Linux Kernel 6.1.183

The 113 most recent commits in this release — the full changelog is longer:

• Linux 6.1.183
• hwmon: (nct6775) Fix non-existent ALARM warning
• hwmon: (nct6775) Fix register for nct6799
• regulator: devres: fix devm_regulator_get_enable_read_voltage() return
• bpf: tcp: fix double sock release on batch realloc
• thunderbolt: Bound the DROM dual link port number before indexing sw->ports
• sctp: clear new_transport when removing a peer
• sctp: fix use-after-free of cached ASCONF chunk
• sctp: keep chunk->transport in step with the list it is queued on
• scsi: scsi_debug: Negate wrapped memcmp() result
• bpf, sockmap: Fix sk_redir use-after-free in send verdict
• sched/psi: Shut down rtpoll_timer in psi_cgroup_free()
• ip6_tunnel: clear skb2->cb[] in ip6ip6_err()
• ipv6: fix Route Information option length validation
• ptp: ocp: Fix board ID over-read
• Revert "thermal/drivers/hwmon: Cleanup coding style a bit"
• KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page
• smb: client: Fix use-after-free in cifs_try_adding_channels()
• tipc: read le->link under the node lock in tipc_node_link_down()
• vhost: reset the vring metadata cache on vring reconfiguration
• vsock/virtio: avoid refilling the RX queue after teardown
• vsock/virtio: read virtqueues under worker locks
• vxlan: do not arm the ageing timer on a device that is down
• xdp: reject clones that overrun skb_shared_info tailroom
• net/sched: act_gact, act_police: range check the fallback control action
• net: atlantic: free RX pages of consumed but not refilled buffers
• net: atlantic: free stranded TX buffers on ring deinit
• netfilter: bridge: release template ct on non-IP path
• ipv6: prevent in6_dev_get() from resurrecting inet6_dev
• net: smc: fix splice entry lifetime imbalance in smc_rx_splice
• fbdev: bitblit: bound-check glyph index in bit_cursor()
• tracing: Fix race between update_event_fields and, event_define_fields
• ALSA: usx2y: bound the hwdep mmap fault offset
• ring-buffer: Fix crash passing ERR_PTR to kthread_stop()
• misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free
• misc: fastrpc: fix channel ctx ref leak when session alloc fails
• staging: rtl8723bs: validate monitor transmit frame lengths
• staging: rtl8723bs: fix missing shared-key auth challenge length check
• staging: rtl8723bs: fix OOB read in WMM_param_handler()
• staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie()
• serial: 8250_dma: Clear stale RX state on shutdown
• ipv4: fix use-after-free in fib_nhc_update_mtu()
• ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops
• selftests/bpf: Fail unbound UDP on sockmap update
• selftests/bpf: Adapt sockmap update error handling
• fscrypt: Replace mk_users keyring with simple list
• RDMA/rxe: Fix a use-after-free problem in rxe_mmap
• pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP
• fortify: Disable -Wstringop-overread in tests
• fortify: refactor test_fortify Makefile to fix some build problems
• futex: Prevent robust futex exit race some more
• net: bridge: mrp: fix uninitialised bytes on the wire
• netfilter: ebt_nflog: pin the NFLOG backend
• net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header
• net: octeontx2-pf: Fix UB in shift operation
• net/sched: reject overly deep qdisc hierarchies
• net: openvswitch: reallocate update replies for mismatched IDs
• net/packet: reset the MAC header on the packet-socket transmit path
• ipvs: clear IPv4 options after rebasing tunnel ICMP errors
• ipvs: properly update the overload flag on dest edit
• ipvs: add totalconns for dest
• ima: fix out-of-bounds read in xattr_verify()
• Input: evdev - fix information leak in evdev_pass_values()
• vt: stabilize tty reference in kbd_keycode with tty_port_tty_get
• vt: add permission check for KDSKBMETA ioctl
• net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup()
• usb: gadget: f_ncm: Use unsigned int for ndp_index
• usb: cdnsp: fix incorrect endian conversions for APB timeout register
• thunderbolt: icm: Preserve USB4 proxy data-valid bit
• usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm()
• ALSA: usb-audio: fix OOB write on Type II inbound URBs
• Input: evdev - sanitize event type index when fetching event masks
• spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers
• KVM: x86: Check for invalid/obsolete root after making MMU pages available
• KVM: x86/mmu: Rename __direct_map() to direct_map()
• hwmon: (ads7828) Fix external VREF regulator handling
• regulator: devres: add API for reference voltage supplies
• hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination
• tls: don't abort the connection on signal-interrupted sends
• sctp: clear control chunk transport if it is being removed
• net/atm: fix slab-out-of-bounds read in vcc_setsockopt()
• ata: pata_sl82c105: fix bridge revision use-after-free
• net: thunderbolt: Tear down DMA paths before stopping the rings
• net: qrtr: ns: Raise lookup limit to 128
• net/smc: fix TOCTOU race between smc_listen_out() and listener close
• net: remove WARN_ON_ONCE() from sk_mc_loop()
• net: prestera: validate firmware header length
• net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length
• tcp: fix TFO max_qlen accounting across reuseport migration
• sctp: fix addip_serial increment on ASCONF_ACK allocation failure
• bnxt_en: Fix PTP PPS setting bug
• bnxt_en: Disable EOP for TPA on all chips to prevent data corruption
• bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips
• selftests/ftrace: refactor eprobes test to fix argument checks
• hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations
• hwmon: (lm25066) Use i2c_get_match_data()
• hwmon: (nzxt-smart2) Check return value of init_device() in probe
• net/openvswitch: check Ethernet header length in key_extract()
• net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter
• udp: fix potential use-after-free in tunnel segmentation
• vhost/vdpa: reject overflowing PA map page counts on 32-bit
• bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()
• bpf: tcp: Avoid socket skips and repeats during iteration
• bpf: tcp: Use bpf_tcp_iter_batch_item for bpf_tcp_iter_state batch items
• bpf: tcp: Get rid of st_bucket_done
• bpf: tcp: Make sure iter->batch always contains a full bucket snapshot
• bpf: tcp: Make mem flags configurable through bpf_iter_tcp_realloc_batch
• tcp: add a scheduling point in established_get_first()
• counter: microchip-tcb-capture: Fix DT channel validation
• net/mlx5: fw_tracer, return NULL on create error
• net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete
• net/sched: cls_route: fix fastmap use-after-free on filter
• net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler()