID: hid-sensor-hub: don't use stale platform-data on remove
- ring-buffer: Do not allow events in NMI with generic atomic64 cmpxchg()
- atomic64: Use arch_spin_locks instead of raw_spin_locks
- wifi: rtlwifi: rtl8821ae: Fix media status report
- wifi: brcmfmac: fix NULL pointer dereference in brcmf_txfinalize()
- wifi: mt76: mt7921u: Add VID/PID for TP-Link TXE50UH
- wifi: rtw88: sdio: Fix disconnection after beacon loss
- wifi: mt76: mt7915: add module param to select 5 GHz or 6 GHz on MT7916
- wifi: rtw88: 8703b: Fix RX/TX issues
- usb: gadget: f_tcm: Translate error to sense
- usb: gadget: f_tcm: Decrement command ref count on cleanup
- usb: gadget: f_tcm: ep_autoconfig with fullspeed endpoint
- usb: gadget: f_tcm: Don't prepare BOT write request twice
- usbnet: ipheth: fix possible overflow in DPE length check
- usbnet: ipheth: use static NDP16 location in URB
- usbnet: ipheth: check that DPE points past NCM header
- usbnet: ipheth: refactor NCM datagram loop
- usbnet: ipheth: break up NCM header size computation
- usbnet: ipheth: fix DPE OoB read
- usbnet: ipheth: document scope of NCM implementation
- arm64: dts: qcom: x1e80100-asus-vivobook-s15: Fix USB QMP PHY supplies
- arm64: dts: qcom: x1e80100-qcp: Fix USB QMP PHY supplies
- arm64: dts: qcom: x1e80100-crd: Fix USB QMP PHY supplies
- arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Fix USB QMP PHY supplies
- arm64: dts: qcom: x1e80100: Fix usb_2 controller interrupts
- ASoC: acp: Support microphone from Lenovo Go S
- soc: qcom: socinfo: Avoid out of bounds read of serial number
- serial: sh-sci: Drop __initdata macro for port_cfg
- serial: sh-sci: Do not probe the serial port if its slot in sci_ports[] is
in use
- MIPS: Loongson64: remove ROM Size unit in boardinfo
- LoongArch: Extend the maximum number of watchpoints
- powerpc/pseries/eeh: Fix get PE state translation
- dm-crypt: don't update io->sector after kcryptd_crypt_write_io_submit()
- dm-crypt: track tag_offset in convert_context
- mips/math-emu: fix emulation of the prefx instruction
- MIPS: pci-legacy: Override pci_address_to_pio
- Revert "MIPS: csrc-r4k: Select HAVE_UNSTABLE_SCHED_CLOCK if SMP && 64BIT"
- block: don't revert iter for -EIOCBQUEUED
- firmware: qcom: scm: Fix missing read barrier in qcom_scm_is_available()
- firmware: qcom: scm: Fix missing read barrier in qcom_scm_get_tzmem_pool()
- ALSA: hda/realtek: Enable headset mic on Positivo C6400
- ALSA: hda: Fix headset detection failure due to unstable sort
- arm64: tegra: Fix Tegra234 PCIe interrupt-map
- s390/pci: Fix SR-IOV for PFs initially in standby
- PCI: Avoid putting some root ports into D3 on TUXEDO Sirius Gen1
- PCI: endpoint: Finish virtual EP removal in pci_epf_remove_vepf()
- PCI: dwc: ep: Write BAR_MASK before iATU registers in pci_epc_set_bar()
- PCI: dwc: ep: Prevent changing BAR size/flags in pci_epc_set_bar()
- nvme-pci: Add TUXEDO InfinityFlex to Samsung sleep quirk
- nvme-pci: Add TUXEDO IBP Gen9 to Samsung sleep quirk
- KVM: x86/mmu: Ensure NX huge page recovery thread is alive before waking
- scsi: st: Don't set pos_unknown just after device recognition
- scsi: qla2xxx: Move FCE Trace buffer allocation to user control
- scsi: ufs: qcom: Fix crypto key eviction
- scsi: ufs: core: Fix use-after free in init error and remove paths
- scsi: storvsc: Set correct data length for sending SCSI command without
payload
- scsi: core: Do not retry I/Os during depopulation
- kbuild: Move -Wenum-enum-conversion to W=2
- rust: init: use explicit ABI to clean warning in future compilers
- x86/boot: Use '-std=gnu11' to fix build with GCC 15
- ubi: Add a check for ubi_num
- ARM: dts: dra7: Add bus_dma_limit for l4 cfg bus
- ARM: dts: ti/omap: gta04: fix pm issues caused by spi module
- arm64: dts: qcom: x1e80100: Fix ADSP memory base and length
- arm64: dts: qcom: x1e80100: Fix CDSP memory length
- arm64: dts: qcom: sm6115: Fix MPSS memory length
- arm64: dts: qcom: sm6115: Fix CDSP memory length
- arm64: dts: qcom: sm6115: Fix ADSP memory base and length
- arm64: dts: qcom: sm6350: Fix ADSP memory length
- arm64: dts: qcom: sm6350: Fix MPSS memory length
- arm64: dts: qcom: sm6350: Fix uart1 interconnect path
- arm64: dts: qcom: sm6375: Fix ADSP memory length
- arm64: dts: qcom: sm6375: Fix CDSP memory base and length
- arm64: dts: qcom: sm6375: Fix MPSS memory base and length
- arm64: dts: qcom: sm8350: Fix ADSP memory base and length
- arm64: dts: qcom: sm8350: Fix CDSP memory base and length
- arm64: dts: qcom: sm8350: Fix MPSS memory length
- arm64: dts: qcom: sm8450: Fix ADSP memory base and length
- arm64: dts: qcom: sm8450: Fix CDSP memory length
- arm64: dts: qcom: sm8450: Fix MPSS memory length
- arm64: dts: qcom: sm8550: Fix ADSP memory base and length
- arm64: dts: qcom: sm8550: Fix CDSP memory length
- arm64: dts: qcom: sm8550: Fix MPSS memory length
- arm64: dts: qcom: sm8650: Fix ADSP memory base and length
- arm64: dts: qcom: sm8650: Fix CDSP memory length
- arm64: dts: qcom: sm8650: Fix MPSS memory length
- arm64: dts: qcom: sm8550: correct MDSS interconnects
- arm64: dts: qcom: sm8650: correct MDSS interconnects
- crypto: qce - fix priority to be less than ARMv8 CE
- arm64: tegra: Fix typo in Tegra234 dce-fabric compatible
- arm64: tegra: Disable Tegra234 sce-fabric node
- parisc: Temporarily disable jump label support
- pwm: microchip-core: fix incorrect comparison with max period
- xfs: don't call remap_verify_area with sb write protection held
- xfs: Propagate errors from xfs_reflink_cancel_cow_range in
xfs_dax_write_iomap_end
- xfs: Add error handling for xfs_reflink_cancel_cow_range
- accel/ivpu: Clear runtime_error after pm_runtime_resume_and_get() fails
- ACPI: PRM: Remove unnecessary strict handler address checks
- tpm: Change to kvalloc() in eventlog/acpi.c
- rv: Reset per-task monitors also for idle tasks
- hrtimers: Force migrate away hrtimers queued after CPUHP_AP_HRTIMERS_DYING
- iommufd: Fix struct iommu_hwpt_pgfault init and padding
- kfence: skip __GFP_THISNODE allocations on NUMA systems
- media: ccs: Clean up parsed CCS static data on parse failure
- mm/hugetlb: fix avoid_reserve to allow taking folio from subpool
- iio: light: as73211: fix channel handling in only-color triggered buffer
- iommufd/fault: Destroy response and mutex in iommufd_fault_destroy()
- iommufd/fault: Use a separate spinlock to protect fault->deliver list
- soc: samsung: exynos-pmu: Fix uninitialized ret in
tensor_set_bits_atomic()
- soc: mediatek: mtk-devapc: Fix leaking IO map on error paths
- soc: mediatek: mtk-devapc: Fix leaking IO map on driver remove
- soc: qcom: smem_state: fix missing of_node_put in error path
- media: mmp: Bring back registration of the device
- media: mc: fix endpoint iteration
- media: nuvoton: Fix an error check in npcm_video_ece_init()
- media: imx296: Add standby delay during probe
- media: intel/ipu6: remove cpu latency qos request on error
- media: ov5640: fix get_light_freq on auto
- media: stm32: dcmipp: correct dma_set_mask_and_coherent mask value
- media: ccs: Fix CCS static data parsing for large block sizes
- media: ccs: Fix cleanup order in ccs_probe()
- media: i2c: ds90ub9x3: Fix extra fwnode_handle_put()
- media: i2c: ds90ub960: Fix use of non-existing registers on UB9702
- media: i2c: ds90ub960: Fix UB9702 VC map
- media: i2c: ds90ub960: Fix logging SP & EQ status only for UB9702
- media: uvcvideo: Fix crash during unbind if gpio unit is in use
- media: uvcvideo: Fix event flags in uvc_ctrl_send_events
- media: uvcvideo: Support partial control reads
- media: uvcvideo: Only save async fh if success
- media: uvcvideo: Remove redundant NULL assignment
- media: uvcvideo: Remove dangling pointers
- mm: kmemleak: fix upper boundary check for physical address objects
- mm: gup: fix infinite loop within __get_longterm_locked
- mm/hugetlb: fix hugepage allocation for interleaved memory nodes
- mm/compaction: fix UBSAN shift-out-of-bounds warning
- ata: libata-sff: Ensure that we cannot write outside the allocated buffer
- irqchip/irq-mvebu-icu: Fix access to msi_data from irq_domain::host_data
- crypto: qce - fix goto jump in error path
- crypto: qce - unregister previously registered algos in error path
- ceph: fix memory leak in ceph_mds_auth_match()
- nvmem: qcom-spmi-sdam: Set size in struct nvmem_config
- nvmem: core: improve range check for nvmem_cell_write()
- nvmem: imx-ocotp-ele: simplify read beyond device check
- nvmem: imx-ocotp-ele: fix MAC address byte order
- nvmem: imx-ocotp-ele: fix reading from non zero offset
- nvmem: imx-ocotp-ele: set word length to 1
- io_uring: fix multishots with selected buffers
- io_uring/net: don't retry connect operation on EPOLLERR
- selftests: mptcp: connect: -f: no reconnect
- pnfs/flexfiles: retry getting layout segment for reads
- ocfs2: fix incorrect CPU endianness conversion causing mount failure
- ocfs2: handle a symlink read error correctly
- nilfs2: fix possible int overflows in nilfs_fiemap()
- nfs: Make NFS_FSCACHE select NETFS_SUPPORT instead of depending on it
- mailbox: tegra-hsp: Clear mailbox before using message
- mailbox: zynqmp: Remove invalid __percpu annotation in zynqmp_ipi_probe()
- NFC: nci: Add bounds checking in nci_hci_create_pipe()
- fgraph: Fix set_graph_notrace with setting TRACE_GRAPH_NOTRACE_BIT
- irqchip/apple-aic: Only handle PMC interrupt as FIQ when configured so
- mtd: onenand: Fix uninitialized retlen in do_otp_read()
- misc: misc_minor_alloc to use ida for all dynamic/misc dynamic minors
- misc: fastrpc: Deregister device nodes properly in error scenarios
- misc: fastrpc: Fix registered buffer page address
- misc: fastrpc: Fix copy buffer page size
- net/ncsi: wait for the last response to Deselect Package before
configuring
channel
- net: phy: c45-tjaxx: add delay between MDIO write and read in soft_reset
- maple_tree: simplify split calculation
- scripts/gdb: fix aarch64 userspace detection in get_current_task
- tracing/osnoise: Fix resetting of tracepoints
- rtla/osnoise: Distinguish missing workload option
- rtla/timerlat_hist: Set OSNOISE_WORKLOAD for kernel threads
- rtla/timerlat_top: Set OSNOISE_WORKLOAD for kernel threads
- rtla: Add trace_instance_stop
- rtla/timerlat_hist: Stop timerlat tracer on signal
- rtla/timerlat_top: Stop timerlat tracer on signal
- pinctrl: samsung: fix fwnode refcount cleanup if
platform_get_irq_optional()
fails
- pinctrl: renesas: rzg2l: Fix PFC_MASK for RZ/V2H and RZ/G3E
- ptp: Ensure info->enable callback is always set
- RDMA/mlx5: Fix a race for an ODP MR which leads to CQE with error
- rtc: zynqmp: Fix optional clock name property
- s390/fpu: Add fpc exception handler / remove fixup section again
- MIPS: ftrace: Declare ftrace_get_parent_ra_addr() as static
- xfs: avoid nested calls to __xfs_trans_commit
- xfs: don't lose solo superblock counter update transactions
- xfs: separate dquot buffer reads from xfs_dqflush
- xfs: clean up log item accesses in xfs_qm_dqflush{,_done}
- xfs: attach dquot buffer to dquot log item buffer
- xfs: convert quotacheck to attach dquot buffers
- xfs: release the dquot buf outside of qli_lock
- xfs: lock dquot buffer before detaching dquot from b_li_list
- spi: atmel-quadspi: Create `atmel_qspi_ops` to support newer SoC families
- spi: atmel-qspi: Memory barriers after memory-mapped I/O
- mptcp: prevent excessive coalescing on receive
- x86/mm: Convert unreachable() to BUG()
- md/md-linear: Fix a NULL vs IS_ERR() bug in linear_add()
- md: Fix linear_set_limits()
- Revert "drm/amd/display: Fix green screen issue after suspend"
- fs: prepend statmount.mnt_opts string with security_sb_mnt_opts()
- fs: fix adding security options to statmount.mnt_opt
- statmount: let unset strings be empty
- arm64: dts: rockchip: add reset-names for combphy on rk3568
- ocfs2: check dir i_size in ocfs2_find_entry
- Upstream stable to v6.6.77, v6.12.14
* Oracular update: upstream stable patchset 2025-03-21 (LP: #2103829)
- powerpc/book3s64/hugetlb: Fix disabling hugetlb when fadump is active
- dlm: fix srcu_read_lock() return type to int
- afs: Fix EEXIST error returned from afs_rmdir() to be ENOTEMPTY
- afs: Fix directory format encoding struct
- afs: Fix cleanup of immediately failed async calls
- fs: fix proc_handler for sysctl_nr_open
- block: retry call probe after request_module in blk_request_module
- nbd: don't allow reconnect after disconnect
- pstore/blk: trivial typo fixes
- nvme: Add error check for xa_store in nvme_get_effects_log
- selftests/powerpc: Fix argument order to timer_sub()
- nvme: Add error path for xa_store in nvme_init_effects
- partitions: ldm: remove the initial kernel-doc notation
- select: Fix unbalanced user_access_end()
- nvme: fix bogus kzalloc() return check in nvme_init_effects_log()
- afs: Fix the fallback handling for the YFS.RemoveFile2 RPC call
- perf/core: Save raw sample data conditionally based on sample type
- sched/fair: Fix value reported by hot tasks pulled in /proc/schedstat
- x86/cpu: Enable SD_ASYM_PACKING for PKG domain on AMD
- x86/topology: Use x86_sched_itmt_flags for PKG domain unconditionally
- drm/msm/dp: set safe_to_exit_level before printing it
- drm/etnaviv: Fix page property being used for non writecombine buffers
- HID: core: Fix assumption that Resolution Multipliers must be in Logical
Collections
- drm/amd/pm: Fix an error handling path in
vega10_enable_se_edc_force_stall_config()
- drm/amdgpu: Fix potential NULL pointer dereference in
atomctrl_get_smc_sclk_range_table
- drm/rockchip: vop2: Fix cluster windows alpha ctrl regsiters offset
- drm/rockchip: vop2: Fix the mixer alpha setup for layer 0
- drm/rockchip: vop2: Fix the windows switch between different layers
- drm/rockchip: vop2: Check linear format for Cluster windows on rk3566/8
- drm/rockchip: vop2: include rockchip_drm_drv.h
- drm/amdgpu/vcn: reset fw_shared under SRIOV
- OPP: add index check to assert to avoid buffer overflow in _read_freq()
- OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized
- drm/msm/dpu: link DSPP_2/_3 blocks on SM8150
- drm/msm/dpu: link DSPP_2/_3 blocks on SC8180X
- drm/msm/dpu: link DSPP_2/_3 blocks on SM8250
- drm/msm/dpu: link DSPP_2/_3 blocks on SM8350
- drm/msm/dpu: link DSPP_2/_3 blocks on SM8550
- drm/msm: Check return value of of_dma_configure()
- drm/bridge: it6505: Change definition of AUX_FIFO_MAX_SIZE
- drm/amdgpu: tear down ttm range manager for doorbell in amdgpu_ttm_fini()
- genirq: Make handle_enforce_irqctx() unconditionally available
- ipmi: ipmb: Add check devm_kasprintf() returned value
- wifi: ath11k: Fix unexpected return buffer manager error for
WCN6750/WCN6855
- wifi: rtlwifi: do not complete firmware loading needlessly
- wifi: rtlwifi: rtl8192se: rise completion of firmware loading as last step
- wifi: rtlwifi: wait for firmware loading before releasing memory
- wifi: rtlwifi: fix init_sw_vars leak when probe fails
- wifi: rtlwifi: usb: fix workqueue leak when probe fails
- wifi: wcn36xx: fix channel survey memory allocation size
- net_sched: sch_sfq: handle bigger packets
- net_sched: sch_sfq: don't allow 1 packet limit
- spi: zynq-qspi: Add check for clk_enable()
- rxrpc: Fix handling of received connection abort
- dt-bindings: mmc: controller: clarify the address-cells description
- clk: fix an OF node reference leak in of_clk_get_parent_name()
- dt-bindings: leds: class-multicolor: Fix path to color definitions
- wifi: rtlwifi: remove unused check_buddy_priv
- wifi: rtlwifi: destroy workqueue at rtl_deinit_core
- wifi: rtlwifi: fix memory leaks and invalid access at probe error path
- wifi: rtlwifi: pci: wait for firmware loading before releasing memory
- HID: multitouch: fix support for Goodix PID 0x01e9
- regulator: dt-bindings: mt6315: Drop regulator-compatible property
- wifi: brcmfmac: add missing header include for brcmf_dbg
- ACPI: fan: cleanup resources in the error path of .probe()
- cpupower: fix TSC MHz calculation
- dt-bindings: mfd: bd71815: Fix rsense and typos
- leds: netxbig: Fix an OF node reference leak in
netxbig_leds_get_of_pdata()
- inetpeer: remove create argument of inet_getpeer_v[46]()
- inetpeer: remove create argument of inet_getpeer()
- inetpeer: update inetpeer timestamp in inet_getpeer()
- inetpeer: do not get a refcount in inet_getpeer()
- pwm: stm32-lp: Add check for clk_enable()
- cpufreq: schedutil: Fix superfluous updates caused by need_freq_update
- gpio: pca953x: log an error when failing to get the reset GPIO
- cpufreq: qcom: Fix qcom_cpufreq_hw_recalc_rate() to query LUT if LMh IRQ
is
not available
- cpufreq: qcom: Implement clk_ops::determine_rate() for qcom_cpufreq*
clocks
- clk: imx8mp: Fix clkout1/2 support
- dt-bindings: clock: sunxi: Export PLL_VIDEO_2X and PLL_MIPI
- clk: sunxi-ng: a64: drop redundant CLK_PLL_VIDEO0_2X and CLK_PLL_MIPI
- clk: sunxi-ng: a64: stop force-selecting PLL-MIPI as TCON0 parent
- regulator: of: Implement the unwind path of of_regulator_match()
- ax25: rcu protect dev->ax25_ptr
- OPP: OF: Fix an OF node leak in _opp_add_static_v2()
- ipmi: ssif_bmc: Fix new request loss when bmc ready for a response
- wifi: ath12k: fix tx power, max reg power update to firmware
- clk: qcom: gcc-sdm845: Do not use shared clk_ops for QUPs
- HID: hid-thrustmaster: Fix warning in thrustmaster_probe by adding
endpoint
check
- HID: fix generic desktop D-Pad controls
- leds: cht-wcove: Use devm_led_classdev_register() to avoid memory leak
- mfd: syscon: Use scoped variables with memory allocators to simplify error
paths
- mfd: syscon: Fix race in device_node_get_regmap()
- samples/landlock: Fix possible NULL dereference in parse_path()
- wifi: wlcore: fix unbalanced pm_runtime calls
- wifi: mt76: mt7915: Fix mesh scan on MT7916 DBDC
- wifi: mac80211: prohibit deactivating all links
- wifi: mac80211: fix tid removal during mesh forwarding
- wifi: mac80211: Fix common size calculation for ML element
- wifi: mac80211: don't flush non-uploaded STAs
- clk: ralink: mtmips: remove duplicated 'xtal' clock for Ralink SoC RT3883
- net/smc: fix data error when recvmsg with MSG_PEEK flag
- landlock: Handle weird files
- wifi: mt76: mt76u_vendor_request: Do not print error messages when -EPROTO
- wifi: mt76: mt7921: fix using incorrect group cipher after disconnection.
- wifi: mt76: mt7915: fix overflows seen when writing limit attributes
- wifi: mt76: mt7996: fix rx filter setting for bfee functionality
- wifi: mt76: mt7915: firmware restart on devices with a second pcie link
- wifi: mt76: connac: move mt7615_mcu_del_wtbl_all to connac
- wifi: mt76: mt7915: improve hardware restart reliability
- wifi: mt76: mt7915: fix omac index assignment after hardware reset
- wifi: mt76: mt7915: fix register mapping
- wifi: mt76: mt7996: fix register mapping
- wifi: mt76: mt7996: add max mpdu len capability
- wifi: mt76: mt7996: fix the capability of reception of EHT MU PPDU
- wifi: mt76: mt7996: fix HE Phy capability
- wifi: mt76: mt7996: fix incorrect indexing of MIB FW event
- wifi: mt76: mt7996: fix ldpc setting
- cpufreq: ACPI: Fix max-frequency computation
- selftests: timers: clocksource-switch: Adapt progress to kselftest
framework
- selftests: harness: fix printing of mismatch values in __EXPECT()
- wifi: cfg80211: adjust allocation of colocated AP data
- inet: ipmr: fix data-races
- clk: analogbits: Fix incorrect calculation of vco rate delta
- pwm: stm32: Add check for clk_enable()
- selftests/landlock: Fix error message
- net: let net.core.dev_weight always be non-zero
- net/mlxfw: Drop hard coded max FW flash image size
- octeon_ep: remove firmware stats fetch in ndo_get_stats64
- netfilter: nf_tables: fix set size with rbtree backend
- netfilter: nft_flow_offload: update tcp state flags under lock
- net: ethernet: ti: am65-cpsw: fix freeing IRQ in
am65_cpsw_nuss_remove_tx_chns()
- tcp_cubic: fix incorrect HyStart round start detection
- net/rose: prevent integer overflows in rose_setsockopt()
- libbpf: don't adjust USDT semaphore address if .stapsdt.base addr is
missing
- tools/testing/selftests/bpf/test_tc_tunnel.sh: Fix wait for server bind
- libbpf: Fix segfault due to libelf functions not setting errno
- ASoC: sun4i-spdif: Add clock multiplier settings
- selftests/bpf: Fix fill_link_info selftest on powerpc
- crypto: caam - use JobR's space to access page 0 regs
- perf header: Fix one memory leakage in process_bpf_btf()
- perf header: Fix one memory leakage in process_bpf_prog_info()
- perf bpf: Fix two memory leakages when calling
perf_env__insert_bpf_prog_info()
- ASoC: renesas: rz-ssi: Use only the proper amount of dividers
- perf expr: Initialize is_test value in expr__ctx_new()
- ktest.pl: Remove unused declarations in run_bisect_test function
- bpf: bpf_local_storage: Always use bpf_mem_alloc in PREEMPT_RT
- crypto: hisilicon/sec2 - fix for aead icv error
- crypto: hisilicon/sec2 - fix for aead invalid authsize
- crypto: ixp4xx - fix OF node reference leaks in init_ixp_crypto()
- ALSA: seq: Make dependency on UMP clearer
- padata: fix sysfs store callback check
- perf top: Don't complain about lack of vmlinux when not resolving some
kernel samples
- perf machine: Don't ignore _etext when not a text symbol
- perf namespaces: Introduce nsinfo__set_in_pidns()
- perf namespaces: Fixup the nsinfo__in_pidns() return type, its bool
- ASoC: Intel: avs: Do not readq() u32 registers
- ASoC: Intel: avs: Fix theoretical infinite loop
- perf report: Fix misleading help message about --demangle
- pinctrl: stm32: Add check for clk_enable()
- pinctrl: amd: Take suspend type into consideration which pins are non-wake
- bpf: Send signals asynchronously if !preemptible
- bpf: tcp: Mark bpf_load_hdr_opt() arg2 as read-write
- ALSA: hda/realtek - Fixed headphone distorted sound on Acer Aspire A115-31
laptop
- perf lock: Fix parse_lock_type which only retrieve one lock flag
- padata: fix UAF in padata_reorder
- padata: add pd get/put refcnt helper
- padata: avoid UAF for reorder_work
- smb: client: fix oops due to unset link speed
- cifs: Use cifs_autodisable_serverino() for disabling
CIFS_MOUNT_SERVER_INUM
in readdir.c
- soc: atmel: fix device_node release in atmel_soc_device_init()
- ARM: at91: pm: change BU Power Switch to automatic mode
- arm64: dts: mediatek: mt8186: Move wakeup to MTU3 to get working suspend
- arm64: dts: mt8183: set DMIC one-wire mode on Damu
- arm64: dts: mediatek: mt8516: fix GICv2 range
- arm64: dts: mediatek: mt8516: fix wdt irq type
- arm64: dts: mediatek: mt8516: add i2c clock-div property
- arm64: dts: mediatek: mt8516: reserve 192 KiB for TF-A
- ARM: dts: stm32: Fix IPCC EXTI declaration on stm32mp151
- RDMA/mlx4: Avoid false error about access to uninitialized gids array
- rdma/cxgb4: Prevent potential integer overflow on 32bit
- arm64: dts: mediatek: mt8173-evb: Drop regulator-compatible property
- arm64: dts: mediatek: mt8173-elm: Drop regulator-compatible property
- arm64: dts: mediatek: mt8192-asurada: Drop regulator-compatible property
- arm64: dts: mediatek: mt8195-cherry: Drop regulator-compatible property
- arm64: dts: mediatek: mt8195-demo: Drop regulator-compatible property
- arm64: dts: mediatek: mt8173-elm: Fix MT6397 PMIC sub-node names
- arm64: dts: mediatek: mt8173-evb: Fix MT6397 PMIC sub-node names
- ARM: dts: aspeed: yosemite4: correct the compatible string of adm1272
- ARM: dts: aspeed: yosemite4: Add required properties for IOE on fan boards
- ARM: dts: aspeed: yosemite4: correct the compatible string for max31790
- arm: dts: socfpga: use reset-name "stmmaceth-ocp" instead of "ahb"
- RDMA/rxe: Fix mismatched max_msg_sz
- arm64: dts: mediatek: mt8183: kenzo: Support second source touchscreen
- arm64: dts: mediatek: mt8183: willow: Support second source touchscreen
- RDMA/srp: Fix error handling in srp_add_port
- arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie1
- ARM: dts: stm32: Deduplicate serial aliases and chosen node for
STM32MP15xx
DHCOM SoM
- ARM: dts: stm32: Swap USART3 and UART8 alias on STM32MP15xx DHCOM SoM
- memory: tegra20-emc: fix an OF node reference bug in
tegra_emc_find_node_by_ram_code()
- arm64: dts: mediatek: mt8183-kukui-jacuzzi: Drop pp3300_panel voltage
settings
- arm64: dts: qcom: msm8996-xiaomi-gemini: Fix LP5562 LED1 reg property
- arm64: dts: qcom: sa8775p: Update sleep_clk frequency
- arm64: dts: qcom: msm8996: Fix up USB3 interrupts
- arm64: dts: qcom: msm8994: Describe USB interrupts
- arm64: dts: qcom: sm7225-fairphone-fp4: Drop extra qcom,msm-id value
- arm64: dts: qcom: msm8916: correct sleep clock frequency
- arm64: dts: qcom: msm8939: correct sleep clock frequency
- arm64: dts: qcom: msm8994: correct sleep clock frequency
- arm64: dts: qcom: qcs404: correct sleep clock frequency
- arm64: dts: qcom: q[dr]u1000: correct sleep clock frequency
- arm64: dts: qcom: qrb4210-rb2: correct sleep clock frequency
- arm64: dts: qcom: sc7280: correct sleep clock frequency
- arm64: dts: qcom: sdx75: correct sleep clock frequency
- arm64: dts: qcom: sm4450: correct sleep clock frequency
- arm64: dts: qcom: sm6125: correct sleep clock frequency
- arm64: dts: qcom: sm6375: correct sleep clock frequency
- arm64: dts: qcom: sm8250: correct sleep clock frequency
- arm64: dts: qcom: sm8350: correct sleep clock frequency
- arm64: dts: qcom: sm8450: correct sleep clock frequency
- ARM: dts: microchip: sama5d27_wlsom1_ek: Add no-1-8-v property to sdmmc0
node
- arm64: dts: ti: k3-am62: Remove duplicate GICR reg
- arm64: dts: ti: k3-am62a: Remove duplicate GICR reg
- arm64: dts: allwinner: a64: explicitly assign clock parent for TCON0
- RDMA/bnxt_re: Fix to drop reference to the mmap entry in case of error
- ARM: omap1: Fix up the Retu IRQ on Nokia 770
- arm64: dts: qcom: sdm845-db845c-navigation-mezzanine: Convert mezzanine
riser to dtso
- arm64: dts: qcom: sdm845-db845c-navigation-mezzanine: remove disabled
ov7251
camera
- arm64: dts: qcom: sc7180-trogdor-quackingstick: add missing avee-supply
- arm64: dts: qcom: sc7180-trogdor-pompom: rename 5v-choke thermal zone
- arm64: dts: qcom: sc7180: change labels to lower-case
- arm64: dts: qcom: sc7180: fix psci power domain node names
- arm64: dts: qcom: sm8150-microsoft-surface-duo: fix typos in da7280
properties
- arm64: dts: qcom: sc8280xp: Fix up remoteproc register space sizes
- dts: arm64: mediatek: mt8195: Remove MT8183 compatible for OVL
- arm64: dts: mediatek: add per-SoC compatibles for keypad nodes
- arm64: dts: qcom: sdm845: Fix interrupt types of camss interrupts
- arm64: dts: qcom: sm8250: Fix interrupt types of camss interrupts
- ARM: dts: mediatek: mt7623: fix IR nodename
- fbdev: omapfb: Fix an OF node leak in dss_of_port_get_parent_device()
- arm64: tegra: Fix DMA ID for SPI2
- i3c: dw: Fix use-after-free in dw_i3c_master driver due to race condition
- RDMA/mlx5: Fix indirect mkey ODP page count
- of: reserved-memory: Do not make kmemleak ignore freed address
- efi: sysfb_efi: fix W=1 warnings when EFI is not set
- RDMA/rxe: Fix the warning "__rxe_cleanup+0x12c/0x170 [rdma_rxe]"
- media: rc: iguanair: handle timeouts
- media: lmedm04: Handle errors for lme2510_int_read
- PCI: endpoint: Destroy the EPC device in devm_pci_epc_destroy()
- media: marvell: Add check for clk_enable()
- media: i2c: imx290: Register 0x3011 varies between imx327 and imx290
- media: i2c: imx412: Add missing newline to prints
- media: i2c: ov9282: Correct the exposure offset
- media: mipi-csis: Add check for clk_enable()
- media: camif-core: Add check for clk_enable()
- media: uvcvideo: Propagate buf->error to userspace
- mtd: rawnand: brcmnand: fix status read of brcmnand_waitfunc
- mtd: hyperbus: hbmc-am654: fix an OF node reference leak
- media: nxp: imx8-isi: fix v4l2-compliance test errors
- watchdog: rti_wdt: Fix an OF node leak in rti_wdt_probe()
- staging: media: imx: fix OF node leak in imx_media_add_of_subdevs()
- media: dvb-usb-v2: af9035: fix ISO C90 compilation error on
af9035_i2c_master_xfer
- PCI: rcar-ep: Fix incorrect variable used when calling
devm_request_mem_region()
- PCI: imx6: Skip controller_id generation logic for i.MX7D
- PCI: endpoint: pci-epf-test: Set dma_chan_rx pointer to NULL on error
- PCI: endpoint: pci-epf-test: Fix check for DMA MEMCPY test
- scsi: mpt3sas: Set ioc->manu_pg11.EEDPTagMode directly to 1
- scsi: ufs: bsg: Delete bsg_dev when setting up bsg fails
- ocfs2: mark dquot as inactive if failed to start trans while releasing
dquot
- nilfs2: protect access to buffers with no active references
- module: Extend the preempt disabled section in
dereference_symbol_descriptor().
- driver core: class: Fix wild pointer dereferences in API
class_dev_iter_next()
- serial: 8250: Adjust the timeout for FIFO mode
- NFSv4.2: fix COPY_NOTIFY xdr buf size calculation
- NFSv4.2: mark OFFLOAD_CANCEL MOVEABLE
- LoongArch: Fix warnings during S3 suspend
- tools/bootconfig: Fix the wrong format specifier
- xfrm: replay: Fix the update of replay_esn->oseq_hi for GSO
- dmaengine: ti: edma: fix OF node reference leaks in edma_driver
- xfrm: delete intermediate secpath entry in packet offload mode
- rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read
- rtc: loongson: clear TOY_MATCH0_REG in loongson_rtc_isr()
- ubifs: skip dumping tnc tree when zroot is null
- regulator: core: Add missing newline character
- net: hns3: fix oops when unload drivers paralleling
- gpio: mxc: remove dead code after switch to DT-only
- net: fec: implement TSO descriptor cleanup
- ipmr: do not call mr_mfc_uses_dev() for unres entries
- PM: hibernate: Add error handling for syscore_suspend()
- iavf: allow changing VLAN state without calling PF
- net: rose: fix timer races against user threads
- net: netdevsim: try to close UDP port harness races
- vxlan: Fix uninit-value in vxlan_vnifilter_dump()
- net: davicom: fix UAF in dm9000_drv_remove
- ptp: Properly handle compat ioctls
- net: stmmac: Limit the number of MTL queues to hardware capability
- net: stmmac: Limit FIFO size by hardware capability
- perf trace: Fix runtime error of index out of bounds
- vsock: Allow retrying on connect() failure
- bgmac: reduce max frame size to support just MTU 1500
- tcp: correct handling of extreme memory squeeze
- net: xdp: Disallow attaching device-bound programs in generic mode
- net: sh_eth: Fix missing rtnl lock in suspend/resume path
- net: hsr: fix fill_frame_info() regression vs VLAN packets
- genksyms: fix memory leak when the same symbol is added from source
- genksyms: fix memory leak when the same symbol is read from *.symref file
- RISC-V: Mark riscv_v_init() as __init
- ASoC: rockchip: i2s_tdm: Re-add the set_sysclk callback
- io_uring/uring_cmd: use cached cmd_op in io_uring_cmd_sock()
- cifs: Validate EAs for WSL reparse points
- cifs: Fix getting and setting SACLs over SMB1
- kconfig: fix file name in warnings when loading KCONFIG_DEFCONFIG_LIST
- kconfig: fix memory leak in sym_warn_unmet_dep()
- hexagon: fix using plain integer as NULL pointer warning in cmpxchg
- hexagon: Fix unbalanced spinlock in die()
- f2fs: Introduce linear search for dentries
- Revert "SUNRPC: Reduce thread wake-up rate when receiving large RPC
messages"
- kbuild: switch from lz4c to lz4 for compression
- netfilter: nf_tables: reject mismatching sum of field_len with set key
length
- selftests/rseq: Fix handling of glibc without rseq support
- ktest.pl: Check kernelrelease return in get_version
- ALSA: usb-audio: Add delay quirk for iBasso DC07 Pro
- net: usb: rtl8150: enable basic endpoint checking
- usb: xhci: Fix NULL pointer dereference on certain command aborts
- drivers/card_reader/rtsx_usb: Restore interrupt based detection
- usb: gadget: f_tcm: Fix Get/SetInterface return value
- usb: dwc3-am62: Fix an OF node leak in phy_syscon_pll_refclk()
- usb: dwc3: core: Defer the probe until USB power supply ready
- usb: typec: tcpm: set SRC_SEND_CAPABILITIES timeout to
PD_T_SENDER_RESPONSE
- usb: typec: tcpci: Prevent Sink disconnection before vPpsShutdown in SPR
PPS
- mptcp: consolidate suboption status
- mptcp: handle fastopen disconnect correctly
- remoteproc: core: Fix ida_free call while not allocated
- media: uvcvideo: Fix double free in error path
- pps: Fix a use-after-free
- usb: gadget: f_tcm: Don't free command immediately
- staging: media: max96712: fix kernel oops when removing module
- media: imx-jpeg: Fix potential error pointer dereference in detach_pm()
- btrfs: output the reason for open_ctree() failure
- s390: Add '-std=gnu11' to decompressor and purgatory CFLAGS
- LoongArch: Change 8 to 14 for LOONGARCH_MAX_{BRP,WRP}
- dlm: fix removal of rsb struct that is master and dir record
- block: copy back bounce buffer to user-space correctly in case of split
- ps3disk: Do not use dev->bounce_size before it is set
- block: check BLK_FEAT_POLL under q_usage_count
- block: don't update BLK_FEAT_POLL in __blk_mq_update_nr_hw_queues
- nvme-tcp: Fix I/O queue cpu spreading for multiple controllers
- powerpc/pseries/iommu: IOMMU incorrectly marks MMIO range in DDW
- sched: Fix race between yield_to() and try_to_wake_up()
- drm/v3d: Fix performance counter source settings on V3D 7.x
- drm/rockchip: vop2: fix rk3588 dp+dsi maxclk verification
- drm/panthor: Preserve the result returned by panthor_fw_resume()
- drm/connector: Allow clearing HDMI infoframes
- drm/rockchip: vop2: Set AXI id for rk3588
- drm/rockchip: vop2: Setup delay cycle for Esmart2/3
- drm/rockchip: vop2: Add check for 32 bpp format for rk3588
- drm/msm/dpu: provide DSPP and correct LM config for SDM670
- drm/msm/dpu: link DSPP_2/_3 blocks on SM8650
- drm/msm/dpu: link DSPP_2/_3 blocks on X1E80100
- drm/msm: don't clean up priv->kms prematurely
- drm/msm/mdp4: correct LCDC regulator name
- wifi: rtlwifi: rtl8821ae: phy: restore removed code to fix infinite loop
- clk: renesas: cpg-mssr: Fix 'soc' node handling in
cpg_mssr_reserved_init()
- wifi: cfg80211: tests: Fix potential NULL dereference in
test_cfg80211_parse_colocated_ap()
- selftests/bpf: Actuate tx_metadata_len in xdp_hw_metadata
- selftests: ktap_helpers: Fix uninitialized variable
- ptr_ring: do not block hard interrupts in ptr_ring_resize_multiple()
- udp: Deal with race between UDP socket address change and rehash
- dt-bindings: clock: imx93: Drop IMX93_CLK_END macro definition
- dt-bindings: clock: Add i.MX91 clock support
- dt-bindings: clock: imx93: Add SPDIF IPG clk
- clk: imx93: Move IMX93_CLK_END macro to clk driver
- clk: imx: add i.MX91 clk
- clk: imx93: Add IMX93_CLK_SPDIF_IPG clock
- arm64: dts: imx93: Use IMX93_CLK_SPDIF_IPG as SPDIF IPG clock
- clk: imx: Apply some clks only for i.MX93
- clk: qcom: camcc-x1e80100: Set titan_top_gdsc as the parent GDSC of
subordinate GDSCs
- team: prevent adding a device which is already a team device lower
- wifi: mt76: mt7996: fix invalid interface combinations
- wifi: rtw89: mcc: consider time limits not divisible by 1024
- hwmon: Fix help text for aspeed-g6-pwm-tach
- wifi: mt76: mt7925: fix off by one in mt7925_load_clc()
- wifi: iwlwifi: fw: read STEP table from correct UEFI var
- wifi: iwlwifi: mvm: don't count mgmt frames as MPDU
- wifi: cfg80211: Move cfg80211_scan_req_add_chan() n_channels increment
earlier
- clk: thead: Fix clk gate registration to pass flags
- clk: thead: Add CLK_IGNORE_UNUSED to fix TH1520 boot
- clk: thead: Fix cpu2vp_clk for TH1520 AP_SUBSYS clocks
- wifi: mt76: mt7925: fix NULL deref check in mt7925_change_vif_links
- wifi: mt76: mt7925: fix wrong band_idx setting when enable sniffer mode
- wifi: mt76: mt7925: fix get wrong chip cap from incorrect pointer
- wifi: mt76: mt7925: fix the invalid ip address for arp offload
- wifi: mt76: mt7996: fix overflows seen when writing limit attributes
- wifi: mt76: connac: Extend mt76_connac_mcu_uni_add_dev for MLO
- wifi: mt76: mt7925: Fix incorrect MLD address in bss_mld_tlv for MLO
support
- wifi: mt76: mt7925: Fix incorrect WCID assignment for MLO
- wifi: mt76: mt7925: Fix incorrect WCID phy_idx assignment
- wifi: mt76: mt7925: convert comma to semicolon
- wifi: mt76: mt7925: fix wrong parameter for related cmd of chan info
- wifi: mt76: mt7925: Fix CNM Timeout with Single Active Link in MLO
- wifi: mt76: mt7925: Enhance mt7925_mac_link_bss_add to support MLO
- wifi: mt76: Enhance mt7925_mac_link_sta_add to support MLO
- wifi: mt76: mt7925: Update mt7925_mcu_sta_update for BC in ASSOC state
- wifi: mt76: mt7925: Update mt792x_rx_get_wcid for per-link STA
- wifi: mt76: mt7925: Update mt7925_unassign_vif_chanctx for per-link BSS
- wifi: mt76: mt7925: Update secondary link PS flow
- wifi: mt76: mt7925: Init secondary link PM state
- wifi: mt76: mt7925: Update mt7925_mcu_uni_[tx,rx]_ba for MLO
- wifi: mt76: mt7925: Cleanup MLO settings post-disconnection
- wifi: mt76: mt7925: Properly handle responses for commands with events
- wifi: mt76: mt7996: fix definition of tx descriptor
- Bluetooth: btbcm: Fix NULL deref in btbcm_get_board_name()
- Bluetooth: btrtl: check for NULL in btrtl_setup_realtek()
- dev: Acquire netdev_rename_lock before restoring dev->name in
dev_change_name().
- selftests/landlock: Fix build with non-default pthread linking
- octeon_ep_vf: remove firmware stats fetch in ndo_get_stats64
- net: sched: refine software bypass handling in tc_run
- platform/mellanox: mlxbf-pmc: incorrect type in assignment
- platform/x86: x86-android-tablets: make platform data be static
- pinctrl: samsung: Fix irq handling if an error occurs in
exynos_irq_demux_eint16_31()
- ASoC: cs40l50: Use *-y for Makefile
- ASoC: wcd937x: Use *-y for Makefile
- iommu/arm-smmuv3: Update comments about ATS and bypass
- crypto: tegra - do not transfer req when tegra init fails
- crypto: api - Fix boot-up self-test race
- pinctrl: nomadik: Add check for clk_enable()
- rhashtable: Fix potential deadlock by moving schedule_work outside lock
- crypto: iaa - Fix IAA disabling that occurs when sync_mode is set to
'async'
- bpf: Use refcount_t instead of atomic_t for mmap_count
- bpf: Reject struct_ops registration that uses module ptr and the module
btf_id is missing
- perf maps: Fix display of kernel symbols
- ASoC: Intel: avs: Fix the minimum firmware version numbers
- ASoC: Intel: avs: Fix init-config parsing
- perf MANIFEST: Add arch/*/include/uapi/asm/bpf_perf_event.h to the perf
tarball
- ALSA: hda: Fix compilation of snd_hdac_adsp_xxx() helpers
- ASoC: Intel: sof_sdw: Fix DMI match for Lenovo 83LC
- ASoC: Intel: sof_sdw: Fix DMI match for Lenovo 83JX, 83MC and 83NM
- selftests/bpf: Fix btf leak on new btf alloc failure in btf_distill test
- libbpf: Fix return zero when elf_begin failed
- libbpf: Fix incorrect traversal end type ID when marking BTF_IS_EMBEDDED
- iommu/amd: Remove unused amd_iommu_domain_update()
- tools: Sync if_xdp.h uapi tooling header
- rhashtable: Fix rhashtable_try_insert test
- bpf: Cancel the running bpf_timer through kworker for PREEMPT_RT
- ARM: dts: imx7-tqma7: add missing vs-supply for LM75A (rev. 01xxx)
- ARM: dts: stm32: Increase CPU core voltage on STM32MP13xx DHCOR SoM
- arm64: dts: renesas: rzg3s-smarc: Fix the debug serial alias
- arm64: dts: medaitek: mt8395-nio-12l: Drop regulator-compatible property
- arm64: dts: mediatek: mt8395-genio-1200-evk: Drop regulator-compatible
property
- arm64: defconfig: remove obsolete CONFIG_SM_DISPCC_8650
- arm64: dts: qcom: sm8550: correct sleep clock frequency
- arm64: dts: qcom: sm8650: correct sleep clock frequency
- arm64: dts: qcom: x1e80100: correct sleep clock frequency
- arm64: dts: qcom: sm8650: Fix CDSP context banks unit addresses
- ARM: dts: microchip: sama5d29_curiosity: Add no-1-8-v property to sdmmc0
node
- arm64: dts: rockchip: Fix sdmmc access on rk3308-rock-s0 v1.1 boards
- RDMA/hns: Clean up the legacy CONFIG_INFINIBAND_HNS
- [Config] updateconfigs for CONFIG_INFINIBAND_HNS{_HIP08}
- arm64: dts: qcom: qcm6490-shift-otter: remove invalid orientation-switch
- firmware: qcom: scm: Cleanup global '__scm' on probe failures
- arm64: dts: mediatek: mt7988: Add missing clock-div property for i2c
- arm64: dts: marvell: cn9131-cf-solidwan: fix cp1 comphy links
- arm64: dts: rockchip: fix num-channels property of wolfvision pf5 mic
- arm64: dts: ti: k3-am642-hummingboard-t: Convert overlay to board dts
- of: property: Avoiding using uninitialized variable @imaplen in
parse_interrupt_map()
- RDMA/cxgb4: Notify rdma stack for IB_EVENT_QP_LAST_WQE_REACHED event
- iommu: iommufd: fix WARNING in iommufd_device_unbind
- iommufd/iova_bitmap: Fix shift-out-of-bounds in
iova_bitmap_offset_to_index()
- of: reserved_mem: Restructure how the reserved memory regions are
processed
- of/fdt: Restore possibility to use both ACPI and FDT from bootloader
- remoteproc: mtk_scp: Only populate devices for SCP cores
- PCI: imx6: Deassert apps_reset in imx_pcie_deassert_core_reset()
- PCI: dwc: Always stop link in the dw_pcie_suspend_noirq
- PCI: microchip: Add support for using either Root Port 1 or 2
- PCI: microchip: Set inbound address translation for coherent or
non-coherent
mode
- scsi: mpi3mr: Fix possible crash when setting up bsg fails
- firewire: test: Fix potential null dereference in firewire kunit test
- erofs: get rid of erofs_{find,insert}_workgroup
- erofs: move erofs_workgroup operations into zdata.c
- module: Don't fail module loading when setting ro_after_init section RO
failed
- tty: mips_ejtag_fdc: fix one more u8 warning
- xfrm: Add support for per cpu xfrm state handling.
- xfrm: Cache used outbound xfrm states at the policy.
- xfrm: Add an inbound percpu state cache.
- xfrm: state: fix out-of-bounds read during lookup
- rtc: tps6594: Fix integer overflow on 32bit systems
- net: airoha: Fix wrong GDM4 register definition
- net: phy: marvell-88q2xxx: Fix temperature measurement with reset-gpios
- xfrm: Don't disable preemption while looking up cache state.
- idpf: add read memory barrier when checking descriptor done bit
- idpf: Acquire the lock before accessing the xn->salt
- idpf: convert workqueues to unbound
- ice: rework of dump serdes equalizer values feature
- ice: extend dump serdes equalizer values feature
- ice: remove invalid parameter of equalizer
- s390/mm: Allow large pages for KASAN shadow mapping
- net/ncsi: use dev_set_mac_address() for Get MC MAC Address handling
- tools: ynl: c: correct reverse decode of empty attrs
- selftests: mptcp: extend CFLAGS to keep options from environment
- selftests: net/{lib,openvswitch}: extend CFLAGS to keep options from
environment
- rxrpc, afs: Fix peer hash locking vs RCU callback
- net: ethtool: only allow set_rxnfc with rss + ring_cookie if driver opts
in
- ethtool: Fix set RXNFC command with symmetric RSS hash
- s390/sclp: Initialize sclp subsystem via arch_cpu_finalize_init()
- [Config] updateconfigs for ARCH_HAS_CPU_FINALIZE_INIT
- Bluetooth: btusb: mediatek: Add locks for usb_driver_claim_interface()
- net: ravb: Fix missing rtnl lock in suspend/resume path
- hostfs: fix string handling in __dentry_name()
- tools/power turbostat: Allow using cpu device in perf counters on hybrid
platforms
- tools/power turbostat: Fix PMT mmaped file size rounding
- tools/power turbostat: Fix forked child affinity regression
- md: add a new callback pers->bitmap_sector()
- md/raid5: implement pers->bitmap_sector()
- drm/amd/display: Reduce accessing remote DPCD overhead
- xfs: check for dead buffers in xfs_buf_find_insert
- xfs: don't shut down the filesystem for media failures beyond end of log
- usb: dwc3: Skip resume if pm_runtime_set_active() fails
- clk: qcom: gcc-x1e80100: Do not turn off usb_2 controller GDSC
- mptcp: pm: only set fullmesh for subflow endp
- powerpc/pseries/iommu: Don't unset window if it was never set
- of: reserved-memory: Warn for missing static reserved memory regions
- dma-mapping: save base/size instead of pointer to shared DMA pool
- xfrm: Add error handling when nla_put_u32() returns an error
- xfrm: Fix acquire state insertion.
- ethtool: Fix access to uninitialized fields in set RXNFC command
- Revert "s390/mm: Allow large pages for KASAN shadow mapping"
- ASoC: da7213: Initialize the mutex
- drm/amd/display: Add hubp cache reset when powergating
- KVM: x86: Plumb in the vCPU to kvm_x86_ops.hwapic_isr_update()
- memcg: fix soft lockup in the OOM process
- ethtool: ntuple: fix rss + ring_cookie check
- Upstream stable to v6.6.76, v6.12.13
* log_check/kernel_tainted failed with kernel warnings at
kernel/time/timer_migration.c:543 on Oracular (LP: #2106022)
- timers/migration: Fix off-by-one root mis-connection
-- Mehmet Basaran <mehmet.basa...@canonical.com> Sat, 12 Apr 2025
12:10:29 +0300
** Changed in: linux (Ubuntu Oracular)
Status: Fix Committed => Fix Released
--
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/2104210
Title:
uprobe-related panics during profiling
Status in linux package in Ubuntu:
Invalid
Status in linux source package in Noble:
Fix Released
Status in linux source package in Oracular:
Fix Released
Bug description:
[Impact]
On systems that utilize both uprobes and perf_events style profiling, it
is possible to hit a panic in the uprobe_free_utask code. This occurs
during process exit. If the profiler fires while uprobe_free_utask is
in the process of cleaning up the utask, the NMI may read freed memory
because the cleanup code frees the utask before setting its pointer to
NULL. This submitter has encountered the problem on systems running
workloads without intentionally trying to trigger the problem.
The stacks look something like this:
RIP: 0010:is_uprobe_at_func_entry+0x28/0x80
...
? die_addr+0x36/0x90
? exc_general_protection+0x217/0x420
? asm_exc_general_protection+0x26/0x30
? is_uprobe_at_func_entry+0x28/0x80
perf_callchain_user+0x20a/0x360
get_perf_callchain+0x147/0x1d0
bpf_get_stackid+0x60/0x90
bpf_prog_9aac297fb833e2f5_do_perf_event+0x434/0x53b
? __smp_call_single_queue+0xad/0x120
bpf_overflow_handler+0x75/0x110
...
asm_sysvec_apic_timer_interrupt+0x1a/0x20
RIP: 0010:__kmem_cache_free+0x1cb/0x350
...
? uprobe_free_utask+0x62/0x80
? acct_collect+0x4c/0x220
uprobe_free_utask+0x62/0x80
mm_release+0x12/0xb0
do_exit+0x26b/0xaa0
__x64_sys_exit+0x1b/0x20
do_syscall_64+0x5a/0x80
The person who reported the issue upstream provided this reproducer.
(Run each command in a separate terminal):
# while :; do bpftrace -e 'uprobe:/bin/ls:_start { printf("hit\n"); }' -c
ls; done
# bpftrace -e 'profile:hz:100000 { @[ustack()] = count(); }'
However, since the binutils are stripped on some of the releases where I
tested this, I ran the following instead:
# while :; do bpftrace -e 'uprobe:libc:malloc { printf("hit\n"); }' -c ls;
done
# bpftrace -e 'profile:hz:100000 { @[ustack()] = count(); }'
[Backport]
The fix is upstream as commit b583ef82b671 ("uprobes: Fix race in
uprobe_free_utask")
However this patch was massaged by stable for its inclusion in 6.12,
6.6, and 6.1. Instead of re-doing stable's conflict resolution, take
the patch directly from 6.6.x instead, at commit eff00c5e29ab.
This patch is in stable as of 6.12.19, 6.6.83, and 6.1.131.
[Test]
I've run the provided reproducer and validated that I can reproduce the
problem without the patch applied and that I cannot reproduce it again
once I have applied the patch.
[Potential Regression]
The regression potential here seems quite low. The fix has been
upstream for a couple releases and no subsequent issues have been
reported. It makes no functional change beyond ensuring that the utask
pointer is set to NULL before the utask structure itself is freed. The
dereference and free occur on the same cpu.
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2104210/+subscriptions
--
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help : https://help.launchpad.net/ListHelp
