Linux Kernel

2 commits in this release:

• Linux 6.12.98
• ext4: fix fd leak in EXT4_IOC_MOVE_EXT cross-sb validation

The 120 most recent commits in this release — the full changelog is longer:

• Linux 7.1.5
• Revert "gpib: cb7210: Fix region leak when request_irq fails"
• posix-cpu-timers: Prevent UAF caused by non-leader exec() race
• posix-timers: Expand timer_[re]arm() callbacks with a boolean return value
• drm/amd/display: Fix Color Manager (3DLUT, Shaper, Blend)
• iomap: consolidate bio submission
• exfat: fix implicit declaration of brelse()
• exfat: add data_start_bytes and exfat_cluster_to_phys_bytes() helper
• exfat: add balloc parameter to exfat_map_cluster() for iomap support
• exfat: replace unsafe macros with static inline functions
• crypto: xilinx-trng - Remove crypto_rng interface
• liveupdate: validate session type before performing operation
• usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect()
• usb: atm: ueagle-atm: remove function entry/exit debug messages
• usb: atm: ueagle-atm: use dev_dbg() for 'device found' message
• xfs: add newly added RTGs to the free pool in growfs
• xfs: factor out a xfs_zone_mark_free helper
• ksmbd: use opener credentials for FSCTL mutations
• smb: move compression definitions into common/fscc.h
• ksmbd: fix path resolution in ksmbd_vfs_kern_path_create
• Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()
• Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister
• binder: cache secctx size before release zeroes it
• binder: Use LIST_HEAD() to initialize on stack list head
• ALSA: hda/tas2781: Cancel async firmware request at unbind
• firmware_loader: Add cancel helper for async requests
• ALSA: scarlett2: Update offsets for 2i2 Gen 4 firmware 2417
• ALSA: scarlett2: Allow selecting config_set by firmware version
• iio: hid-sensor-rotation: Fix stale or zero output when reading raw values
• f2fs: fix listxattr handling of corrupted xattr entries
• f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs()
• f2fs: fix potential deadlock in f2fs_balance_fs()
• device property: initialize the remaining fields of fwnode_handle in fwnode_init()
• samples/damon/mtier: fail early if address range parameters are invalid
• mm/damon/core: trace esz at first setup
• bpf: Reject negative const offsets for buffer pointers
• mmc: sdhci-esdhc-imx: fix resume error handling
• mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend
• mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend
• mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt
• mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore
• mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume
• mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore
• mmc: sdhci-of-dwcmshc: check bus clock enable result in the probe() method
• mmc: mmc_test: Fix __counted_by handling after kzalloc_flex() conversion
• mmc: block: fix RPMB device unregister ordering
• mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout
• mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout
• mtd: rawnand: fsl_ifc: return errors for failed page reads
• mmc: vub300: defer reset until cmd_mutex is unlocked
• mtd: mchp23k256: use SPI match data for chip caps
• mtd: onenand: samsung: report DMA completion timeouts
• mtd: virt-concat: free duplicate generated name
• wifi: mwifiex: fix permanently busy scans after multiple roam iterations
• wifi: mac80211: validate extension-frame layout before RX
• wifi: mac80211: free ack status frame on TX header build failure
• wifi: ieee80211: validate MLE common info length
• wifi: cfg80211: validate EHT MLE before MLD ID read
• powerpc/uaccess: correct check for CONFIG_PPC_E500 in mask_user_address()
• powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access()
• reset: sunxi: fix memory region leak on ioremap failure
• reset: imx7: Correct polarity of MIPI CSI resets on i.MX8MQ
• ipvs: reload ip header after head reallocation
• ipvs: fix more places with wrong ipv6 transport offsets
• memstick: ms_block: reject a card that reports too many blocks
• macsec: fix promiscuity refcount leak in macsec_dev_open()
• llc: fix SAP refcount leak when creating incoming sockets
• crypto: aes - Fix conditions for selecting MAC dependencies
• Bluetooth: btrtl: validate firmware patch bounds
• net: openvswitch: reject oversized nested action attrs
• regulator: ltc3676: Fix incorrect IRQSTAT bit offsets
• arch/riscv: vdso: remove CFI landing pad from rt_sigreturn
• riscv: vdso: Do not use LTO for the vDSO
• wifi: brcmfmac: cyw: fix heap overflow on a short auth frame
• wifi: mac80211: fix memory leak in ieee80211_register_hw()
• wifi: mwifiex: fix roaming to different channel in host_mlme mode
• wifi: rt2x00: avoid full teardown before work setup in probe
• net/mlx5: free mlx5_st_idx_data on final dealloc
• powerpc/pseries: fix memory leak on krealloc failure in papr_init
• mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume
• selftests/landlock: Fix screwed up pointers in the scoped_signal_test
• selftests/landlock: Skip scoped_signal subtest with MSG_OOB if not available
• pmdomain: imx: Fix i.MX8MP VC8000E power up sequence
• pmdomain: imx: Fix i.MX8MP power notifier
• pmdomain: mediatek: Fix possible nullptr KP in HWV cleanup/on-check
• pmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI
• cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed
• selftests/rseq: Fix a building error for riscv arch
• s390/mm: Fix type mismatch in get_align_mask().
• s390/diag: Add missing array_index_nospec() call to memtop_get_page_count()
• tracing/osnoise: Call synchronize_rcu() when unregistering
• riscv: Prevent NULL pointer dereference in machine_kexec_prepare()
• drbd: reject data replies with an out-of-range payload size
• ata: libata-core: Allow capacity transition to zero for locked drives
• ata: libata-core: Skip HPA resize for locked drives
• fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list
• fs/resctrl: Free mon_data structures on rdt_get_tree() failure
• cpu/hotplug: Fix NULL kobject warning in cpuhp_smt_enable()
• arm64: smp: Fix hot-unplug tearing by forcing unregistration
• amdkfd: properly free secondary context id
• net: macb: drop in-flight Tx SKBs on close
• dibs: loopback: validate offset and size in move_data()
• macsec: don't read an unset MAC header in macsec_encrypt()
• ipvs: reset full ip_vs_seq structs in ip_vs_conn_new
• ipvs: use parsed transport offset in SCTP state lookup
• llc: fix SAP refcount leak in llc_ui_autobind()
• selftests: net: make busywait timeout clock portable
• octeontx2-pf: fix SQB pointer leak on init failure
• mac802154: remove interfaces with RCU list deletion
• s390/monwriter: Reject buffer reuse with different data length
• irqchip/irq-riscv-imsic-early: Fix fwnode leak on state setup failure
• mm/compaction: handle free_pages_prepare() properly in compaction_free()
• riscv: probes: save original sp in rethook trampoline
• hwmon: (asus_atk0110) Check package count before accessing element
• net: ipa: fix SMEM state handle leaks in SMP2P init
• net: wwan: iosm: bound device offsets in the MUX downlink decoder
• ata: libata-core: Reject an invalid concurrent positioning ranges count
• ata: pata_pxa: Fix DMA channel leak on probe error
• ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD
• net/mlx5: HWS, fix matcher leak on resize target setup failure

The 120 most recent commits in this release — the full changelog is longer:

• Linux 5.10.261
• tools/resolve_btfids: Emit warnings and patch zero id for missing symbols
• tools/resolve_btfids: Fix some error messages
• perf/x86/amd/core: Always use the NMI latency mitigation
• mld: fix suspicious RCU usage in __ipv6_dev_mc_dec()
• ipv6: mcast: remove one synchronize_net() barrier in ipv6_mc_down()
• ipv6: mcast: fix data-race in ipv6_mc_down / mld_ifc_work
• net: mld: fix reference count leak in mld_{query | report}_work()
• ipv6: fix lockdep splat in in6_dump_addrs()
• ipv6: mcast: use rcu-safe version of ipv6_get_lladdr()
• net: ethernet: rmnet: Always subtract MAP header
• ipv6: mcast: Delay put pmc->idev in mld_del_delrec()
• mld: change lockdep annotation for ip6_sf_socklist and ipv6_mc_socklist
• iio: imu: inv_icm42600: fix timestamp clock period by using lower value
• iio: invensense: fix odr switching to same value
• iio: imu: inv_mpu6050: fix frequency setting when chip is off
• Bluetooth: L2CAP: Fix regressions caused by reusing ident
• KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers
• posix-cpu-timers: Use u64 multiplication in update_rlimit_cpu()
• audit: fix potential integer overflow in audit_log_n_hex()
• audit: add audit_log_nf_skb helper function
• crypto: qat - validate RSA CRT component lengths
• crypto: qat - fix restarting state leak on allocation failure
• btrfs: do not trim a device which is not writeable
• usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile
• crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A
• crypto: atmel - Drop explicit initialization of struct i2c_device_id::driver_data to 0
• crypto: atmel-sha204a - Mark OF related data as maybe unused
• usb: gadget: f_fs: initialize reset_work at allocation time
• usb: typec: tcpm: Fix VDM type for Enter Mode commands
• usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect()
• usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove
• gpio: pca953x: Make platform teardown callback return void
• leds: lm3601x: Improve error reporting for problems during .remove()
• leds: lm3697: Remove duplicated error reporting in .remove()
• drm/i2c/sil164: Drop no-op remove function
• USB: serial: digi_acceleport: fix write buffer corruption
• usb: iowarrior: remove inherent race with minor number
• usb: free iso schedules on failed submit
• usb: gadget: f_printer: take kref only for successful open
• usb: gadget: function: Simplify diagnostic messaging in printer
• hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length
• hfs/hfsplus: prevent getting negative values of offset/length
• xfs: use null daddr for unset first bad log block
• xfs: fix unreachable BIGTIME check in dquot flush validation
• xfs: reflect sb features in xfs_mount
• serial: 8250_mid: Disable DMA for selected platforms
• serial: 8250_mid: Remove 8250_pci usage
• HID: appleir: fix UAF on pending key_up_timer in remove()
• proc: protect ptrace_may_access() with exec_update_lock (part 1)
• cpufreq: intel_pstate: Sync policy->cur during CPU offline
• HID: multitouch: fix out-of-bounds bit access on mt_io_flags
• HID: add haptics page defines
• proc: protect ptrace_may_access() with exec_update_lock (FD links)
• proc: rename proc_setattr to proc_nochmod_setattr
• proc: use generic setattr() for /proc/$PID/net
• X.509: Fix validation of ASN.1 certificate header
• writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs()
• smb: client: harden POSIX SID length parsing
• smb: client: use unaligned reads in parse_posix_ctxt()
• smb: client: mask server-provided mode to 07777 in modefromsid
• smb: client: Fix next buffer leak in receive_encrypted_standard()
• Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock
• Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del()
• Bluetooth: L2CAP: Fix not tracking outstanding TX ident
• netfilter: ebtables: zero chainstack array
• netfilter: ebtables: Use vmalloc_array() to improve code
• coresight: etb10: restore atomic_t for shared reading state
• PCI: Skip Resizable BAR restore on read error
• PCI: Move Resizable BAR code to rebar.c
• PCI: Add kerneldoc for pci_resize_resource()
• PCI: Fix restoring BARs on BAR resize rollback path
• PCI: Free saved list without holding pci_bus_sem
• PCI: Prevent resource tree corruption when BAR resize fails
• crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()
• staging: rtl8723bs: remove DBG_871X log argument
• PCI: mediatek: Fix IRQ domain leak when port fails to enable
• PCI: mediatek: Convert bool to single quirks entry and bitmap
• PCI: controller: Use dev_fwnode() instead of of_fwnode_handle()
• staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl()
• staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie()
• staging: rtl8723bs: Fix space issues
• staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()
• staging: rtl8723bs: clean up comparsions to NULL
• staging: rtl8723bs: remove commented out condition
• staging: rtl8723bs: remove 5Ghz code blocks
• staging: rtl8723bs: remove 5Ghz code related to channel plan definition
• staging: rtl8723bs: remove all 5Ghz network types
• staging: rtl8723bs: remove commented out RT_ASSERT occurrences
• staging: rtl8723bs: split too long line
• PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling
• smb: client: restrict implied bcc[0] exemption to responses without data area
• cifs: remove unused server parameter from calc_smb_size()
• smb2: small refactor in smb2_check_message()
• cifs: remove check of list iterator against head past the loop body
• cifs: Create a new shared file holding smb2 pdu definitions
• staging: media: atomisp: reduce load_primary_binaries() stack usage
• media: staging: media: atomisp: Fix alignment and line length issues
• media: staging: media: atomisp: Replace if else clause with a ternary
• media: staging: media: atomisp: Fix the rest of sh_css.c brace issues
• media: staging: media: atomisp: Fix sh_css.c brace coding style issues
• media: atomisp: replace boolean comparison of values with bool variables
• PCI: altera: Fix resource leaks on probe failure
• binder: fix UAF in binder_free_transaction()
• vfio/pci: Release the VGA arbiter client on register_device() failure
• Bluetooth: btusb: fix wakeup source leak on probe failure
• Bluetooth: btusb: fix use-after-free on marvell probe failure
• Bluetooth: btintel: Check firmware version before download
• Bluetooth: btintel: Fix offset calculation boot address parameter
• ALSA: aoa: check snd_ctl_new1() return value
• iio: common: st_sensors: honour channel endianness in read_axis_data
• bitops: make BYTES_TO_BITS() treewide-available
• iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading
• iio: imu: inv_icm42600: stabilized timestamp in interrupt
• iio: invensense: fix timestamp glitches when switching frequency
• iio: invensense: remove redundant initialization of variable period
• iio: imu: inv_mpu6050: use the common inv_sensors timestamp module
• iio: make invensense timestamp module generic
• iio: move inv_icm42600 timestamp module in common
• iio: imu: inv_icm42600: make timestamp module chip independent

The 120 most recent commits in this release — the full changelog is longer:

• Linux 5.15.212
• perf/x86/amd/core: Always use the NMI latency mitigation
• ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup()
• iio: imu: inv_icm42600: fix timestamp clock period by using lower value
• ALSA: seq: Check UMP support for midi_version change
• ALSA: seq: Skip event type filtering for UMP events
• iio: invensense: fix odr switching to same value
• iio: imu: inv_mpu6050: fix frequency setting when chip is off
• ALSA: seq: Avoid confusion of aligned read size
• Bluetooth: L2CAP: Fix regressions caused by reusing ident
• KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers
• posix-cpu-timers: Use u64 multiplication in update_rlimit_cpu()
• regulator: scmi: fix of_node refcount leak in scmi_regulator_probe()
• audit: fix potential integer overflow in audit_log_n_hex()
• audit: add audit_log_nf_skb helper function
• btrfs: fix incorrect buffered IO fallback for append direct writes
• crypto: qat - validate RSA CRT component lengths
• btrfs: fix false IO failure after falling back to buffered write
• crypto: qat - fix restarting state leak on allocation failure
• btrfs: do not trim a device which is not writeable
• usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile
• crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A
• crypto: atmel - Drop explicit initialization of struct i2c_device_id::driver_data to 0
• crypto: atmel-sha204a - Mark OF related data as maybe unused
• usb: gadget: f_fs: initialize reset_work at allocation time
• usb: typec: tcpm: Fix VDM type for Enter Mode commands
• usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect()
• usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove
• gpio: pca953x: Make platform teardown callback return void
• leds: lm3601x: Improve error reporting for problems during .remove()
• leds: lm3697: Remove duplicated error reporting in .remove()
• drm/i2c/sil164: Drop no-op remove function
• usb: iowarrior: remove inherent race with minor number
• bpf: Allow LPM map access from sleepable BPF programs
• bpf: Consistently use bpf_rcu_lock_held() everywhere
• bpf: Convert lpm_trie.c to rqspinlock
• bpf: Reject fragmented frames in devmap
• xdp: introduce flags field in xdp_buff/xdp_frame
• hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length
• hfs/hfsplus: prevent getting negative values of offset/length
• xfs: use null daddr for unset first bad log block
• xfs: Remove dead code
• xfs: Remove redundant assignment of mp
• serial: 8250_mid: Disable DMA for selected platforms
• serial: 8250_mid: Remove 8250_pci usage
• HID: appleir: fix UAF on pending key_up_timer in remove()
• treewide: Switch/rename to timer_delete_sync
• proc: protect ptrace_may_access() with exec_update_lock (part 1)
• HID: multitouch: fix out-of-bounds bit access on mt_io_flags
• HID: add haptics page defines
• proc: protect ptrace_may_access() with exec_update_lock (FD links)
• proc: rename proc_setattr to proc_nochmod_setattr
• proc: Move fdinfo PTRACE_MODE_READ check into the inode .permission operation
• proc: use generic setattr() for /proc/$PID/net
• X.509: Fix validation of ASN.1 certificate header
• ksmbd: track the connection owning a byte-range lock
• ksmbd: centralize ksmbd_conn final release to plug transport leak
• ksmbd: destroy async_ida in ksmbd_conn_free()
• ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc
• ksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger
• smb: client: harden POSIX SID length parsing
• smb: client: use unaligned reads in parse_posix_ctxt()
• smb: client: mask server-provided mode to 07777 in modefromsid
• smb: client: resolve SWN tcon from live registrations
• cifs: Add tracing for the cifs_tcon struct refcounting
• smb: client: Fix next buffer leak in receive_encrypted_standard()
• Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock
• Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del()
• Bluetooth: L2CAP: Fix not tracking outstanding TX ident
• netfilter: ebtables: zero chainstack array
• netfilter: ebtables: Use vmalloc_array() to improve code
• gpio: sch: use raw_spinlock_t in the irq startup path
• gpio: sch: use new GPIO line value setter callbacks
• coresight: etb10: restore atomic_t for shared reading state
• PCI: Skip Resizable BAR restore on read error
• PCI: Move Resizable BAR code to rebar.c
• PCI: Add kerneldoc for pci_resize_resource()
• PCI: Fix restoring BARs on BAR resize rollback path
• PCI: Free saved list without holding pci_bus_sem
• PCI: Prevent resource tree corruption when BAR resize fails
• crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()
• staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr()
• staging: rtl8723bs: fix spaces around binary operators
• staging: rtl8723bs: core: move constants to right side in comparison
• staging: rtl8723bs: remove redundant braces in if statements
• staging: rtl8723bs: Remove redundant else branches.
• PCI: mediatek: Fix IRQ domain leak when port fails to enable
• PCI: mediatek: Convert bool to single quirks entry and bitmap
• PCI: controller: Use dev_fwnode() instead of of_fwnode_handle()
• staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie()
• staging: rtl8723bs: Fix space issues
• staging: rtl8723bs: Fix indentation issues
• PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling
• smb: client: restrict implied bcc[0] exemption to responses without data area
• cifs: remove unused server parameter from calc_smb_size()
• smb2: small refactor in smb2_check_message()
• cifs: remove check of list iterator against head past the loop body
• cifs: Create a new shared file holding smb2 pdu definitions
• PCI: altera: Fix resource leaks on probe failure
• vfio/pci: Release the VGA arbiter client on register_device() failure
• ALSA: aoa: check snd_ctl_new1() return value
• iio: common: st_sensors: honour channel endianness in read_axis_data
• bitops: make BYTES_TO_BITS() treewide-available
• iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading
• iio: imu: inv_icm42600: stabilized timestamp in interrupt
• iio: invensense: fix timestamp glitches when switching frequency
• iio: invensense: remove redundant initialization of variable period
• iio: imu: inv_mpu6050: use the common inv_sensors timestamp module
• iio: make invensense timestamp module generic
• iio: move inv_icm42600 timestamp module in common
• iio: imu: inv_icm42600: make timestamp module chip independent
• iio: hid-sensor-rotation: Fix stale or zero output when reading raw values
• iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ
• ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup
• ACPI: CPPC: Suppress UBSAN warning caused by field misuse
• mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout
• mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout
• mtd: rawnand: fsl_ifc: return errors for failed page reads
• mmc: vub300: defer reset until cmd_mutex is unlocked
• mt

The 118 most recent commits in this release — the full changelog is longer:

• Linux 6.18.40
• RDMA/bnxt_re: Avoid repeated requests to allocate WC pages
• RDMA/bnxt_re: Initialize dpi variable to zero
• ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd
• perf callchain: Handle multiple address spaces
• seqlock: fix scoped_seqlock_read kernel-doc
• perf inject: With --convert-callchain ignore the dummy event for dwarf stacks
• PCI: Fix Resizable BAR restore order
• PCI: Fix BAR resize rollback path overwriting ret
• perf symbol: Fix ENOENT case for filename__read_build_id
• pinctrl: airoha: fix pinctrl function mismatch issue
• bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized
• iommufd: Move vevent memory allocation outside spinlock
• iommufd: Propagate allocation failure in iommufd_veventq_deliver_fetch()
• KVM: arm64: nv: Re-translate VNCR before injecting abort
• KVM: arm64: Deduplicate ASID retrieval code
• samples/damon/mtier: fail early if address range parameters are invalid
• mm/damon/core: trace esz at first setup
• mm/damon/core: always put unsuccessfully committed target pids
• KVM: arm64: Fix propagation of TLBI level in kvm_pgtable_stage2_relax_perms()
• KVM: arm64: Ensure level is always initialized when relaxing perms
• btrfs: fix incorrect buffered IO fallback for append direct writes
• btrfs: fix false IO failure after falling back to buffered write
• crypto: qat - fix restarting state leak on allocation failure
• btrfs: remove folio parameter from ordered io related functions
• btrfs: replace for_each_set_bit() with for_each_set_bitmap()
• btrfs: concentrate the error handling of submit_one_sector()
• crypto: atmel-sha204a - fail on hwrng registration error in probe path
• usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile
• usb: gadget: f_fs: initialize reset_work at allocation time
• functionfs: use spinlock for FFS_DEACTIVATED/FFS_CLOSING transitions
• functionfs: switch to simple_remove_by_name()
• functionfs: don't bother with ffs->ref in ffs_data_{opened,closed}()
• functionfs: don't abuse ffs_data_closed() on fs shutdown
• new helper: simple_remove_by_name()
• usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect()
• usb: atm: ueagle-atm: remove function entry/exit debug messages
• usb: atm: ueagle-atm: use dev_dbg() for 'device found' message
• usb: dwc3: fix dwc3_readl() and dwc3_writel() calls in dwc3_ulpi_setup()
• usb: dwc3: Support USB3340x ULPI PHY high-speed negotiation.
• xfs: use bio_reuse in the zone GC code
• xfs: only log freed extents for the current RTG in zoned growfs
• xfs: add a xfs_groups_to_rfsbs helper
• bpf: Allow LPM map access from sleepable BPF programs
• bpf: Consistently use bpf_rcu_lock_held() everywhere
• bpf: Keep dynamic inner array lookups nullable
• bpf: Introduce struct bpf_map_desc in verifier
• bpf: Consistently use reg_state() for register access in the verifier
• xfs: initialize iomap->flags earlier in xfs_bmbt_to_iomap
• hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length
• hfs/hfsplus: prevent getting negative values of offset/length
• proc: protect ptrace_may_access() with exec_update_lock (part 1)
• seqlock: Change do_task_stat() to use scoped_seqlock_read()
• seqlock: Introduce scoped_seqlock_read()
• proc: protect ptrace_may_access() with exec_update_lock (FD links)
• proc: rename proc_setattr to proc_nochmod_setattr
• ksmbd: validate NTLMv2 response before updating session key
• ksmbd: Use HMAC-MD5 library for NTLMv2
• ksmbd: Use HMAC-SHA256 library for message signing and key generation
• ksmbd: Use SHA-512 library for SMB3.1.1 preauth hash
• ksmbd: track the connection owning a byte-range lock
• ksmbd: centralize ksmbd_conn final release to plug transport leak
• ksmbd: fix path resolution in ksmbd_vfs_kern_path_create
• ksmbd: use opener credentials for FSCTL mutations
• cifs: SMB1 split: Add some #includes
• cifs: SMB1 split: Rename cifstransport.c
• Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()
• Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister
• media: nxp: imx8-isi: Fix use-after-free on remove
• media: nxp: imx8-isi: use devm_pm_runtime_enable() to simplify code
• crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()
• staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr()
• staging: rtl8723bs: fix spaces around binary operators
• staging: rtl8723bs: core: move constants to right side in comparison
• PCI: Skip Resizable BAR restore on read error
• PCI: Move Resizable BAR code to rebar.c
• PCI: Add kerneldoc for pci_resize_resource()
• PCI: Fix restoring BARs on BAR resize rollback path
• PCI: Free saved list without holding pci_bus_sem
• PCI: Try BAR resize even when no window was released
• PCI: Change pci_dev variable from 'bridge' to 'dev'
• PCI/IOV: Adjust ->barsz[] when changing BAR size
• PCI: imx6: Configure REF_USE_PAD before PHY reset for i.MX95
• PCI: imx6: Fix reference clock source selection for i.MX95
• binder: cache secctx size before release zeroes it
• binder: Use LIST_HEAD() to initialize on stack list head
• vfio/mlx5: Fix racy bitfields and tighten struct layout
• ALSA: hda/tas2781: Cancel async firmware request at unbind
• firmware_loader: Add cancel helper for async requests
• ALSA: scarlett2: Update offsets for 2i2 Gen 4 firmware 2417
• ALSA: scarlett2: Allow selecting config_set by firmware version
• iio: hid-sensor-rotation: Fix stale or zero output when reading raw values
• ACPI: NFIT: core: Fix possible deadlock and missing notifications
• ACPI: NFIT: core: Use devm_acpi_install_notify_handler()
• ACPI: bus: Introduce devm_acpi_install_notify_handler()
• ACPI: driver: Check ACPI_COMPANION() against NULL during probe
• ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup
• crypto: xilinx-trng - Remove crypto_rng interface
• mmc: sdhci-esdhc-imx: fix resume error handling
• mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend
• mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend
• mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt
• mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore
• mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume
• mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore
• mmc: sdhci-of-dwcmshc: check bus clock enable result in the probe() method
• mmc: block: fix RPMB device unregister ordering
• mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout
• mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout
• mtd: rawnand: fsl_ifc: return errors for failed page reads
• mmc: vub300: defer reset until cmd_mutex is unlocked
• mtd: mchp23k256: use SPI match data for chip caps
• mtd: onenand: samsung: report DMA completion timeouts
• wifi: mwifiex: fix permanently busy scans after multiple roam iterations
• wifi: mac80211: free ack status frame on TX header build failure
• wifi: ieee80211: validate MLE common info length
• wifi: cfg80211: validate EHT MLE before MLD ID read
• powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access()

The 113 most recent commits in this release — the full changelog is longer:

• Linux 6.1.178
• perf/x86/amd/core: Always use the NMI latency mitigation
• ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup()
• iio: imu: inv_icm42600: fix timestamp clock period by using lower value
• ALSA: seq: Check UMP support for midi_version change
• ALSA: seq: Skip event type filtering for UMP events
• bluetooth/hci: disallow setting handle bigger than HCI_CONN_HANDLE_MAX
• Bluetooth: Ignore too large handle values in BIG
• iio: invensense: fix odr switching to same value
• iio: imu: inv_mpu6050: fix frequency setting when chip is off
• virtio_ring: fix syncs DMA memory with different direction
• cifs: fix lock ordering while disabling multichannel
• tools/virtio: Add dma sync api for virtio test
• ALSA: seq: Avoid confusion of aligned read size
• driver core: Guard deferred probe timeout extension with delayed_work_pending()
• driver core: Fix missing jiffies conversion in deferred_probe_extend_timeout()
• jiffies: Cast to unsigned long in secs_to_jiffies() conversion
• jiffies: Define secs_to_jiffies()
• writeback: drop now-unnecessary rcu_barrier() in cgroup_writeback_umount()
• writeback: Fix use after free in inode_switch_wbs_work_fn()
• Bluetooth: L2CAP: fix tx ident leak for commands without a response
• Bluetooth: L2CAP: Fix regressions caused by reusing ident
• seqlock: fix scoped_seqlock_read kernel-doc
• KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers
• mm/damon/sysfs-schemes: fix dir put orders in access_pattern_add_dirs()
• mm/damon/core: make charge_addr_from aware of end-address exclusivity
• btrfs: fix incorrect buffered IO fallback for append direct writes
• btrfs: fix false IO failure after falling back to buffered write
• regulator: scmi: fix of_node refcount leak in scmi_regulator_probe()
• regulator: scmi: Simplify with scoped for each OF child loop
• audit: fix potential integer overflow in audit_log_n_hex()
• audit: add audit_log_nf_skb helper function
• crypto: qat - validate RSA CRT component lengths
• btrfs: check and set EXTENT_DELALLOC_NEW before clearing EXTENT_DELALLOC
• crypto: qat - fix restarting state leak on allocation failure
• usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile
• nvmet: remove superfluous initialization
• crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A
• crypto: atmel - Drop explicit initialization of struct i2c_device_id::driver_data to 0
• crypto: atmel-sha204a - Mark OF related data as maybe unused
• usb: gadget: f_fs: initialize reset_work at allocation time
• usb: typec: tcpm: Fix VDM type for Enter Mode commands
• usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect()
• usb: iowarrior: remove inherent race with minor number
• bpf: Allow LPM map access from sleepable BPF programs
• bpf: Consistently use bpf_rcu_lock_held() everywhere
• hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length
• hfs/hfsplus: prevent getting negative values of offset/length
• serial: 8250_mid: Disable DMA for selected platforms
• serial: 8250_mid: Remove 8250_pci usage
• HID: appleir: fix UAF on pending key_up_timer in remove()
• treewide: Switch/rename to timer_delete_sync
• proc: protect ptrace_may_access() with exec_update_lock (part 1)
• seqlock: Change do_task_stat() to use scoped_seqlock_read()
• seqlock: Introduce scoped_seqlock_read()
• HID: multitouch: fix out-of-bounds bit access on mt_io_flags
• HID: add haptics page defines
• proc: protect ptrace_may_access() with exec_update_lock (FD links)
• proc: rename proc_setattr to proc_nochmod_setattr
• proc: Move fdinfo PTRACE_MODE_READ check into the inode .permission operation
• proc: use generic setattr() for /proc/$PID/net
• writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs()
• writeback: Avoid contention on wb->list_lock when switching inodes
• ksmbd: track the connection owning a byte-range lock
• ksmbd: centralize ksmbd_conn final release to plug transport leak
• ksmbd: destroy async_ida in ksmbd_conn_free()
• ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc
• ksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger
• smb: move smb_version_values to common/smbglob.h
• smb: move some duplicate definitions to common/cifsglob.h
• ksmbd: use opener credentials for FSCTL mutations
• smb: client: resolve SWN tcon from live registrations
• cifs: Add tracing for the cifs_tcon struct refcounting
• cifs: Fix reacquisition of volume cookie on still-live connection
• cifs: after disabling multichannel, mark tcon for reconnect
• cifs: handle when server stops supporting multichannel
• Bluetooth: hci_core: Enable buffer flow control for SCO/eSCO
• Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock
• Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del()
• Bluetooth: L2CAP: Fix not tracking outstanding TX ident
• Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()
• Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister
• Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect()
• Bluetooth: Remove BT_HS
• Bluetooth: Make handle of hci_conn be unique
• netfilter: ebtables: zero chainstack array
• netfilter: ebtables: Use vmalloc_array() to improve code
• mm: shrinker: fix NULL pointer dereference in debugfs
• mm: shrinkers: fix debugfs file permissions
• gpio: sch: use raw_spinlock_t in the irq startup path
• coresight: etb10: restore atomic_t for shared reading state
• mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show()
• mm: shrinker: remove redundant shrinker_rwsem in debugfs operations
• PCI: Skip Resizable BAR restore on read error
• PCI: Move Resizable BAR code to rebar.c
• PCI: Add kerneldoc for pci_resize_resource()
• PCI: Fix restoring BARs on BAR resize rollback path
• PCI: Free saved list without holding pci_bus_sem
• PCI: Prevent resource tree corruption when BAR resize fails
• crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()
• staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr()
• staging: rtl8723bs: fix spaces around binary operators
• staging: rtl8723bs: core: move constants to right side in comparison
• PCI: mediatek: Fix IRQ domain leak when port fails to enable
• PCI: mediatek: Use generic MACRO for TPVPERL delay
• PCI: mediatek: Convert bool to single quirks entry and bitmap
• PCI: controller: Use dev_fwnode() instead of of_fwnode_handle()
• staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie()
• staging: rtl8723bs: Fix space issues
• staging: rtl8723bs: Fix indentation issues
• PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling
• vfio/mlx5: Fix racy bitfields and tighten struct layout
• PCI: altera: Fix resource leaks on probe failure

The 110 most recent commits in this release — the full changelog is longer:

• Linux 6.6.145
• selftests/bpf: Add simple strscpy() implementation
• tools/testing: add linux/args.h header and fix radix, VMA tests
• driver core: Guard deferred probe timeout extension with delayed_work_pending()
• driver core: Fix missing jiffies conversion in deferred_probe_extend_timeout()
• jiffies: Cast to unsigned long in secs_to_jiffies() conversion
• jiffies: Define secs_to_jiffies()
• writeback: drop now-unnecessary rcu_barrier() in cgroup_writeback_umount()
• writeback: Fix use after free in inode_switch_wbs_work_fn()
• xfs: fix stupid compiler warning
• Bluetooth: btmtk: remove #ifdef around declarations
• Bluetooth: btmtk: Fix btmtk.c undefined reference build error harder
• selftests/hid: ensure CKI can compile our new tests on old kernels
• Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev
• Bluetooth: hci_sync: Fix attempting to send HCI_Disconnect to BIS handle
• Bluetooth: hci_core: Remove check of BDADDR_ANY in hci_conn_hash_lookup_big_state
• ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd
• seqlock: fix scoped_seqlock_read kernel-doc
• KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers
• Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()
• Bluetooth: hci_sync: annotate data-races around hdev->req_status
• Bluetooth: separate CIS_LINK and BIS_LINK link types
• Bluetooth: hci_core: Enable buffer flow control for SCO/eSCO
• btrfs: fix incorrect buffered IO fallback for append direct writes
• btrfs: fix false IO failure after falling back to buffered write
• exfat: preserve benign secondary entries during rename and move
• exfat: move exfat_chain_set() out of __exfat_resolve_path()
• exfat: add exfat_get_dentry_set_by_ei() helper
• exfat: rename argument name for exfat_move_file and exfat_rename_file
• exfat: remove unnecessary read entry in __exfat_rename()
• exfat: move free cluster out of exfat_init_ext_entry()
• mm: do file ownership checks with the proper mount idmap
• regulator: scmi: fix of_node refcount leak in scmi_regulator_probe()
• regulator: scmi: Simplify with scoped for each OF child loop
• audit: fix potential integer overflow in audit_log_n_hex()
• audit: add audit_log_nf_skb helper function
• crypto: qat - fix restarting state leak on allocation failure
• btrfs: check and set EXTENT_DELALLOC_NEW before clearing EXTENT_DELALLOC
• usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile
• nvmet-auth: validate reply message payload bounds against transfer length
• nvmet: return DHCHAP status codes from nvmet_setup_auth()
• nvmet: remove superfluous initialization
• usb: gadget: f_fs: initialize reset_work at allocation time
• crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A
• crypto: atmel - Drop explicit initialization of struct i2c_device_id::driver_data to 0
• usb: typec: tcpm: Fix VDM type for Enter Mode commands
• usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect()
• usb: iowarrior: remove inherent race with minor number
• bpf: Allow LPM map access from sleepable BPF programs
• bpf: Consistently use bpf_rcu_lock_held() everywhere
• hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length
• hfs/hfsplus: prevent getting negative values of offset/length
• serial: 8250_mid: Disable DMA for selected platforms
• serial: 8250_mid: Remove 8250_pci usage
• HID: appleir: fix UAF on pending key_up_timer in remove()
• treewide: Switch/rename to timer_delete_sync
• proc: protect ptrace_may_access() with exec_update_lock (part 1)
• seqlock: Change do_task_stat() to use scoped_seqlock_read()
• seqlock: Introduce scoped_seqlock_read()
• mm/slab: do not limit zeroing to orig_size when only red zoning is enabled
• HID: multitouch: fix out-of-bounds bit access on mt_io_flags
• HID: add haptics page defines
• perf/x86/intel/uncore: Defer ADL global PMON enable to enable_box()
• writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs()
• writeback: Avoid contention on wb->list_lock when switching inodes
• proc: protect ptrace_may_access() with exec_update_lock (FD links)
• proc: rename proc_setattr to proc_nochmod_setattr
• ksmbd: track the connection owning a byte-range lock
• ksmbd: centralize ksmbd_conn final release to plug transport leak
• ksmbd: use opener credentials for FSCTL mutations
• smb: client: resolve SWN tcon from live registrations
• smb: client: Improve unlocking of a mutex in cifs_get_swn_reg()
• Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()
• Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister
• Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock
• netfilter: ebtables: zero chainstack array
• netfilter: ebtables: Use vmalloc_array() to improve code
• media: nxp: imx8-isi: Fix use-after-free on remove
• media: nxp: imx8-isi: use devm_pm_runtime_enable() to simplify code
• media: nxp: imx8-isi: Convert to platform remove callback returning void
• gpio: sch: use raw_spinlock_t in the irq startup path
• coresight: etb10: restore atomic_t for shared reading state
• mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show()
• mm: shrinker: remove redundant shrinker_rwsem in debugfs operations
• Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref
• crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()
• staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr()
• staging: rtl8723bs: fix spaces around binary operators
• staging: rtl8723bs: core: move constants to right side in comparison
• PCI: Skip Resizable BAR restore on read error
• PCI: Move Resizable BAR code to rebar.c
• PCI: Add kerneldoc for pci_resize_resource()
• PCI: Fix restoring BARs on BAR resize rollback path
• PCI: Free saved list without holding pci_bus_sem
• PCI: Prevent resource tree corruption when BAR resize fails
• PCI: mediatek: Fix IRQ domain leak when port fails to enable
• PCI: mediatek: Use generic MACRO for TPVPERL delay
• PCI: mediatek: Convert bool to single quirks entry and bitmap
• PCI: controller: Use dev_fwnode() instead of of_fwnode_handle()
• PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling
• vfio/mlx5: Fix racy bitfields and tighten struct layout
• PCI: altera: Fix resource leaks on probe failure
• ALSA: aoa: check snd_ctl_new1() return value
• iio: common: st_sensors: honour channel endianness in read_axis_data
• bitops: make BYTES_TO_BITS() treewide-available
• iio: pressure: mpl115: fix runtime PM leak on read error
• iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading
• iio: imu: inv_icm42600: stabilized timestamp in interrupt
• iio: invensense: fix timestamp glitches when switching frequency
• iio: invensense: remove redundant initialization of variable period

43 commits in this release:

• Linux 7.0.14
• virtiofs: fix UAF on submount umount
• media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si
• ksmbd: reject non-VALID session in compound request branch
• drivers/base/memory: set mem->altmap after successful device registration
• serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails
• serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero
• vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write
• crypto: qat - remove unused character device and IOCTLs
• iio: adc: ti-ads1298: add bounds check to pga_settings index
• iio: light: veml6075: add bounds check to veml6075_it_ms index
• net: net_failover: Fix the deadlock in slave register
• net: export netif_open for self_test usage
• rose: don't free fd-owned sockets when reaping in the heartbeat
• rose: clear neighbour pointer in rose_kill_by_device()
• rose: cancel neighbour timers in rose_neigh_put() before freeing
• rose: drop CALL_REQUEST in loopback timer when device is not running
• rose: release netdev ref and destroy orphaned incoming sockets
• rose: fix netdev double-hold in rose_make_new()
• rose: disconnect orphaned STATE_2 sockets when device is gone
• rose: set SOCK_DESTROY in rose_kill_by_device() for prompt cleanup
• rose: fix notifier unregistered too early in rose_exit()
• rose: fix netdev double-hold in rose_rx_call_request()
• rose: guard rose_neigh_put() against NULL in timer expiry
• rose: clear neighbour pointer after rose_neigh_put() in state machines
• rose: fix race between loopback timer and module removal
• rose: hold loopback neighbour reference across timer callback
• rose: fix dev_put() leak in rose_loopback_timer()
• agp/amd64: Fix broken error propagation in agp_amd64_probe()
• net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink()
• i2c: stub: Reject I2C block transfers with invalid length
• bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths
• RDMA/bnxt_re: zero shared page before exposing to userspace
• Revert "NFSD: Defer sub-object cleanup in export put callbacks"
• fuse: re-lock request before replacing page cache folio
• firmware: samsung: acpm: Fix missing LKMM barriers in sequence allocator
• firmware: samsung: acpm: Fix false timeouts and Use-After-Free in polling
• firmware: samsung: acpm: Fix cross-thread RX length corruption
• firmware: exynos-acpm: Count acpm_xfer buffers with __counted_by_ptr
• firmware: exynos-acpm: Count number of commands in acpm_xfer
• lockd: fix TEST handling when not all permissions are available.
• arm64/entry: Fix arm64-specific rseq brokenness
• io_uring/net: Avoid msghdr on op_connect/op_bind async data